Spyware / Malware / Virus Removal

[Resolved] jkkjkl.dll problem.

9 min read

Looking for the outcome? Ask AI

macditty Topic Starter

Post #1October 3, 2007, 9:11 PM UTC

ok a short description of my problem. i am a linux user, i logged onto my mothers computer and i was having tons of popups, she didnt see this as odd because windows has always done this. anyway i did a scan and cleared most of the stuff but one program is giving me problems. i cant seem to shake it. please help, im not used to dealing with all of this new spyware technology in windows being away for so long.

hijackthis log ————-
Logfile of HijackThis v1.99.1
Scan saved at 4:46:09 PM, on 10/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\Program Files\Eset\nod32kui.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Unlocker\UnlockerAssistant.exe
C:\Program Files\EssNetTools3\Ent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13F815B5-BC6E-43C4-AE05-9EBC2408468C} - (no file)
O2 - BHO: (no name) - {2D624F0B-9EDA-46CD-A29C-B07CCC4A6638} - (no file)
O2 - BHO: (no name) - {3AA3D6F8-D18A-470F-A9EA-DB354A350970} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73552DCE-4D7F-4D47-93D7-41BB4A9CA501} - (no file)
O2 - BHO: (no name) - {7f9aaf14-478f-4b6b-b0c1-7322427f46ec} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\system32\cwyuldai.dll (file missing)
O2 - BHO: (no name) - {92D4828D-EE1F-4056-A49D-9733885CF4C8} - (no file)
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
O2 - BHO: (no name) - {B8B6B908-BFB0-4BBE-A940-0094BADF099F} - (no file)
O2 - BHO: (no name) - {D73F0BA8-5E00-4784-9FE8-545BE1D78CA2} - C:\WINDOWS\system32\jkkjk.dll (file missing)
O2 - BHO: (no name) - {DE8BA79A-6281-4795-92EF-5C186D7E2E76} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Essential NetTools] C:\Program Files\EssNetTools3\Ent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: ljjhigh - C:\WINDOWS\
O20 - Winlogon Notify: urqppol - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\oseoqjrm.exe (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

a few more logs and events from NOD32 the one in bold worries me
Time Module Object Name Threat Action User Information
10/3/2007 15:53:12 PM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\C5MRCLOF\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/3/2007 15:51:06 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\amnymcjn.exe Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/3/2007 15:50:48 PM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan Connection terminated YOUR-AE066C3A9B\HP_Owner
10/3/2007 7:05:09 AM AMON file C:\WINDOWS\system32\dxlhoaho.dll a variant of Win32/BHO.G trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a file modified by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/2/2007 7:29:32 AM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\O9EZGD6J\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/2/2007 7:29:32 AM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\iepnqxbf.exe Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/2/2007 7:29:31 AM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan YOUR-AE066C3A9B\HP_Owner
10/2/2007 6:29:49 AM AMON file C:\WINDOWS\system32\varapbbx.dll a variant of Win32/BHO.G trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a file modified by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:36:10 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\uetuhxdp.dll a variant of Win32/BHO.G trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\explorer.exe. The file was moved to quarantine. You may close this window.
10/1/2007 19:27:27 PM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\XZ9NXY3H\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\explorer.exe. The file was moved to quarantine. You may close this window.
10/1/2007 19:27:27 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\sutuuiyc.exe Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\explorer.exe. The file was moved to quarantine. You may close this window.
10/1/2007 19:27:27 PM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan YOUR-AE066C3A9B\HP_Owner
10/1/2007 19:26:02 PM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\Q7MRODC9\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:25:55 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\rmkhnjar.exe Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:25:53 PM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan Connection terminated YOUR-AE066C3A9B\HP_Owner
10/1/2007 19:17:57 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\qkhrbnrk.dll a variant of Win32/BHO.G trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:14:04 PM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE552R41UJ\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:13:56 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\xooyxolr.exe Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:13:49 PM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan Connection terminated YOUR-AE066C3A9B\HP_Owner
10/1/2007 19:12:13 PM AMON file C:\DOCUME~1\HP_Owner\LOCALS~1\Temp\nyixiftf.dll a variant of Win32/BHO.G trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:11:46 PM AMON file C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\Q7MRODC9\valera[1] Win32/Agent.BCK trojan quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred on a new file created by the application: C:\WINDOWS\Explorer.EXE. The file was moved to quarantine. You may close this window.
10/1/2007 19:11:35 PM IMON file http://82.98.235.78/netob/valera.exe?uid=6…0CA6A391F503BB4 Win32/Agent.BCK trojan quarantined - Connection terminated YOUR-AE066C3A9B\HP_Owner
10/1/2007 6:18:34 AM AMON file C:\Program Files\AWS\WeatherBug\MiniBugTransporter.dll Win32/Adware.WBug.A application quarantined - deleted YOUR-AE066C3A9B\HP_Owner Event occurred at an attempt to access the file by the application: C:\Documents and Settings\HP_Owner\Desktop\FixVundo.exe.

Scotty

Post #2October 3, 2007, 10:24 PM UTC

Hi! Welcome to the WTT forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient and I'd be grateful if you would note the following:

I will working be on your Malware issues, this may or may not, solve other issues you have with your machine.
The fixes are specific to your problem and should only be used for this issue on this machine.
Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
It's often worth reading through these instructions and printing them for ease of reference.
If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
Please reply to this thread. Do not start a new topic.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

Download and Run ComboFix

Download this file from below:

Here
Disconnect from the Internet, than disable your anti-virus and any real-time anti-spyware monitors that are running.
Then double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

Note 1: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Note 2:Remember to re-enable your anti-virus and anti-spyware before reconnecting to the Internet.

macditty

Post #3October 5, 2007, 10:29 AM UTC

Uninstal manager:
Adobe Acrobat - Reader 6.0.2 Update
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Reader 6.0.1
Agere Systems PCI Soft Modem
AOL Uninstaller (Choose which Products to Remove)
Avanquest update
BitPim 1.0.1
Driver Magician 3.25
Full Tilt Poker
Help and Support Additions
High Definition Audio Driver Package - KB835221
HijackThis 1.99.1
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
HP Deskjet Preloaded Printer Drivers
HP Image Zone 4.2
HP Image Zone Plus 4.2
HP Photo & Imaging 3.5 - HP Devices
HP PSC & OfficeJet 4.0
HP Software Update
HPIZ402
ICQ6
IntelliMover Data Transfer Demo
InterVideo WinDVD Creator 2
InterVideo WinDVD Player
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Kaspersky Anti-Virus 7.0
Kaspersky Anti-Virus 7.0
Microsoft .NET Framework 1.1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office Standard Edition 2003
Microsoft Plus! Dancer LE
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works 7.0
Motorola Driver Installation
Motorola Phone Tools
Motorola Software Update
Mozilla Firefox (2.0.0.7)
MSXML 4.0 SP2 (KB936181)
muvee autoProducer 3.5 magicMoments - HPD
NOD32 antivirus system
Norton Internet Security
Photosmart 320,370,7400,8100,8400 Series
Python 2.2 combined Win32 extensions
Python 2.2.1
QuickTime
RealPlayer
S3 S3Display
S3 S3Gamma2
S3 S3Info2
S3 S3Overlay
Sandlot Games Client Services
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Spybot - Search & Destroy
UltimateDefrag
Unlocker 1.8.5
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Updates from HP
VIA Rhine-Family Fast Ethernet Adapter
VIA/S3G Display Driver
Viewpoint Media Player
Windows Installer 3.1 (KB893803)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB883667
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
WinPatrol 2007
WinRAR archiver
Your Uninstaller! 2006 Version 5

combofix log:

ComboFix 07-10-05.3 - HP_Owner 2007-10-05 6:07:31.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.144 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\check_LSA7.txt
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\HP_Owner\err.log
C:\Program Files\Common Files\{34C5C~1
C:\Program Files\Common Files\{34C5C~1\Uninst.exe
C:\Program Files\Common Files\{E4C5C~1
C:\Program Files\Common Files\projyd.html
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\MSN Messenger\msimg32.dll
C:\Program Files\WinAble
C:\WINDOWS\cookies.ini
C:\WINDOWS\IA
C:\WINDOWS\system32\aqrhemnu.dll
C:\WINDOWS\system32\C2
C:\WINDOWS\system32\cocybgnk.ini
C:\WINDOWS\system32\drivers\ApiMon.sys
C:\WINDOWS\system32\drtvrnhp.ini
C:\WINDOWS\system32\dvikmllt.dll
C:\WINDOWS\system32\eiocadoh.ini
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\hodacoie.dll
C:\WINDOWS\system32\kngbycoc.dll
C:\WINDOWS\system32\ojnbpmhj.dll
C:\WINDOWS\system32\phnrvtrd.dll
C:\WINDOWS\system32\stera.exe
C:\WINDOWS\system32\tllmkivd.ini
C:\WINDOWS\system32\twwlanvx.ini
C:\WINDOWS\system32\unmehrqa.ini
C:\WINDOWS\system32\xvnalwwt.dll
C:\WINDOWS\system32\Z1
E:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 )))))))))))))))))))))))))))))))
.

2007-10-05 06:07 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-04 19:54 d——– C:\Program Files\Full Tilt Poker
2007-10-03 13:15 d——– C:\.Trash-kyle
2007-10-01 19:11 1,574,960 —hs—- C:\WINDOWS\system32\kjkkj.bak2
2007-10-01 05:36 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2007-10-01 05:36 298,104 –a—— C:\WINDOWS\system32\imon.dll
2007-10-01 05:36 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-01 05:27 d——– C:\Documents and Settings\All Users\Application Data\Eset
2007-09-30 14:59 1,576,587 —hs—- C:\WINDOWS\system32\kjkkj.ini2
2007-09-30 14:50 82,061 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-09-30 14:50 81,549 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-09-30 14:48 29,216 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-30 14:48 1,589,536 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-30 14:48 d——– C:\Program Files\Kaspersky Lab
2007-09-30 14:48 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-30 14:32 2,132,943 –ahs—- C:\WINDOWS\system32\kjkkj.bak1
2007-09-30 14:05 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-09-30 13:52 d——– C:\Documents and Settings\HP_Owner\Application Data\WinPatrol
2007-09-30 13:51 d——– C:\Program Files\BillP Studios
2007-09-29 10:11 d——– C:\Documents and Settings\Administrator.YOUR-AE066C3A9B\WINDOWS
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:54 d——– C:\Program Files\Temporary
2007-09-29 08:51 d——– C:\WINDOWS\system32\GB9
2007-09-29 08:51 d——– C:\WINDOWS\system32\DL1
2007-09-29 08:51 d——– C:\Temp
2007-09-28 12:11 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-09-28 12:11 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-09-27 07:35 31,616 –a–c— C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-09-27 07:35 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2007-09-27 07:33 42,112 –a—— C:\WINDOWS\system32\drivers\motodrv.sys
2007-09-27 07:32 d——– C:\Program Files\Motorola
2007-09-27 07:17 d——– C:\Program Files\BitPim
2007-09-27 06:34 d——– C:\Program Files\Windows Media Connect 2
2007-09-27 06:33 d——– C:\WINDOWS\system32\LogFiles
2007-09-27 06:33 d——– C:\WINDOWS\system32\drivers\UMDF
2007-09-27 06:13 23,680 –a—— C:\WINDOWS\system32\drivers\motmodem.sys
2007-09-27 06:13 1,419,232 –a—— C:\WINDOWS\system32\wdfcoinstaller01005.dll
2007-09-27 06:12 92,064 –a—— C:\Documents and Settings\HP_Owner\mqdmmdm.sys
2007-09-27 06:12 9,232 –a—— C:\Documents and Settings\HP_Owner\mqdmmdfl.sys
2007-09-27 06:12 79,328 –a—— C:\Documents and Settings\HP_Owner\mqdmserd.sys
2007-09-27 06:12 66,656 –a—— C:\Documents and Settings\HP_Owner\mqdmbus.sys
2007-09-27 06:12 6,208 –a—— C:\Documents and Settings\HP_Owner\mqdmcmnt.sys
2007-09-27 06:12 5,936 –a—— C:\Documents and Settings\HP_Owner\mqdmwhnt.sys
2007-09-27 06:12 4,048 –a—— C:\Documents and Settings\HP_Owner\mqdmcr.sys
2007-09-27 06:12 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-09-27 06:12 d——– C:\Program Files\Common Files\Motorola Shared
2007-09-27 06:05 25,600 –a–c— C:\WINDOWS\system32\dllcache\usbser.sys
2007-09-27 06:05 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys
2007-09-27 06:05 d——– C:\Program Files\Avanquest update
2007-09-27 06:04 25,600 –a—— C:\Documents and Settings\HP_Owner\usbsermptxp.sys
2007-09-27 06:04 22,768 –a—— C:\Documents and Settings\HP_Owner\usbsermpt.sys
2007-09-27 06:04 d——– C:\Program Files\Motorola Phone Tools
2007-09-27 06:04 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-09-17 06:56 19,142,000 –a—— C:\aaw2007.exe
2007-09-16 13:05 d——– C:\Program Files\ICQ6
2007-09-16 13:05 d——– C:\Documents and Settings\HP_Owner\Application Data\ICQ
2007-09-16 13:04 d——– C:\Documents and Settings\HP_Owner\Application Data\InstallShield
2007-09-16 13:03 12,816,680 –a—— C:\Install_ICQ6.exe
2007-09-16 10:05 d——– C:\Program Files\DiskTrix
2007-09-16 10:03 12,499 –a—— C:\WINDOWS\system32\Seagate.bin
2007-09-16 10:03 d——– C:\nzbs
2007-09-15 11:52 d——– C:\Program Files\AOL 9.0
2007-09-15 11:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-15 11:25 d——– C:\Program Files\Your Uninstaller 2006
2007-09-15 11:25 d——– C:\Documents and Settings\HP_Owner\Application Data\URSoft
2007-09-15 11:24 d——– C:\Your.Uninstaller.2006.Pro.v5.0.0.361.WinAll.Regged–CRD
2007-09-15 11:21 d——– C:\Documents and Settings\HP_Owner\Application Data\uTorrent
2007-09-15 11:15 110,602 –a—— C:\WINDOWS\system32\xcdsfx32.bin
2007-09-15 11:15 d——– C:\Program Files\Driver Magician
2007-09-15 11:13 d——– C:\Documents and Settings\HP_Owner\Application Data\WinRAR
2007-09-15 11:10 1,206,249 –a—— C:\wrar371b1.exe
2007-09-15 11:08 269,312 –a—— C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
2007-09-15 11:00 d——– C:\WINDOWS\Options
2007-09-15 09:33 453,120 –a–c— C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-09-15 09:31 2,180,352 –a–c— C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-09-15 09:31 2,136,064 –a–c— C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-09-15 09:31 2,057,600 –a–c— C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-09-15 09:31 2,015,744 –a–c— C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-09-15 08:53 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-09-14 18:37 33,588 -ra—— C:\WINDOWS\system32\drivers\wanatw4.sys
2007-09-14 18:31 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\SampleView
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\Real
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\Apple Computer
2007-09-14 18:30 d——– C:\Documents and Settings\HP_Owner\WINDOWS
2007-09-14 18:30 d——– C:\Documents and Settings\HP_Owner\Application Data\Symantec
2007-09-14 18:29 d——– C:\WINDOWS\system32\config\systemprofile\WINDOWS
2007-09-14 18:27 21,060 –a—— C:\WINDOWS\system32\drivers\iviaspi.sys
2007-09-14 18:27 10,368 –a—— C:\WINDOWS\system32\drivers\pfc.sys
2007-09-14 18:26 204,800 –a—— C:\WINDOWS\system32\IVIresizeW7.dll
2007-09-14 18:26 200,704 –a—— C:\WINDOWS\system32\IVIresizeA6.dll
2007-09-14 18:26 20,480 –a—— C:\WINDOWS\system32\IVIresize.dll
2007-09-14 18:26 192,512 –a—— C:\WINDOWS\system32\IVIresizeP6.dll
2007-09-14 18:26 192,512 –a—— C:\WINDOWS\system32\IVIresizeM6.dll
2007-09-14 18:26 188,416 –a—— C:\WINDOWS\system32\IVIresizePX.dll
2007-09-14 18:25 1,040 –a—— C:\WINDOWS\system32\drivers\alcxinit.dat
2007-09-14 16:46 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-09-14 16:46 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-05 06:13 3788 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-10-05 06:13 22880 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-05 06:13 ——— d——– C:\Program Files\MSN Messenger
2007-10-04 20:03 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-10-04 16:25 ——— d——– C:\Program Files\Full Tilt Poker.Net
2007-10-04 12:21 ——— d——– C:\Program Files\Common Files\Sandlot Shared
2007-10-04 11:25 ——— d——– C:\Program Files\Diner Dash
2007-10-03 17:52 ——— d——– C:\Program Files\Carrie the Caregiver
2007-10-01 14:49 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-10-01 05:24 ——— d——– C:\Program Files\nbpro
2007-09-30 14:51 246 –a—— C:\Program Files\Common Files\lazup
2007-09-30 14:28 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-30 12:42 ——— d——– C:\Program Files\Lavasoft
2007-09-30 12:33 ——— d-a—— C:\Program Files\PC-Doctor for Windows
2007-09-30 08:58 ——— d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-27 06:16 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-09-27 06:16 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2007-09-18 04:36 ——— d——– C:\Program Files\Fish Tycoon
2007-09-15 20:59 ——— d——– C:\Program Files\Nanny Mania
2007-09-15 11:55 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\AOL
2007-09-15 11:54 ——— d——– C:\Program Files\Common Files\aolshare
2007-09-15 11:53 ——— d——– C:\Program Files\Common Files\AOL
2007-09-15 11:52 209436 –a—— C:\WINDOWS\aolunins_us.exe
2007-09-15 11:52 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-15 11:28 ——— d——– C:\Program Files\Hewlett-Packard
2007-09-15 11:27 ——— d——– C:\Program Files\Easy Internet signup
2007-09-14 18:31 4178 -rahs—- C:\WINDOWS\system32\drivers\HP_PJ509AA-ABA A720N_YC_Pavi_QMXK438_E44NAheBLU5_4_IKelut_SASUSTek Computer INC._V2.02_B3.11_T040902_WXH2_L409_M448_J200_7AMD_8Athlon XP 3200+_92.2_111063044_N11063065_P_Z11C1048C_K_A11063059_U11063038_G11067205.MRK
2007-09-14 18:26 ——— d——– C:\Program Files\InterVideo
2007-09-13 13:34 ——— d——– C:\Program Files\Soulseek
2007-09-08 19:06 ——— d——– C:\Program Files\Absolute Poker
2007-09-06 09:51 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\.gaim
2007-08-28 04:58 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\foobar2000
2007-08-25 16:37 ——— d——– C:\Program Files\GameHouse
2007-08-25 16:37 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\GameHouse
2007-08-25 16:37 ——— d——– C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2007-08-17 03:20 ——— d——– C:\Program Files\foobar2000
2007-08-15 00:04 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 15:17 ——— d——– C:\Program Files\Mystery Case Files Huntsville
2007-08-05 11:58 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\wxChecksums
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-01 17:14 10165784 –a—— C:\Program Files\FullTiltPokerNetSetup.exe
2007-07-01 16:57 10468630 –a—— C:\Program Files\FullTiltSetup.exe
2007-05-24 11:42 7028440 –a—— C:\Program Files\AbsolutePoker7_2_0.exe
2006-08-30 08:32 81920 –a—— C:\Documents and Settings\HP_Owner\Application Data\ezpinst.exe
2006-08-30 08:32 47360 –a—— C:\Documents and Settings\HP_Owner\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13F815B5-BC6E-43C4-AE05-9EBC2408468C}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D624F0B-9EDA-46CD-A29C-B07CCC4A6638}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3AA3D6F8-D18A-470F-A9EA-DB354A350970}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73552DCE-4D7F-4D47-93D7-41BB4A9CA501}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7f9aaf14-478f-4b6b-b0c1-7322427f46ec}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92D4828D-EE1F-4056-A49D-9733885CF4C8}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8B6B908-BFB0-4BBE-A940-0094BADF099F}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D73F0BA8-5E00-4784-9FE8-545BE1D78CA2}]
C:\WINDOWS\system32\jkkjk.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE8BA79A-6281-4795-92EF-5C186D7E2E76}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-23 10:30]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-01 05:35]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:42]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-08-07 12:36]
"HostManager"="C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe" [2006-09-25 17:52]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 10:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Essential NetTools"="C:\Program Files\EssNetTools3\Ent.exe" [2004-09-01 13:47]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhigh]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqppol]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SNDSrvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccProxy"=2 (0x2)
"ccEvtMgr"=2 (0x2)

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\Start.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-10-02 18:08:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-12-18 23:10:19 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-09-26 11:21:00 C:\WINDOWS\Tasks\WebReg 20050211042108.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-05 06:15:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-05 6:19:34 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-10-05 06:19
.
— E O F —

Scotty

Post #4October 5, 2007, 9:50 PM UTC

Hi

Could you take a look at this file/folder and tell me what it is? Dont open it, just tell me if you recognise it.
C:\.Trash-kyle

Go to http://www.virustotal.com/en/indexf.html
Copy the following line into the white textbox:
C:\wrar371b1.exe
Click Send.
Please post the results of this scan to this thread.

Do the same for these

C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf

macditty

Post #5October 6, 2007, 3:31 PM UTC

i believe the c:\.trash\kyle folder is a folder created when i booted into linux to delete the jkkjkl.dll file while it wasnt being used since windows couldnt shake it. i just deleted the folder and emptied recycling bin.

C:\wrar371b1.exe
File wrar371b1.exe received on 10.06.2007 17:01:03 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED
Result: 2/32 (6.25%)

Antivirus Version Last Update Result
AhnLab-V3 2007.10.6.0 2007.10.05 -
AntiVir 7.6.0.20 2007.10.05 -
Authentium 4.93.8 2007.10.05 -
Avast 4.7.1051.0 2007.10.05 -
AVG 7.5.0.488 2007.10.06 -
BitDefender 7.2 2007.10.06 -
CAT-QuickHeal 9.00 2007.10.06 -
ClamAV 0.91.2 2007.10.06 -
DrWeb 4.44.0.09170 2007.10.06 -
eSafe 7.0.15.0 2007.10.04 -
eTrust-Vet 31.2.5190 2007.10.06 -
Ewido 4.0 2007.10.06 -
FileAdvisor 1 2007.10.06 -
Fortinet 3.11.0.0 2007.10.06 -
F-Prot 4.3.2.48 2007.10.05 -
F-Secure 6.70.13030.0 2007.10.05 -
Ikarus T3.1.1.12 2007.10.06 -
Kaspersky 7.0.0.125 2007.10.06 -
McAfee 5135 2007.10.05 -
Microsoft 1.2908 2007.10.06 -
NOD32v2 2575 2007.10.06 -
Norman 5.80.02 2007.10.05 -
Panda 9.0.0.4 2007.10.06 -
Prevx1 V2 2007.10.06 Heuristic: Suspicious Hijacker
Rising 19.43.50.00 2007.10.06 -
Sophos 4.22.0 2007.10.06 -
Sunbelt 2.2.907.0 2007.10.06 -
Symantec 10 2007.10.06 -
TheHacker 6.2.6.078 2007.10.06 -
VBA32 3.12.2.4 2007.10.05 -
VirusBuster 4.3.26:9 2007.10.06 Trojan.DL.Zlob.CSA
Webwasher-Gateway 6.0.1 2007.10.05 -
Additional information
File size: 1206249 bytes
MD5: 974ac85737ba51ba8c07848d03ecc1dc
SHA1: d232ffd9664c80cc7c1efd2c250cca8a40b1d3c8
packers: RAR
packers: PE_Patch
Prevx info: http://fileinfo.prevx.com/fileinfo.asp?PX5…2B8B1009CA57552

C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
Antivirus Version Last Update Result
AhnLab-V3 2007.10.6.0 2007.10.05 -
AntiVir 7.6.0.20 2007.10.05 -
Authentium 4.93.8 2007.10.05 -
Avast 4.7.1051.0 2007.10.05 -
AVG 7.5.0.488 2007.10.06 -
BitDefender 7.2 2007.10.06 -
CAT-QuickHeal 9.00 2007.10.06 (Suspicious) - DNAScan
ClamAV 0.91.2 2007.10.06 -
DrWeb 4.44.0.09170 2007.10.06 -
eSafe 7.0.15.0 2007.10.04 -
eTrust-Vet 31.2.5190 2007.10.06 -
Ewido 4.0 2007.10.06 -
FileAdvisor 1 2007.10.06 -
Fortinet 3.11.0.0 2007.10.06 -
F-Prot 4.3.2.48 2007.10.05 -
F-Secure 6.70.13030.0 2007.10.05 -
Ikarus T3.1.1.12 2007.10.06 -
Kaspersky 7.0.0.125 2007.10.06 -
McAfee 5135 2007.10.05 -
Microsoft 1.2908 2007.10.06 -
NOD32v2 2575 2007.10.06 -
Norman 5.80.02 2007.10.05 -
Panda 9.0.0.4 2007.10.06 -
Prevx1 V2 2007.10.06 -
Rising 19.43.50.00 2007.10.06 -
Sophos 4.22.0 2007.10.06 -
Sunbelt 2.2.907.0 2007.10.06 -
Symantec 10 2007.10.06 -
TheHacker 6.2.6.078 2007.10.06 -
VBA32 3.12.2.4 2007.10.05 -
VirusBuster 4.3.26:9 2007.10.06 -
Webwasher-Gateway 6.0.1 2007.10.05 Win32.Malware.gen!90 (suspicious)
Additional information
File size: 269312 bytes
MD5: 07d310c0b9d9416741810a8889e5f20b
SHA1: 2b8d3cb4c984e993e207cae7cd6569b95ba35bf8
packers: Aspack
packers: ASPack

C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
0 bytes size received / Se ha recibido un archivo vacio

Scotty

Post #6October 6, 2007, 3:47 PM UTC last edited October 6, 2007, 3:48 PM UTC

Hi

Download Flash_Disinfector from here and save it to your desktop.
Doubleclick on Flash_Disinfector.exe to run it and follow the prompts.
Wait until it has finished scanning and then exit the program.
The utility may ask you to insert your flash drive and/or other removable drives. This may include your mobile phone.
Please do so and allow the utility to clean up those drives as well.

Open Notepad and Copy/Paste the text in the codebox below into it:

File::
C:\WINDOWS\system32\kjkkj.bak2
C:\WINDOWS\system32\kjkkj.ini2
C:\WINDOWS\system32\kjkkj.bak1 
C:\wrar371b1.exe
C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
C:\WINDOWS\system32\jkkjk.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13F815B5-BC6E-43C4-AE05-9EBC2408468C}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2D624F0B-9EDA-46CD-A29C-B07CCC4A6638}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3AA3D6F8-D18A-470F-A9EA-DB354A350970}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73552DCE-4D7F-4D47-93D7-41BB4A9CA501}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7f9aaf14-478f-4b6b-b0c1-7322427f46ec}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92D4828D-EE1F-4056-A49D-9733885CF4C8}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B8B6B908-BFB0-4BBE-A940-0094BADF099F}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D73F0BA8-5E00-4784-9FE8-545BE1D78CA2}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DE8BA79A-6281-4795-92EF-5C186D7E2E76}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhigh]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqppol]

Save this as "CFScript"

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log with a new HijackThis log.

macditty

Post #7October 6, 2007, 4:48 PM UTC

combofix new log:
ComboFix 07-10-05.3 - HP_Owner 2007-10-06 12:32:12.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.53 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\HP_Owner\Desktop\CFScript
* Created a new restore point

FILE::
C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
C:\WINDOWS\system32\jkkjk.dll
C:\WINDOWS\system32\kjkkj.bak1
C:\WINDOWS\system32\kjkkj.bak2
C:\WINDOWS\system32\kjkkj.ini2
C:\wrar371b1.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DAMN_NFO_Viewer_v2-10-0032-RC3.exe
C:\WINDOWS\system32\kjkkj.bak1
C:\WINDOWS\system32\kjkkj.bak2
C:\WINDOWS\system32\kjkkj.ini2
C:\wrar371b1.exe

.
((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 )))))))))))))))))))))))))))))))
.

2007-10-06 12:19 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-10-06 12:08 drahs—- C:\autorun.inf
2007-10-04 19:54 d——– C:\Program Files\Full Tilt Poker
2007-10-01 05:36 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2007-10-01 05:36 298,104 –a—— C:\WINDOWS\system32\imon.dll
2007-10-01 05:36 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2007-10-01 05:27 d——– C:\Documents and Settings\All Users\Application Data\Eset
2007-09-30 14:50 82,061 –a—— C:\WINDOWS\system32\drivers\klick.dat
2007-09-30 14:50 81,549 –a—— C:\WINDOWS\system32\drivers\klin.dat
2007-09-30 14:48 35,616 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-09-30 14:48 2,057,248 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat
2007-09-30 14:48 d——– C:\Program Files\Kaspersky Lab
2007-09-30 14:48 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-09-30 14:05 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2007-09-30 13:52 d——– C:\Documents and Settings\HP_Owner\Application Data\WinPatrol
2007-09-30 13:51 d——– C:\Program Files\BillP Studios
2007-09-29 10:11 d——– C:\Documents and Settings\Administrator.YOUR-AE066C3A9B\WINDOWS
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:58 d——– C:\Documents and Settings\LocalService\Application Data\Talkback
2007-09-29 08:54 d——– C:\Program Files\Temporary
2007-09-29 08:51 d——– C:\WINDOWS\system32\GB9
2007-09-29 08:51 d——– C:\WINDOWS\system32\DL1
2007-09-29 08:51 d——– C:\Temp
2007-09-28 12:11 14,848 –a–c— C:\WINDOWS\system32\dllcache\kbdhid.sys
2007-09-28 12:11 14,848 –a—— C:\WINDOWS\system32\drivers\kbdhid.sys
2007-09-27 07:35 31,616 –a–c— C:\WINDOWS\system32\dllcache\usbccgp.sys
2007-09-27 07:35 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2007-09-27 07:33 42,112 –a—— C:\WINDOWS\system32\drivers\motodrv.sys
2007-09-27 07:32 d——– C:\Program Files\Motorola
2007-09-27 07:17 d——– C:\Program Files\BitPim
2007-09-27 06:34 d——– C:\Program Files\Windows Media Connect 2
2007-09-27 06:33 d——– C:\WINDOWS\system32\LogFiles
2007-09-27 06:33 d——– C:\WINDOWS\system32\drivers\UMDF
2007-09-27 06:13 23,680 –a—— C:\WINDOWS\system32\drivers\motmodem.sys
2007-09-27 06:13 1,419,232 –a—— C:\WINDOWS\system32\wdfcoinstaller01005.dll
2007-09-27 06:12 92,064 –a—— C:\Documents and Settings\HP_Owner\mqdmmdm.sys
2007-09-27 06:12 9,232 –a—— C:\Documents and Settings\HP_Owner\mqdmmdfl.sys
2007-09-27 06:12 79,328 –a—— C:\Documents and Settings\HP_Owner\mqdmserd.sys
2007-09-27 06:12 66,656 –a—— C:\Documents and Settings\HP_Owner\mqdmbus.sys
2007-09-27 06:12 6,208 –a—— C:\Documents and Settings\HP_Owner\mqdmcmnt.sys
2007-09-27 06:12 5,936 –a—— C:\Documents and Settings\HP_Owner\mqdmwhnt.sys
2007-09-27 06:12 4,048 –a—— C:\Documents and Settings\HP_Owner\mqdmcr.sys
2007-09-27 06:12 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-09-27 06:12 d——– C:\Program Files\Common Files\Motorola Shared
2007-09-27 06:05 25,600 –a–c— C:\WINDOWS\system32\dllcache\usbser.sys
2007-09-27 06:05 25,600 –a—— C:\WINDOWS\system32\drivers\usbser.sys
2007-09-27 06:05 d——– C:\Program Files\Avanquest update
2007-09-27 06:04 25,600 –a—— C:\Documents and Settings\HP_Owner\usbsermptxp.sys
2007-09-27 06:04 22,768 –a—— C:\Documents and Settings\HP_Owner\usbsermpt.sys
2007-09-27 06:04 d——– C:\Program Files\Motorola Phone Tools
2007-09-27 06:04 d——– C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-09-17 06:56 19,142,000 –a—— C:\aaw2007.exe
2007-09-16 13:05 d——– C:\Program Files\ICQ6
2007-09-16 13:05 d——– C:\Documents and Settings\HP_Owner\Application Data\ICQ
2007-09-16 13:04 d——– C:\Documents and Settings\HP_Owner\Application Data\InstallShield
2007-09-16 13:03 12,816,680 –a—— C:\Install_ICQ6.exe
2007-09-16 10:05 d——– C:\Program Files\DiskTrix
2007-09-16 10:03 12,499 –a—— C:\WINDOWS\system32\Seagate.bin
2007-09-16 10:03 d——– C:\nzbs
2007-09-15 11:52 d——– C:\Program Files\AOL 9.0
2007-09-15 11:25 d-a—— C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-15 11:25 d——– C:\Program Files\Your Uninstaller 2006
2007-09-15 11:25 d——– C:\Documents and Settings\HP_Owner\Application Data\URSoft
2007-09-15 11:24 d——– C:\Your.Uninstaller.2006.Pro.v5.0.0.361.WinAll.Regged–CRD
2007-09-15 11:21 d——– C:\Documents and Settings\HP_Owner\Application Data\uTorrent
2007-09-15 11:15 110,602 –a—— C:\WINDOWS\system32\xcdsfx32.bin
2007-09-15 11:15 d——– C:\Program Files\Driver Magician
2007-09-15 11:13 d——– C:\Documents and Settings\HP_Owner\Application Data\WinRAR
2007-09-15 11:00 d——– C:\WINDOWS\Options
2007-09-15 09:33 453,120 –a–c— C:\WINDOWS\system32\dllcache\mrxsmb.sys
2007-09-15 09:31 2,180,352 –a–c— C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2007-09-15 09:31 2,136,064 –a–c— C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2007-09-15 09:31 2,057,600 –a–c— C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2007-09-15 09:31 2,015,744 –a–c— C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2007-09-15 08:53 23,856 –a—— C:\WINDOWS\system32\spupdsvc.exe
2007-09-14 18:37 33,588 -ra—— C:\WINDOWS\system32\drivers\wanatw4.sys
2007-09-14 18:31 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\SampleView
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\Real
2007-09-14 18:31 d——– C:\Documents and Settings\HP_Owner\Application Data\Apple Computer
2007-09-14 18:30 d——– C:\Documents and Settings\HP_Owner\WINDOWS
2007-09-14 18:30 d——– C:\Documents and Settings\HP_Owner\Application Data\Symantec
2007-09-14 18:29 d——– C:\WINDOWS\system32\config\systemprofile\WINDOWS
2007-09-14 18:27 21,060 –a—— C:\WINDOWS\system32\drivers\iviaspi.sys
2007-09-14 18:27 10,368 –a—— C:\WINDOWS\system32\drivers\pfc.sys
2007-09-14 18:26 204,800 –a—— C:\WINDOWS\system32\IVIresizeW7.dll
2007-09-14 18:26 200,704 –a—— C:\WINDOWS\system32\IVIresizeA6.dll
2007-09-14 18:26 20,480 –a—— C:\WINDOWS\system32\IVIresize.dll
2007-09-14 18:26 192,512 –a—— C:\WINDOWS\system32\IVIresizeP6.dll
2007-09-14 18:26 192,512 –a—— C:\WINDOWS\system32\IVIresizeM6.dll
2007-09-14 18:26 188,416 –a—— C:\WINDOWS\system32\IVIresizePX.dll
2007-09-14 18:25 1,040 –a—— C:\WINDOWS\system32\drivers\alcxinit.dat
2007-09-14 16:46 9,600 –a—— C:\WINDOWS\system32\drivers\hidusb.sys
2007-09-14 16:46 60,800 –a—— C:\WINDOWS\system32\drivers\sysaudio.sys
2007-09-14 16:46 54,272 –a—— C:\WINDOWS\system32\drivers\swmidi.sys
2007-09-14 16:46 52,864 –a—— C:\WINDOWS\system32\drivers\DMusic.sys
2007-09-14 16:46 2,944 –a—— C:\WINDOWS\system32\drivers\drmkaud.sys
2007-09-14 16:46 12,160 –a—— C:\WINDOWS\system32\drivers\mouhid.sys
2007-09-11 23:54 18,716 –a—— C:\nvrambak.bin

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-05 19:16 ——— d——– C:\Program Files\Carrie the Caregiver
2007-10-05 06:13 3788 –ahs—- C:\WINDOWS\system32\drivers\fidbox2.idx
2007-10-05 06:13 22880 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx
2007-10-05 06:13 ——— d——– C:\Program Files\MSN Messenger
2007-10-04 20:03 ——— d–h—– C:\Program Files\InstallShield Installation Information
2007-10-04 16:25 ——— d——– C:\Program Files\Full Tilt Poker.Net
2007-10-04 12:21 ——— d——– C:\Program Files\Common Files\Sandlot Shared
2007-10-04 11:25 ——— d——– C:\Program Files\Diner Dash
2007-10-01 14:49 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-10-01 05:24 ——— d——– C:\Program Files\nbpro
2007-09-30 14:51 246 –a—— C:\Program Files\Common Files\lazup
2007-09-30 14:28 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-09-30 12:42 ——— d——– C:\Program Files\Lavasoft
2007-09-30 12:33 ——— d-a—— C:\Program Files\PC-Doctor for Windows
2007-09-30 08:58 ——— d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-09-27 06:16 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-09-27 06:16 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2007-09-18 04:36 ——— d——– C:\Program Files\Fish Tycoon
2007-09-15 20:59 ——— d——– C:\Program Files\Nanny Mania
2007-09-15 11:55 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\AOL
2007-09-15 11:54 ——— d——– C:\Program Files\Common Files\aolshare
2007-09-15 11:53 ——— d——– C:\Program Files\Common Files\AOL
2007-09-15 11:52 209436 –a—— C:\WINDOWS\aolunins_us.exe
2007-09-15 11:52 ——— d——– C:\Documents and Settings\All Users\Application Data\AOL
2007-09-15 11:28 ——— d——– C:\Program Files\Hewlett-Packard
2007-09-15 11:27 ——— d——– C:\Program Files\Easy Internet signup
2007-09-14 18:31 4178 -rahs—- C:\WINDOWS\system32\drivers\HP_PJ509AA-ABA A720N_YC_Pavi_QMXK438_E44NAheBLU5_4_IKelut_SASUSTek Computer INC._V2.02_B3.11_T040902_WXH2_L409_M448_J200_7AMD_8Athlon XP 3200+_92.2_111063044_N11063065_P_Z11C1048C_K_A11063059_U11063038_G11067205.MRK
2007-09-14 18:26 ——— d——– C:\Program Files\InterVideo
2007-09-13 13:34 ——— d——– C:\Program Files\Soulseek
2007-09-08 19:06 ——— d——– C:\Program Files\Absolute Poker
2007-09-06 09:51 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\.gaim
2007-08-28 04:58 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\foobar2000
2007-08-25 16:37 ——— d——– C:\Program Files\GameHouse
2007-08-25 16:37 ——— d——– C:\Documents and Settings\HP_Owner\Application Data\GameHouse
2007-08-25 16:37 ——— d——– C:\Documents and Settings\All Users\Application Data\n7-89-o9-3r-4t-r9
2007-08-17 03:20 ——— d——– C:\Program Files\foobar2000
2007-08-15 00:04 ——— d——– C:\Program Files\MSXML 6.0
2007-08-14 15:17 ——— d——– C:\Program Files\Mystery Case Files Huntsville
2007-07-01 17:14 10165784 –a—— C:\Program Files\FullTiltPokerNetSetup.exe
2007-07-01 16:57 10468630 –a—— C:\Program Files\FullTiltSetup.exe
2007-05-24 11:42 7028440 –a—— C:\Program Files\AbsolutePoker7_2_0.exe
2006-08-30 08:32 81920 –a—— C:\Documents and Settings\HP_Owner\Application Data\ezpinst.exe
2006-08-30 08:32 47360 –a—— C:\Documents and Settings\HP_Owner\Application Data\pcouffin.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinPatrol"="C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe" [2007-09-23 10:30]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-10-01 05:35]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 16:04]
"HPHUPD06"="c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe" [2004-06-07 18:53]
"HPHmon06"="C:\WINDOWS\system32\hphmon06.exe" [2004-06-07 18:42]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-08-07 12:36]
"HostManager"="C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe" [2006-09-25 17:52]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" [2007-06-28 12:51]
"UnlockerAssistant"="C:\Program Files\Unlocker\UnlockerAssistant.exe" [2006-09-07 10:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Essential NetTools"="C:\Program Files\EssNetTools3\Ent.exe" [2004-09-01 13:47]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"SNDSrvc"=3 (0x3)
"ccSetMgr"=2 (0x2)
"ccPwdSvc"=3 (0x3)
"ccProxy"=2 (0x2)
"ccEvtMgr"=2 (0x2)

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys
S3 MotDev;Motorola Inc. USB Device;C:\WINDOWS\system32\DRIVERS\motodrv.sys
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
AutoRun\command- F:\Start.exe

*Newly Created Service* - GMER
.
Contents of the 'Scheduled Tasks' folder
"2007-10-02 18:08:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2006-12-18 23:10:19 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-10-06 11:21:00 C:\WINDOWS\Tasks\WebReg 20050211042108.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-06 12:37:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-10-06 12:38:41
C:\ComboFix-quarantined-files.txt … 2007-10-06 12:38
C:\ComboFix2.txt … 2007-10-05 06:19
.
— E O F —

hijackthis new log:

Logfile of HijackThis v1.99.1
Scan saved at 12:41:45 PM, on 10/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\wanmpsvc.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\explorer.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKCU\..\Run: [Essential NetTools] C:\Program Files\EssNetTools3\Ent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe" -r (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

macditty

Post #8October 6, 2007, 6:29 PM UTC

scotty, i just wanted to thank you for all the help! everything seems to be running fine and i really appreciate what you guys do here. thanks again.

Scotty

Post #9October 6, 2007, 6:57 PM UTC

Hi

Not finished quite yet.

Disable Teatimer
First:

Right click Spybot in the System Tray (looks like a calendar with a padlock symbol)
Choose Exit Spybot S&D Resident

Second:

Open Spybot S&D
Click Mode, check Advanced Mode
Go To Left Panel, Click Tools, then also in left panel, click Resident
If your firewall raises a question, say OK
Uncheck the box labeled Resident Tea-Timer and OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post with a new HijackThis log.

macditty

Post #10October 7, 2007, 10:53 AM UTC

i scanned with !avast and everything came up clean. my trial for karprasky ran out so i had to uninstall. here is my new hijack this log:

Logfile of HijackThis v1.99.1
Scan saved at 6:42:57 AM, on 10/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\EssNetTools3\Ent.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Alwil Software\Avast4\ashAvast.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13F815B5-BC6E-43C4-AE05-9EBC2408468C} - (no file)
O2 - BHO: (no name) - {2D624F0B-9EDA-46CD-A29C-B07CCC4A6638} - (no file)
O2 - BHO: (no name) - {3AA3D6F8-D18A-470F-A9EA-DB354A350970} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {73552DCE-4D7F-4D47-93D7-41BB4A9CA501} - (no file)
O2 - BHO: (no name) - {7f9aaf14-478f-4b6b-b0c1-7322427f46ec} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - (no file)
O2 - BHO: (no name) - {92D4828D-EE1F-4056-A49D-9733885CF4C8} - (no file)
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
O2 - BHO: (no name) - {B8B6B908-BFB0-4BBE-A940-0094BADF099F} - (no file)
O2 - BHO: (no name) - {D73F0BA8-5E00-4784-9FE8-545BE1D78CA2} - (no file)
O2 - BHO: (no name) - {DE8BA79A-6281-4795-92EF-5C186D7E2E76} - (no file)
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Essential NetTools] C:\Program Files\EssNetTools3\Ent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: klogon - C:\WINDOWS\
O20 - Winlogon Notify: ljjhigh - C:\WINDOWS\
O20 - Winlogon Notify: urqppol - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

Scotty

Post #11October 7, 2007, 11:17 AM UTC

Hi

It's a bit odd how those empty reg key's have reappeared in the HJT log.

Run HijackThis, select Do a system scan only and place checks against the following entries (if they are still present):
O2 - BHO: (no name) - {13F815B5-BC6E-43C4-AE05-9EBC2408468C} - (no file)
O2 - BHO: (no name) - {2D624F0B-9EDA-46CD-A29C-B07CCC4A6638} - (no file)
O2 - BHO: (no name) - {3AA3D6F8-D18A-470F-A9EA-DB354A350970} - (no file)
O2 - BHO: (no name) - {73552DCE-4D7F-4D47-93D7-41BB4A9CA501} - (no file)
O2 - BHO: (no name) - {7f9aaf14-478f-4b6b-b0c1-7322427f46ec} - (no file)
O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - (no file)
O2 - BHO: (no name) - {92D4828D-EE1F-4056-A49D-9733885CF4C8} - (no file)
O2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)
O2 - BHO: (no name) - {B8B6B908-BFB0-4BBE-A940-0094BADF099F} - (no file)
O2 - BHO: (no name) - {D73F0BA8-5E00-4784-9FE8-545BE1D78CA2} - (no file)
O2 - BHO: (no name) - {DE8BA79A-6281-4795-92EF-5C186D7E2E76} - (no file)
O20 - Winlogon Notify: klogon - C:\WINDOWS\
O20 - Winlogon Notify: ljjhigh - C:\WINDOWS\
O20 - Winlogon Notify: urqppol - C:\WINDOWS\

WITH ALL OTHER WINDOWS CLOSED Click on Fix Checked and exit HijackThis then reboot your computer.

The instructions I posted previously are for the Kaspersky Online Scanner. If you click on the link and follow the instructions, it will scan your computer and produce a report. Post that here with a new HijackThis log.

macditty

Post #12October 7, 2007, 1:05 PM UTC

ok im sorry, the link was out of order last night, getting a server issue message. scanning with online utility right now will post when im done. thanks

macditty

Post #13October 7, 2007, 7:40 PM UTC

new hijack log
Logfile of HijackThis v1.99.1
Scan saved at 3:30:58 PM, on 10/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\hphmon06.exe
C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\EssNetTools3\Ent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe
O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1189882368\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [Essential NetTools] C:\Program Files\EssNetTools3\Ent.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6\ICQ.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

kasparsky online txt file

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Sunday, October 07, 2007 3:21:59 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 7/10/2007
Kaspersky Anti-Virus database records: 428737
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
K:\
L:\

Scan Statistics:
Total number of scanned objects: 146829
Number of viruses found: 7
Number of infected objects: 6
Number of suspicious objects: 2
Duration of the scan process: 01:58:20

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\19e26cec064e9195496f0b92ff8bcf4b_1fecc410-0e8d-4e51-abfd-2121d5b68044 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\2b978cda3c9677b5038165c13d849c18_1fecc410-0e8d-4e51-abfd-2121d5b68044 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\b6da8b6ab7eddbd73b998dd13ca67a95_1fecc410-0e8d-4e51-abfd-2121d5b68044 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys\da0b15386eb015a35b0c728083ca8c58_1fecc410-0e8d-4e51-abfd-2121d5b68044 Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.4/wbuninst.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\cert8.db Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\history.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\key3.db Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\parent.lock Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\search.sqlite Object is locked skipped
C:\Documents and Settings\HP_Owner\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\HP_Owner\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\AOL\UserProfiles\All Users\cls\common.cls Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\dk12jy6o.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Temp\Perflib_Perfdata_f54.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Temp\~DF1038.tmp Object is locked skipped
C:\Documents and Settings\HP_Owner\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\HP_Owner\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\HP_Owner\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\hp\bin\KillWind.exe Infected: not-a-virus:RiskTool.Win32.PsKill.p skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\BPFTP Server\bpftpserver.exe Infected: not-a-virus:Server-FTP.Win32.BulletProof.231 skipped
C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\MSN Messenger\riched20.dll Infected: not-a-virus:AdTool.Win32.MyWebSearch skipped
C:\qoobox\Quarantine\C\Program Files\MSN Messenger\msimg32.dll.vir Infected: not-a-virus:AdTool.Win32.MyWebSearch.au skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\dvikmllt.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wm skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{E7B21304-9105-4D9D-AFAC-E7088FDCC6A0}\RP4\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{6E9F625F-EECD-4288-8330-8D0E0460BDDB}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\TEMP\Perflib_Perfdata_6a8.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

Scotty

Post #14October 7, 2007, 11:36 PM UTC

Hi

You can remove the Kaspersky Scanner through Add?Remove Programs.

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the x and the /u, it needs to be there.

[external image: Posted Image]
When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Set a new, clean Restore Point.

I would advise updating Adobe Reader, as the latest version clears up any vulnerabilities of previous versions.
First uninstall the version you have on your computer then download and install Adobe Reader 8.1.

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (4th one down the list), which is JRE6u3, and click Yes at the page warning, then accept the Licence Agreement before downloading the Offline file. Once downloading is complete, run the Installer.

Here are some free programs I recommend, although you will not need them all.

Spybot Search and Destroy
Download it from here . Just choose a mirror and off you go.
Find here the tutorial on how to use Spybot properly here

Install Spyware Guard
Download it from here
Find here the tutorial on how to use Spyware Guard here

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Make sure your Windows is ALWAYS up to date!

An unpatched Windows is vulnerable and even with the "best" Antivirus and Firewall installed, malware will find its way through.
So visit http://windowsupdate.microsoft.com/ to download and install the latest updates.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Please check out Tony Klein's article "How did I get infected in the first place?"

Follow this list and your potential for being infected again will reduce dramatically.

Glad I was able to help.

Scotty

Post #15October 11, 2007, 8:55 AM UTC

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] jkkjkl.dll problem.

✨ Ask AI

Ask AI