Spyware / Malware / Virus Removal

[Resolved] A veritable cocktail of problems

23 min read

Looking for the outcome? Ask AI

ristah Topic Starter

Post #1September 24, 2007, 9:19 PM UTC

Hi guys, my name is Tristan, I'm from Australia, and I'm a moderately experienced computer user (though not compared to you fellas!) running Win XP pro.

I registered after being impressed by the friendliness and quality of the volunteers. I came across the site when my Google search hit this post: http://forums.whatthetech.com/Cant_Get_Rid…ups_t83420.html

It seems to be an identical problem to mine, though I'd rather try to solve the issues before resorting to a format/restore.

I'll append the results of my Hijackthis log file after a brief rundown of the situation.

1) The computer is very slow, particularly when surfing.

2) Exes regularly fail when they're opened, although it's hit and miss, sometimes they work. The worst failure involves "services", which leads to the NT/Administrator box popping up and shutting down the comp after 1 minute elapses.

3) Combofix had troubles, used after a plain reboot, and a safe mode boot, resulting in the following message windows:

at.exe Application Error
Failed to initialise properly

and

Ox>[]
Unable to open script file

3) I get regular pop-ups, both in IE and Firefox.

4) The Ikarus virus utilities suite seemed to think just about everything was infected. "Fixing" some of those errors seems to have resulted in certain applications not running.

5) When AVG tries to start up on boot it gets: "Application cannot run due to an error while verifying its electronic certificate"

6) SPSS (A statistical package) tries to install when I run certain other exes.

7) I seem to have exhausted my standard measures, which include scanning with AVG, Spybot S&D and Trendmicro's Housecall online scanner.

Here's my log.

Logfile of HijackThis v1.99.1
Scan saved at 5:34:55 AM, on 9/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\AIM6\aim6.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\shtsqsrc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\yupdater.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B4DF2CE-D139-4164-BF9E-B5DA5021395B} - C:\WINDOWS\system32\pmnlj.dll (file missing)
O2 - BHO: (no name) - {64B94229-7967-860A-A0C2-034C02BA876B} - C:\Program Files\Usxghhcl\xpjxwknr.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\system32\fccyaaa.dll (file missing)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Voice Soft - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O2 - BHO: (no name) - {DC0C1DF4-4E21-4180-A2B0-DEB2349F8C4C} - C:\WINDOWS\system32\pmnli.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [yzanytyp] rundll32.exe "C:\Program Files\tunezqbw\tajknmhk.dll",Init
O4 - HKLM\..\Run: [lkzsridw] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lkzsridw.dll"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [E-Gold] C:\WINDOWS\TEMP\VRR18B.tmp
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [SearchIndexer] rundll32.exe "C:\WINDOWS\system32\tohhrnva.dll",sitypnow
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: fccyaaa - fccyaaa.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: MailExport - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: DomainService - - C:\WINDOWS\system32\shtsqsrc.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)

Scotty

Post #2September 24, 2007, 11:02 PM UTC

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

ristah

Post #3September 24, 2007, 11:36 PM UTC

Hi Scotty! Thank you for your assistance. I feel I'm in safe hands

Here's my list Absolute Poker Adobe Anchor Service CS3 Adobe Asset Services CS3 Adobe Bridge 1.0 Adobe Bridge CS3 Adobe Bridge Start Meeting Adobe Camera Raw 4.0 Adobe CMaps Adobe Color - Photoshop Specific Adobe Color Common Settings Adobe Color Common Settings Adobe Color EU Extra Settings Adobe Color JA Extra Settings Adobe Color NA Recommended Settings Adobe Default Language CS3 Adobe Device Central CS3 Adobe ExtendScript Toolkit 2 Adobe ExtendScript Toolkit 2 Adobe Fonts All Adobe Help Viewer CS3 Adobe Linguistics CS3 Adobe PDF Library Files Adobe Photoshop CS3 Adobe Photoshop CS3 Adobe Reader 8.1.0 Adobe Setup Adobe Setup Adobe Setup Adobe Shockwave Player Adobe Stock Photos CS3 Adobe Type Support Adobe Update Manager CS3 Adobe Version Cue CS3 Client Adobe WinSoft Linguistics Plugin Adobe XMP Panels CS3 Adobe® Photoshop® Album Starter Edition 3.2 AIM 6 AOL Instant Messenger Apple Mobile Device Support Apple Software Update Avernum 2 Avernum Demo AVG 7.5 Azureus Azureus Vuze Baldur's Gate™ II - Throne of Bhaal ™ BioWare Premium Module: Neverwinter Nights - Kingmaker BioWare Premium Module: Neverwinter Nights - ShadowGuard BioWare Premium Module: Neverwinter Nights - Witch's Wake BioWare Premium Module: Neverwinter Nights - Wyvern Crown of Cormyr Bonjour Broadcom 440x 10/100 Integrated Controller Cole2k Media - Codec Pack (Advanced) Command & Conquer The First Decade Command & Conquer™ The First Decade Patch 1.02 Commando Commandos 2: Men of Courage Conexant HDA D110 MDC V.92 Modem Corel WordPerfect Suite 8 Cpukiller3 v1.0.5 DAEMON Tools Dell ResourceCD DivX Codec DivX Content Uploader DivX Converter DivX Player DivX Web Player Empire Earth eMule EV Nova (remove only) Fallout Tactics Fallout2 GameSpy Arcade Geneforge 3 getPlus®_dll Google Desktop Google Earth Google Talk (remove only) Google Toolbar for Firefox Google Video Player GPGNet Guild Wars Hamachi [removed] Heroes II - The Price of Loyalty Heroes of Might and Magic II Heroes of Might and Magic® IV High Definition Audio Driver Package - KB835221 Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB929120) ICQ6 Intel® PROSet/Wireless Software iTunes J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 6 J2SE Runtime Environment 5.0 Update 9 Jagged Alliance 2 Gold - 1.12 Java™ 6 Update 2 Java™ SE Runtime Environment 6 Update 1 LimeWire 4.14.8 Macromedia Flash Player 8 Magic Set Editor 2 - 0.2.7 beta Magic Workstation 0.94f mCore mDriver mDrWiFi mHlpDell Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Device Emulator version 1.0 - ENU Microsoft Document Explorer 2005 Microsoft Document Explorer 2005 Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Microsoft Office XP Professional with FrontPage Microsoft SQL Server 2005 Mobile [ENU] Developer Tools Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Visual J# 2.0 Redistributable Package Microsoft Visual Studio 2005 Professional Edition - ENU Microsoft Windows Journal Viewer mIRC mIWA mLogView mMHouse Mozilla Firefox (2.0.0.7) mPfMgr mPfWiz mProSafe MSDN Library for Visual Studio 2005 MSDN Library for Visual Studio 2005 MSN Music Assistant mSSO MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 6.0 Parser (KB933579) MTG GamePack for Magic Workstation mWlsSafe mWMI mXML MyPlayCity Freecell mZConfig Neverwinter Nights Neverwinter Nights 2 NVIDIA Drivers Oasis™ Golden Glyph Limited Edition OCTGN (remove only) OpenAL PartyGammon PDF Settings PhotoFiltre PowerDVD 5.7 PowerISO Premium Freecell 1.0 Puzzle Quest Demo QuickTime RealPlayer Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB911565) Security Update for Windows Media Player 9 (KB917734) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB918899) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922760) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925454) Security Update for Windows XP (KB925486) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928090) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Senselang Sid Meier's Civilization 4 Sid Meier's Civilization 4 - Beyond the Sword Sid Meier's Civilization 4 - Warlords SigmaTel Audio Skype 2.5 SpeedswitchXP V1.5 SPSS 14.0 for Windows Evaluation Version Spybot - Search & Destroy 1.4 Star Chamber Starcraft Stardock Central Sudoku Synaptics Pointing Device Driver Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB929338) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Ventrilo Client VideoLAN VLC media player 0.8.6c Viewpoint Manager (Remove Only) Viewpoint Media Player Viewpoint Toolbar Warcraft II BNE WinAce Archiver Winamp (remove only) Windows Driver Package - Ricoh Company Memorystick Host Controller (07/09/2005 1.00.01.12) Windows Driver Package - Ricoh Company MMC Host Controller (07/14/2005 1.00.00.06) Windows Driver Package - Ricoh Company xD-Picture Card/SmartMedia Host Controller (07/14/2005 1.00.02.04) Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows Live Messenger Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 WinRAR archiver WoWed 1.1 YahELite 308 Yahoo! Install Manager Yahoo! Messenger Yahoo! Toolbar

Scotty

Post #4September 25, 2007, 8:56 AM UTC

Hi

We'll try something else first then re-download Combofix.

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt in your next reply.

Please download VundoFix.exe to your desktop.

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

ristah

Post #5September 25, 2007, 5:17 PM UTC

Hi there Scotty, sorry about the delay. I fell asleep during the Vundofix scan. Here are the logs as requested:

SDFix: (It asked if I wanted to do something to the hidden files, I said no, tell me if i need to run it again)

SDFix: Version 1.107

Run by [removed] on 2007-09-25 at 19:13

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…

Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\SYSTEM32\NSPRS.DLL - Deleted
C:\WINDOWS\SYSTEM32\SERAUTH1.DLL - Deleted
C:\WINDOWS\SYSTEM32\SERAUTH2.DLL - Deleted
C:\WINDOWS\SYSTEM32\SSPRS.DLL - Deleted
C:\209200~1 - Deleted
C:\Documents and Settings\Tristan\Local Settings\Temp\ubi115.tmp.exe - Deleted
C:\DOCUME~1\Tristan\LOCALS~1\Temp\axs13.tmp - Deleted

Removing Temp Files…

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

Remaining Services:
——————

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
—————

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Mon 23 Oct 2006 52,224 ..SHR — "C:\Program Files\YahELite\Setup.exe"
Tue 18 Sep 2007 6,448 A.SH. — "C:\WINDOWS\system32\jlnmp.bak1"
Fri 31 Aug 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Tue 19 Dec 2006 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Sun 5 Aug 2007 857 …HR — "C:\Documents and Settings\Tristan\Application Data\SecuROM\UserData\securom_v7_01.bak"

Finished!

VundoFix: (It needed to restart twice to get one of the aliens)

VundoFix V6.5.9

Checking Java version…

Java version is 1.5.0.6
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.9
Old versions of java are exploitable and should be removed.

Java version is 1.5.0.11

Scan started at 19:38:08 2007-09-25

Listing files found while scanning….

C:\WINDOWS\system32\avnrhhot.ini
C:\windows\system32\drvcisr.dll
C:\WINDOWS\system32\tohhrnva.dll

Beginning removal…

Attempting to delete C:\WINDOWS\system32\avnrhhot.ini
C:\WINDOWS\system32\avnrhhot.ini Has been deleted!

Attempting to delete C:\windows\system32\drvcisr.dll
C:\windows\system32\drvcisr.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\tohhrnva.dll
C:\WINDOWS\system32\tohhrnva.dll Could not be deleted.

Performing Repairs to the registry.
Done!

Beginning removal…

Attempting to delete C:\WINDOWS\system32\tohhrnva.dll
C:\WINDOWS\system32\tohhrnva.dll Has been deleted!

Performing Repairs to the registry.
Done!

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 03:01, on 2007-09-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B4DF2CE-D139-4164-BF9E-B5DA5021395B} - C:\WINDOWS\system32\pmnlj.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\system32\fccyaaa.dll (file missing)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Voice Soft - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: fccyaaa - fccyaaa.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: MailExport - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)

Scotty

Post #6September 25, 2007, 7:23 PM UTC

Hi

Delete the Combofix icon you have on your Desktop, then navigate to, and delete the following folders, if they are present.

C:\Combofix
C:\Qoobox

Download and Run ComboFix

Download this file from below:

Here
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

ristah

Post #7September 25, 2007, 8:22 PM UTC

Here's the combofix log. I presume I should ignore the submit files for further analysis request?

I got a weird error when I connected to the net just then.

—————————
NSIS Error
—————————
The installer you are trying to use is corrupted or incomplete.
This could be the result of a damaged disk, a failed download or a virus.

You may want to contact the author of this installer to obtain a new copy.

It may be possible to skip this check using the /NCRC command line switch
(NOT RECOMMENDED).
—————————
OK
—————————

ComboFix 07-09-26 - Tristan 2007-09-26 5:54:01.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.350 [GMT 10:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini

.
((((((((((((((((((((((((( Files Created from 2007-08-26 to 2007-09-26 )))))))))))))))))))))))))))))))
.

2007-09-25 19:38 d——– C:\VundoFix Backups
2007-09-25 19:12 d——– C:\WINDOWS\ERUNT
2007-09-25 03:58 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-19 17:44 d——– C:\Program Files\NoAdware5.0
2007-09-18 18:26 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-18 18:04 77,824 –a—— C:\WINDOWS\system32\rundll32.exe
2007-09-18 14:12 6,448 –ahs—- C:\WINDOWS\system32\jlnmp.bak1
2007-09-18 08:56 102,912 –a—— C:\rvdc.exe
2007-09-18 07:00 2,829 –a—— C:\WINDOWS\W2BNEUnin.pif
2007-09-18 07:00 19,840 –a—— C:\WINDOWS\W2BNEUnin.dat
2007-09-18 06:58 d——– C:\Program Files\Warcraft II BNE
2007-09-18 06:53 d——– C:\WINDOWS\system32\okqipwgf
2007-09-18 06:43 d——– C:\Warcraft II BNE
2007-09-18 01:17 d——– C:\WARCRAFT
2007-09-14 21:28 d——– C:\Program Files\Black Isle
2007-09-06 15:39 d——– C:\Program Files\AIM6
2007-09-04 15:58 d——– C:\WIZWORX
2007-09-04 15:58 d——– C:\POOLRAD
2007-09-03 01:46 d——– C:\EYE3
2007-09-03 01:46 d——– C:\EYE2
2007-09-03 01:46 d——– C:\EYE1
2007-08-31 01:45 d——– C:\Documents and Settings\Tristan\.housecall6.6
2007-08-31 00:41 d——– C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-26 05:51 ——— d——– C:\Documents and Settings\Tristan\Application Data\Skype
2007-09-25 19:37 ——— d——– C:\Program Files\ICQ6
2007-09-25 09:16 ——— d——– C:\Program Files\OCTGN
2007-09-25 06:43 ——— d——– C:\Program Files\SPSSEval
2007-09-23 05:24 ——— d——– C:\Documents and Settings\Tristan\Application Data\Azureus
2007-09-23 02:22 ——— d——– C:\Program Files\Azureus
2007-09-19 07:32 ——— d——– C:\Program Files\YahELite
2007-09-19 07:31 ——— d——– C:\Program Files\SpeedswitchXP
2007-09-19 07:31 ——— d——– C:\Program Files\QuickTime
2007-09-19 07:31 ——— d——– C:\Program Files\PowerISO
2007-09-19 07:31 ——— d——– C:\Program Files\D-Tools
2007-09-19 07:31 ——— d——– C:\Program Files\Bonjour
2007-09-19 05:28 ——— d——– C:\Program Files\WoWed
2007-09-18 22:46 ——— d——– C:\Program Files\eMule
2007-09-17 01:34 ——— d——– C:\Program Files\Apple Software Update
2007-09-15 01:02 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-06 16:07 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-06 16:06 ——— d——– C:\Program Files\Common Files\AOL
2007-09-06 15:32 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-08-29 01:31 ——— d——– C:\Program Files\LimeWire
2007-08-21 15:27 ——— d——– C:\Program Files\MSN Messenger
2007-08-18 18:36 ——— d——– C:\Program Files\Fallout2
2007-08-16 12:12 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 16:07 ——— d——– C:\Documents and Settings\Tristan\Application Data\vlc
2007-08-14 16:06 ——— d——– C:\Program Files\VideoLAN
2007-08-13 18:47 ——— d——– C:\Program Files\Microsoft Device Emulator
2007-08-13 18:46 ——— d——– C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
2007-08-13 18:42 ——— d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-08-13 18:40 ——— d——– C:\Program Files\Microsoft Visual Studio 8
2007-08-13 18:40 ——— d——– C:\Program Files\CE Remote Tools
2007-08-10 21:25 ——— d——– C:\Program Files\iTunes
2007-08-10 21:25 ——— d——– C:\Program Files\iPod
2007-08-05 21:45 ——— d——– C:\Documents and Settings\Tristan\Application Data\Media Center Programs
2007-08-05 21:19 ——— d——– C:\Documents and Settings\Tristan\Application Data\InstallShield Installation Information
2007-08-02 20:39 ——— d——– C:\Program Files\Command & Conquer The First Decade
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-29 13:21 ——— d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-06-26 16:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-04-29 00:14 26 –a—— C:\Documents and Settings\Tristan\p.bat
2004-08-04 20:00 276480 —-s—- C:\WINDOWS\Media\SendMail.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B4DF2CE-D139-4164-BF9E-B5DA5021395B}]
C:\WINDOWS\system32\pmnlj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9370EFDE-C0DA-42C9-B609-41C87B462011}]
C:\WINDOWS\system32\fccyaaa.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C222CF73-124F-3562-44AC-E685D962C63C}]
2004-08-04 20:00 276480 —-s—- C:\WINDOWS\Media\sendmail.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" []
"NVHotkey"="nvHotkey.dll" [2006-03-21 20:03 C:\WINDOWS\system32\nvhotkey.dll]
"DVDLauncher"="C:\Program Files\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-30 22:11]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-25 11:28]
"nwiz"="nwiz.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-18 19:41]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 20:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"SpeedswitchXP"="C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe" []
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-09-25 06:43]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-28 07:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

C:\Documents and Settings\Tristan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-06-07 00:54:52]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{9370EFDE-C0DA-42C9-B609-41C87B462011}"= C:\WINDOWS\system32\fccyaaa.dll [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"MailExport"= {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll [2004-08-04 20:00 276480]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccyaaa]
fccyaaa.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzlo32]
winzlo32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

R3 ICAM5USB;Intel® PC Camera CS110;C:\WINDOWS\system32\Drivers\ICAM5D2.sys
R3 portio;winThrottle PortIO Service;C:\WINDOWS\system32\DRIVERS\throttle.sys
S3 NTGUARD;NTGUARD;\??\C:\Program Files\Ikarus\virus utilities\bin\NTGUARD.SYS
S3 oflpydin;oflpydin;\??\C:\DOCUME~1\Tristan\LOCALS~1\Temp\oflpydin.sys
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 23:13:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 06:00:07
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-09-26 6:01:06
C:\ComboFix-quarantined-files.txt … 2007-09-26 06:00
.
— E O F —

Here's HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 06:14, on 2007-09-26
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\OCTGN\OCTGN.exe
C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\devenv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Tristan\My Documents\Visual Studio 2005\Projects\Demo\Demo\bin\Debug\Demo.vshost.exe
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\NirCmd.exe
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\2.exe
C:\Program Files\Adobe\Adobe Photoshop CS3\Photoshop.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4B4DF2CE-D139-4164-BF9E-B5DA5021395B} - C:\WINDOWS\system32\pmnlj.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {9370EFDE-C0DA-42C9-B609-41C87B462011} - C:\WINDOWS\system32\fccyaaa.dll (file missing)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Voice Soft - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O2 - BHO: Editor plugin - {DC1CCBD3-F6B7-458f-8412-3687E06FB393} - netmonit.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: fccyaaa - fccyaaa.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winzlo32 - winzlo32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: MailExport - {C222CF73-124F-3562-44AC-E685D962C63C} - C:\WINDOWS\Media\sendmail.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)

Scotty

Post #8September 25, 2007, 10:24 PM UTC

Hi What file submit request?

ristah

Post #9September 25, 2007, 10:25 PM UTC

—————————
Submit Files for further analysis
—————————
ComboFix needs to submit malware files for further analysis.

Please ensure that you're connected to the internet before clicking OK
—————————
OK
—————————

And

Submit malware to Bleeping Computer for analysis.

Copy/Paste the filepath below into the box above and click Send.

C:\Documents and Settings\Tristan\Desktop.\[4]-[removed]

Scotty

Post #10September 25, 2007, 10:33 PM UTC

By all means submit them. It will help in the future. Let me know when you do that then we will press on.

ristah

Post #11September 25, 2007, 10:40 PM UTC

Upwards and onwards then, Doc!

Scotty

Post #12September 25, 2007, 11:09 PM UTC

Hi

Go to http://www.virustotal.com/en/indexf.html
Copy the following line into the white textbox:
C:\rvdc.exe
Click Send.
Please post the results of this scan to this thread.

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\system32\jlnmp.bak1
C:\WINDOWS\system32\okqipwgf
C:\WINDOWS\system32\pmnlj.dll
C:\WINDOWS\system32\fccyaaa.dll
C:\WINDOWS\system32\winzlo32.dll
C:\DOCUME~1\Tristan\LOCALS~1\Temp\oflpydin.sys

Folder::
C:\WINDOWS\Media
C:\VundoFix Backups

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4B4DF2CE-D139-4164-BF9E-B5DA5021395B}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9370EFDE-C0DA-42C9-B609-41C87B462011}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C222CF73-124F-3562-44AC-E685D962C63C}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{9370EFDE-C0DA-42C9-B609-41C87B462011}"=-
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccyaaa] 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzlo32]

Driver::
oflpydin

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

ristah

Post #13September 25, 2007, 11:33 PM UTC

Here's the next batch:

File rvdc.exe_ received on 09.26.2007 01:08:11 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 6/32 (18.75%)
Loading server information…
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.9.22.0 2007.09.24 -
AntiVir 7.6.0.15 2007.09.25 -
Authentium 4.93.8 2007.09.25 -
Avast 4.7.1043.0 2007.09.24 -
AVG 7.5.0.485 2007.09.25 -
BitDefender 7.2 2007.09.25 -
CAT-QuickHeal 9.00 2007.09.24 -
ClamAV 0.91.2 2007.09.26 W32.Virut.Gen.C-99
DrWeb 4.33 2007.09.25 -
eSafe 7.0.15.0 2007.09.23 suspicious Trojan/Worm
eTrust-Vet 31.2.5164 2007.09.25 -
Ewido 4.0 2007.09.25 -
FileAdvisor 1 2007.09.26 -
Fortinet 3.11.0.0 2007.09.25 -
F-Prot 4.3.2.48 2007.09.25 -
F-Secure 6.70.13030.0 2007.09.25 -
Ikarus T3.1.1.12 2007.09.25 Trojan-Spy.Win32.Delf.jp
Kaspersky 4.0.2.24 2007.09.26 -
McAfee 5127 2007.09.25 -
Microsoft 1.2803 2007.09.26 -
NOD32v2 2550 2007.09.25 -
Norman 5.80.02 2007.09.25 -
Panda 9.0.0.4 2007.09.25 Suspicious file
Prevx1 V2 2007.09.26 Heuristic: Suspicious Browser Help Object
Rising 19.42.11.00 2007.09.25 -
Sophos 4.21.0 2007.09.25 -
Sunbelt 2.2.907.0 2007.09.25 -
Symantec 10 2007.09.26 -
TheHacker 6.2.5.068 2007.09.25 -
VBA32 3.12.2.4 2007.09.25 suspected of Backdoor.XiaoBird.58 (paranoid heuristics)
VirusBuster 4.3.26:9 2007.09.25 -
Webwasher-Gateway 6.0.1 2007.09.25 -
Additional information
File size: 102912 bytes
MD5: 1f072fbff94b56deaadd78ec43ae95ba
SHA1: b835b243ebadc1c7b34dcca2d842db19820ae294
packers: UPX
packers: UPX
packers: UPX
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…7CE7100FCF89D4A

ComboFix

ComboFix 07-09-26 - Tristan 2007-09-26 9:09:49.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.294 [GMT 10:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Tristan\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\system32\jlnmp.bak1
C:\WINDOWS\system32\okqipwgf
C:\WINDOWS\system32\pmnlj.dll
C:\WINDOWS\system32\fccyaaa.dll
C:\WINDOWS\system32\winzlo32.dll
C:\DOCUME~1\Tristan\LOCALS~1\Temp\oflpydin.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups
C:\VundoFix Backups\avnrhhot.ini.bad
C:\VundoFix Backups\drvcisr.dll.bad
C:\VundoFix Backups\tohhrnva.dll.bad
C:\WINDOWS\Media
C:\WINDOWS\Media\chimes.wav
C:\WINDOWS\Media\chord.wav
C:\WINDOWS\Media\ding.wav
C:\WINDOWS\Media\flourish.mid
C:\WINDOWS\Media\notify.wav
C:\WINDOWS\Media\onestop.mid
C:\WINDOWS\Media\recycle.wav
C:\WINDOWS\Media\ringin.wav
C:\WINDOWS\Media\ringout.wav
C:\WINDOWS\Media\SendMail.dll
C:\WINDOWS\Media\silent.wav
C:\WINDOWS\Media\start.wav
C:\WINDOWS\Media\tada.wav
C:\WINDOWS\Media\town.mid
C:\WINDOWS\Media\Windows Feed Discovered.wav
C:\WINDOWS\Media\Windows Information Bar.wav
C:\WINDOWS\Media\Windows Navigation Start.wav
C:\WINDOWS\Media\Windows Pop-up Blocked.wav
C:\WINDOWS\Media\Windows XP Balloon.wav
C:\WINDOWS\Media\Windows XP Battery Critical.wav
C:\WINDOWS\Media\Windows XP Battery Low.wav
C:\WINDOWS\Media\Windows XP Critical Stop.wav
C:\WINDOWS\Media\Windows XP Default.wav
C:\WINDOWS\Media\Windows XP Ding.wav
C:\WINDOWS\Media\Windows XP Error.wav
C:\WINDOWS\Media\Windows XP Exclamation.wav
C:\WINDOWS\Media\Windows XP Hardware Fail.wav
C:\WINDOWS\Media\Windows XP Hardware Insert.wav
C:\WINDOWS\Media\Windows XP Hardware Remove.wav
C:\WINDOWS\Media\Windows XP Information Bar.wav
C:\WINDOWS\Media\Windows XP Logoff Sound.wav
C:\WINDOWS\Media\Windows XP Logon Sound.wav
C:\WINDOWS\Media\Windows XP Menu Command.wav
C:\WINDOWS\Media\Windows XP Minimize.wav
C:\WINDOWS\Media\Windows XP Notify.wav
C:\WINDOWS\Media\Windows XP Pop-up Blocked.wav
C:\WINDOWS\Media\Windows XP Print complete.wav
C:\WINDOWS\Media\Windows XP Recycle.wav
C:\WINDOWS\Media\Windows XP Restore.wav
C:\WINDOWS\Media\Windows XP Ringin.wav
C:\WINDOWS\Media\Windows XP Ringout.wav
C:\WINDOWS\Media\Windows XP Shutdown.wav
C:\WINDOWS\Media\Windows XP Start.wav
C:\WINDOWS\Media\Windows XP Startup.wav
C:\WINDOWS\system32\help.txt
C:\WINDOWS\system32\jlnmp.bak1

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_OFLPYDIN
——-\oflpydin

((((((((((((((((((((((((( Files Created from 2007-08-25 to 2007-09-25 )))))))))))))))))))))))))))))))
.

2007-09-26 09:19 106,496 –a—— C:\nawf.exe
2007-09-26 06:30 1 –a—— C:\WINDOWS\system32\ps1.dat
2007-09-26 06:30 1 –a—— C:\WINDOWS\system32\cookie1.dat
2007-09-26 06:03 59,904 –a—— C:\uhded.exe
2007-09-26 06:03 52,224 –a—— C:\WINDOWS\system32\netmonit.dll
2007-09-26 06:03 5,632 –a—— C:\pqukg.exe
2007-09-25 19:12 d——– C:\WINDOWS\ERUNT
2007-09-25 03:58 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-09-19 17:44 d——– C:\Program Files\NoAdware5.0
2007-09-18 18:26 d–h—– C:\WINDOWS\system32\GroupPolicy
2007-09-18 18:04 77,824 –a—— C:\WINDOWS\system32\rundll32.exe
2007-09-18 08:56 102,912 –a—— C:\rvdc.exe
2007-09-18 07:00 2,829 –a—— C:\WINDOWS\W2BNEUnin.pif
2007-09-18 07:00 19,840 –a—— C:\WINDOWS\W2BNEUnin.dat
2007-09-18 06:58 d——– C:\Program Files\Warcraft II BNE
2007-09-18 06:53 d——– C:\WINDOWS\system32\okqipwgf
2007-09-18 06:43 d——– C:\Warcraft II BNE
2007-09-18 01:17 d——– C:\WARCRAFT
2007-09-14 21:28 d——– C:\Program Files\Black Isle
2007-09-06 15:39 d——– C:\Program Files\AIM6
2007-09-04 15:58 d——– C:\WIZWORX
2007-09-04 15:58 d——– C:\POOLRAD
2007-09-03 01:46 d——– C:\EYE3
2007-09-03 01:46 d——– C:\EYE2
2007-09-03 01:46 d——– C:\EYE1
2007-08-31 01:45 d——– C:\Documents and Settings\Tristan\.housecall6.6
2007-08-31 00:41 d——– C:\Documents and Settings\Incomplete\COMHH4HAAZTWLOBUDSRG57NPCL4SXX2S

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-09-26 08:47 ——— d——– C:\Documents and Settings\Tristan\Application Data\Skype
2007-09-25 19:37 ——— d——– C:\Program Files\ICQ6
2007-09-25 09:16 ——— d——– C:\Program Files\OCTGN
2007-09-25 06:43 ——— d——– C:\Program Files\SPSSEval
2007-09-23 05:24 ——— d——– C:\Documents and Settings\Tristan\Application Data\Azureus
2007-09-23 02:22 ——— d——– C:\Program Files\Azureus
2007-09-19 07:32 ——— d——– C:\Program Files\YahELite
2007-09-19 07:31 ——— d——– C:\Program Files\SpeedswitchXP
2007-09-19 07:31 ——— d——– C:\Program Files\QuickTime
2007-09-19 07:31 ——— d——– C:\Program Files\PowerISO
2007-09-19 07:31 ——— d——– C:\Program Files\D-Tools
2007-09-19 07:31 ——— d——– C:\Program Files\Bonjour
2007-09-19 05:28 ——— d——– C:\Program Files\WoWed
2007-09-18 22:46 ——— d——– C:\Program Files\eMule
2007-09-17 01:34 ——— d——– C:\Program Files\Apple Software Update
2007-09-15 01:02 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-09-06 16:07 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-06 16:06 ——— d——– C:\Program Files\Common Files\AOL
2007-09-06 15:32 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-08-29 01:31 ——— d——– C:\Program Files\LimeWire
2007-08-21 15:27 ——— d——– C:\Program Files\MSN Messenger
2007-08-18 18:36 ——— d——– C:\Program Files\Fallout2
2007-08-16 12:12 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 16:07 ——— d——– C:\Documents and Settings\Tristan\Application Data\vlc
2007-08-14 16:06 ——— d——– C:\Program Files\VideoLAN
2007-08-13 18:47 ——— d——– C:\Program Files\Microsoft Device Emulator
2007-08-13 18:46 ——— d——– C:\Program Files\Microsoft SQL Server 2005 Mobile Edition
2007-08-13 18:42 ——— d——– C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-08-13 18:40 ——— d——– C:\Program Files\Microsoft Visual Studio 8
2007-08-13 18:40 ——— d——– C:\Program Files\CE Remote Tools
2007-08-10 21:25 ——— d——– C:\Program Files\iTunes
2007-08-10 21:25 ——— d——– C:\Program Files\iPod
2007-08-05 21:45 ——— d——– C:\Documents and Settings\Tristan\Application Data\Media Center Programs
2007-08-05 21:19 ——— d——– C:\Documents and Settings\Tristan\Application Data\InstallShield Installation Information
2007-08-02 20:39 ——— d——– C:\Program Files\Command & Conquer The First Decade
2007-07-29 13:21 ——— d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2007-04-29 00:14 26 –a—— C:\Documents and Settings\Tristan\p.bat
.

((((((((((((((((((((((((((((( snapshot_2007-09-26_ 60030.32 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 16,384 2007-09-25 23:18:38 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-25 23:18:38 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
—-a-w 32,768 2007-09-25 23:18:38 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
—-a-w 3,584 2007-09-25 23:19:04 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\89ABCDEF\dl[1].exe
—-a-w 8,192 2007-09-25 23:18:54 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GHIJKLMN\adv735[1].exe
.
—-a-w 16,384 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
—-a-w 32,768 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
—-a-w 32,768 2007-09-25 16:43:53 C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DC1CCBD3-F6B7-458f-8412-3687E06FB393}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" []
"NVHotkey"="nvHotkey.dll" [2006-03-21 20:03 C:\WINDOWS\system32\nvhotkey.dll]
"DVDLauncher"="C:\Program Files\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-30 22:11]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" []
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" []
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-25 11:28]
"nwiz"="nwiz.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" []
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-09-18 19:41]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-02 07:22]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [2006-11-30 20:49]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2006-06-12 17:33]
"SpeedswitchXP"="C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe" []
"ICQ"="C:\Program Files\ICQ6\ICQ.exe" [2007-09-25 06:43]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 20:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-28 07:17]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
1.exe [2007-09-26 06:03:18]
2.exe [2007-09-26 06:03:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

C:\Documents and Settings\Tristan\Start Menu\Programs\Startup\
PowerReg Scheduler V3.exe [2006-06-07 00:54:52]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
1.exe [2007-09-26 06:03:18]
2.exe [2007-09-26 06:03:24]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

R3 ICAM5USB;Intel® PC Camera CS110;C:\WINDOWS\system32\Drivers\ICAM5D2.sys
R3 portio;winThrottle PortIO Service;C:\WINDOWS\system32\DRIVERS\throttle.sys
S3 NTGUARD;NTGUARD;\??\C:\Program Files\Ikarus\virus utilities\bin\NTGUARD.SYS
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80

.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 23:13:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-26 09:19:11
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

**************************************************************************
.
Completion time: 2007-09-26 9:22:21 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-09-26 09:21
C:\ComboFix2.txt … 2007-09-26 06:01
.
— E O F —

HijackThis

Logfile of HijackThis v1.99.1
Scan saved at 9:27:42 AM, on 9/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\PowerDVD\DVDLauncher.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\ICQ6\ICQ.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll
O2 - BHO: Editor plugin - {DC1CCBD3-F6B7-458f-8412-3687E06FB393} - netmonit.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [SpeedswitchXP] C:\Program Files\SpeedswitchXP\SpeedswitchXP.exe
O4 - HKCU\..\Run: [ICQ] "C:\Program Files\ICQ6\ICQ.exe" silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: 1.exe
O4 - Global Startup: 2.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Tristan\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra 'Tools' menuitem: PartyGammon.com - {59A861EE-32B3-42cd-8CCA-FC130EDF3A44} - C:\Program Files\PartyGaming\PartyGammon\RunBackGammon.exe
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A16BB4EC-0357-4A91-83F7-3418EE3A6D2F}: NameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\..\{DB1046F5-2CFC-498B-8E58-9C657F86AA1A}: NameServer = 192.168.1.254
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Unknown owner - C:\Program Files\Bonjour\mDNSResponder.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoogleDesktopManager - Unknown owner - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - Unknown owner - C:\WINDOWS\system32\nvsvc32.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Unknown owner - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe (file missing)

Doing the kapersky scan now. Phew.

PS. You're a champ, mate.

ristah

Post #14September 26, 2007, 5:43 AM UTC

Well Scotty….I'm afraid we have our work cut out for us.

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Wednesday, September 26, 2007 3:12:52 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 26/09/2007
Kaspersky Anti-Virus database records: 423559
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
E:\
F:\
G:\
H:\
J:\

Scan Statistics:
Total number of scanned objects: 192656
Number of viruses found: 10
Number of infected objects: 5488
Number of suspicious objects: 2
Duration of the scan process: 05:10:13

I have a list of 5400 infected objects. Two-thirds of them look like this (in bold are the common attributes): C:\System Volume Information\_restore{5405DBBD-BD94-45F7-92A2-1CC872A047A4}\RP473\A0064723.exe Infected: Virus.Win32.Virut.q skipped

Some of the viruses/malware are:

Virus.Win32.Virut.q (This comprises 99% of the entries. I ran Ikarus' scan earlier and assumed that this fella created a lot of false positives, as the infected files were improbably numerous and in unusual locations, such as in exes I compiled in VB)
Trojan-Downloader.Win32.VB.bgd
Trojan-Downloader.Win32.Agent.dkc
Trojan.Win32.Obfuscated.ic
Trojan-Downloader.Win32.LoadAdv.gen
Trojan.Win32.Dialer.qn
not-a-virus:AdWare.Win32.Virtumonde.tg
not-a-virus:AdWare.Win32.PurityScan.fk

The following entries are, I believe, the source of most of the issues. I figured I was savvy enough to take a crack site on the chin, and i dealt with a host of the problems I encountered as a result. The ironic thing, I wasn't even cracking something i didn't have. The CD and it's key simply wasn't on hand. Not that I've never cracked illegally before, I've done it a handful of times, but I typically avoid crack/warez sites. Lesson learned first hand eh.

C:\System Volume Information\_restore{5405DBBD-BD94-45F7-92A2-1CC872A047A4}\RP472\A0063275.exe/data.rar/keygen.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.tg skipped
C:\System Volume Information\_restore{5405DBBD-BD94-45F7-92A2-1CC872A047A4}\RP472\A0063275.exe/data.rar/patch.exe Infected: Trojan.Win32.Dialer.qn skipped
C:\System Volume Information\_restore{5405DBBD-BD94-45F7-92A2-1CC872A047A4}\RP472\A0063275.exe/data.rar/crack.exe Infected: Trojan-Downloader.Win32.LoadAdv.gen skipped
C:\System Volume Information\_restore{5405DBBD-BD94-45F7-92A2-1CC872A047A4}\RP472\A0063275.exe/data.rar/install.exe Infected: Virus.Win32.Virut.q skipped

Let me know what else I can usefully derive from this list. Otherwise I could just send you the text file.

ristah

Post #15September 26, 2007, 5:52 AM UTC

A couple other files I thought were suspicious were C:\pqukg.exe, C:\uhded.exe and C:\nawf.exe. I uploaded nawf to virustotal, but the other two wouldn't send.

File nawf.exe received on 09.26.2007 07:40:20 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 20/32 (62.5%)
Loading server information…
Your file is queued in position: 1.
Estimated start time is between 39 and 56 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Compact
Print results Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:

Antivirus Version Last Update Result
AhnLab-V3 2007.9.22.0 2007.09.24 -
AntiVir 7.6.0.15 2007.09.25 W32/Virut.X
Authentium 4.93.8 2007.09.25 -
Avast 4.7.1043.0 2007.09.26 Win32:Virut
AVG 7.5.0.485 2007.09.25 -
BitDefender 7.2 2007.09.26 Generic.Spy.Finanz.D57CFC08
CAT-QuickHeal 9.00 2007.09.24 W32.Virut.F
ClamAV 0.91.2 2007.09.26 -
DrWeb 4.33 2007.09.25 Win32.Virut.5
eSafe 7.0.15.0 2007.09.23 -
eTrust-Vet 31.2.5164 2007.09.25 -
Ewido 4.0 2007.09.25 -
FileAdvisor 1 2007.09.26 -
Fortinet 3.11.0.0 2007.09.26 W32/Virut.F
F-Prot 4.3.2.48 2007.09.25 -
F-Secure 6.70.13030.0 2007.09.26 Virus.Win32.Virut.q
Ikarus T3.1.1.12 2007.09.26 Trojan-Spy.Win32.Banker
Kaspersky 4.0.2.24 2007.09.26 Virus.Win32.Virut.q
McAfee 5127 2007.09.25 W32/Virut.gen
Microsoft 1.2803 2007.09.26 -
NOD32v2 2550 2007.09.25 a variant of Win32/Virut
Norman 5.80.02 2007.09.25 -
Panda 9.0.0.4 2007.09.26 Suspicious file
Prevx1 V2 2007.09.26 Heuristic: Suspicious Self Modifying File
Rising 19.42.21.00 2007.09.26 Win32.Virut.GEN
Sophos 4.21.0 2007.09.26 W32/Vetor-A
Sunbelt 2.2.907.0 2007.09.26 VIPRE.Suspicious
Symantec 10 2007.09.26 W32.Virut.U
TheHacker 6.2.6.070 2007.09.26 -
VBA32 3.12.2.4 2007.09.26 Virus.Win32.Virut.f
VirusBuster 4.3.26:9 2007.09.25 Win32.Virut.J
Webwasher-Gateway 6.0.1 2007.09.25 Win32.Virut.X
Additional information
File size: 106496 bytes
MD5: bbab25c9ffd6cfdcacfbfa874af4b4a6
SHA1: 13990756c9c22576ad738d66986906fb4e1cbeb7
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…7A053008F4C8FF7
Sunbelt info: VIPRE.Suspicious is a generic detection for potential threats that are deemed suspicious through heuristics.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] A veritable cocktail of problems

✨ Ask AI

Ask AI