[Resolved] HJT Log

Just this morning AVG reported finding a Trojan SHeur.AGTK. Four files were infected. First were two.exe files that had named themselves after two .avi video files that I've had for years and know to be clean, and then two .exe's were found in system restore. AVG healed all four files. I disabled System Restore (which I'll enable again after posting this), then ran another AVG AV scan. I ran a Spybot S&D scan aftter that, followed by a Windows Defender scan. I then downloaded and ran two scans with AVG Anti-Spyware. Once regular and once in safemode with the recommended settings from the stickies. I also ran a scan with AVG Anti-Rootkit. The only scanner I haven't run is Ad-Aware which seemed kind of redundant… but knowing me I'll run one anyway soon. After all those finished I installed a couple of pending Windows Updates and then manually downloaded Windows Malicious Software Scanner for December and ran a full system scan (man that one took a while). Only the initial AVG scan that originally reported the infection had any hits. Everything after that has come back clean, with the exception of a few tracking cookies in some old FEBE backups of FireFox (I can post the log from the AVG Anti-Spyware scan that found them if needed). After all that I ran HJT and here I am. I just want to make certain that there is no residual trace of whatever it was infecting my computer. Logfile of HijackThis v1.99.1 Scan saved at 12:14:59 AM, on 12/15/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Windows Defender\MSASCui.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\RunDLL32.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1164162903203 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: NBService - Nero AG - D:\Program Files\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 07-12-15.5 - Administrator 2007-12-15 13:16:45.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.570 [GMT -5:00] Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\QCQBCKFG\www.broadcaster.com C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\QCQBCKFG\www.broadcaster.com\played_list.sol C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\QCQBCKFG\www.broadcaster.com\video_queue.sol C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol . ((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 ))))))))))))))))))))))))))))))) . 2007-12-15 12:55 . 2007-12-15 12:55 d——– C:\Documents and Settings\All Users\Application Data\iolo 2007-12-15 12:55 . 2007-12-15 12:55 d——– C:\Documents and Settings\Administrator\Application Data\iolo 2007-12-15 12:55 . 2007-12-15 12:55 406 –a—— C:\WINDOWS\system32\ioloBootDefrag.cfg 2007-12-14 10:36 . 2007-12-14 10:36 d——– C:\Documents and Settings\Administrator\Application Data\Grisoft 2007-12-14 10:36 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-12-14 09:31 . 2007-12-14 09:31 d——– C:\Documents and Settings\Administrator\Application Data\DivX 2007-12-13 16:45 . 2007-12-04 13:38 120,056 ——— C:\WINDOWS\system32\pxcpyi64.exe 2007-12-13 16:45 . 2007-12-04 13:38 118,520 ——— C:\WINDOWS\system32\pxinsi64.exe 2007-12-12 16:37 . 2007-12-14 02:34 d——– C:\Documents and Settings\Administrator\Application Data\Hamachi 2007-12-12 16:37 . 2007-12-12 16:37 25,280 –a—— C:\WINDOWS\system32\drivers\hamachi.sys 2007-12-11 17:34 . 2007-12-11 17:34 1,044,480 –a—— C:\WINDOWS\system32\libdivx.dll 2007-12-11 17:34 . 2007-12-11 17:34 200,704 –a—— C:\WINDOWS\system32\ssldivx.dll 2007-12-07 12:28 . 2007-10-12 15:14 3,734,536 –a—— C:\WINDOWS\system32\d3dx9_36.dll 2007-12-07 12:28 . 2007-10-12 15:14 1,374,232 –a—— C:\WINDOWS\system32\D3DCompiler_36.dll 2007-12-07 12:28 . 2007-10-02 09:56 444,776 –a—— C:\WINDOWS\system32\d3dx10_36.dll 2007-12-07 12:28 . 2007-10-22 03:39 267,272 –a—— C:\WINDOWS\system32\xactengine2_10.dll 2007-12-04 13:38 . 2007-12-04 13:38 3,596,288 –a—— C:\WINDOWS\system32\qt-dx331.dll 2007-12-04 13:38 . 2007-12-04 13:38 524,288 –a—— C:\WINDOWS\system32\DivXsm.exe 2007-12-04 13:38 . 2007-12-04 13:38 4,816 –a—— C:\WINDOWS\system32\divxsm.tlb 2007-12-04 13:35 . 2007-12-04 13:35 156,992 –a—— C:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-04 13:35 . 2007-12-04 13:35 12,288 –a—— C:\WINDOWS\system32\DivXWMPExtType.dll 2007-11-17 16:03 . 2007-12-15 13:18 73,760 –ahs—- C:\WINDOWS\system32\drivers\fidbox.dat 2007-11-17 16:03 . 2007-12-15 13:07 32 –ahs—- C:\WINDOWS\system32\drivers\fidbox.idx 2007-11-17 16:00 . 2007-11-17 16:00 d——– C:\Documents and Settings\All Users\Application Data\MailFrontier . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-12-06 09:00 ——— d—–w C:\Program Files\Image-Line 2007-12-15 15:51 ——— d—–w C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2 2007-12-15 14:36 ——— d—–w C:\Documents and Settings\Administrator\Application Data\AVG7 2007-12-15 12:00 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7 2007-12-14 15:36 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft 2007-12-14 08:04 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Xfire 2007-12-13 19:56 22,328 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-12-13 19:55 107,832 —-a-w C:\WINDOWS\system32\PnkBstrB.exe 2007-12-13 19:54 66,872 —-a-w C:\WINDOWS\system32\PnkBstrA.exe 2007-12-12 16:31 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus 2007-12-09 14:22 ——— d–h–w C:\Program Files\InstallShield Installation Information 2007-12-07 11:06 13,990,266 —-a-w C:\WINDOWS\Internet Logs\tvDebug.zip 2007-12-04 18:38 129,784 ——w C:\WINDOWS\system32\pxafs.dll 2007-12-04 18:36 823,296 —-a-w C:\WINDOWS\system32\divx_xx0c.dll 2007-12-04 18:36 823,296 —-a-w C:\WINDOWS\system32\divx_xx07.dll 2007-12-04 18:36 81,920 —-a-w C:\WINDOWS\system32\dpl100.dll 2007-12-04 18:36 802,816 —-a-w C:\WINDOWS\system32\divx_xx11.dll 2007-12-04 18:36 682,496 —-a-w C:\WINDOWS\system32\DivX.dll 2007-12-04 18:36 593,920 —-a-w C:\WINDOWS\system32\dpuGUI11.dll 2007-12-04 18:36 57,344 —-a-w C:\WINDOWS\system32\dpv11.dll 2007-12-04 18:36 53,248 —-a-w C:\WINDOWS\system32\dpuGUI10.dll 2007-12-04 18:36 344,064 —-a-w C:\WINDOWS\system32\dpus11.dll 2007-12-04 18:36 294,912 —-a-w C:\WINDOWS\system32\dpu11.dll 2007-12-04 18:36 294,912 —-a-w C:\WINDOWS\system32\dpu10.dll 2007-12-04 18:36 196,608 —-a-w C:\WINDOWS\system32\dtu100.dll 2007-11-14 21:05 75,248 —-a-w C:\WINDOWS\zllsputility.exe 2007-11-14 21:05 1,086,952 —-a-w C:\WINDOWS\system32\zpeng24.dll 2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys 2007-11-07 21:50 ——— d—–w C:\Documents and Settings\All Users\Application Data\Muzzy Lane Software 2007-11-07 20:29 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard 2007-11-07 20:29 ——— d—–w C:\Program Files\AGEIA Technologies 2007-11-07 02:17 ——— d—–w C:\Program Files\Common Files\DirectX 2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll 2007-10-28 20:29 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Codemasters 2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll 2007-10-24 06:47 96,760 —-a-w C:\WINDOWS\system32\dfshim.dll 2007-10-24 06:47 84,480 —-a-w C:\WINDOWS\system32\mscories.dll 2007-10-24 06:47 282,112 —-a-w C:\WINDOWS\system32\mscoree.dll 2007-10-24 06:47 158,720 —-a-w C:\WINDOWS\system32\mscorier.dll 2007-10-22 08:37 17,928 —-a-w C:\WINDOWS\system32\X3DAudio1_2.dll 2007-10-18 16:41 ——— d—–w C:\Documents and Settings\Administrator\Application Data\dvdcss 2007-09-11 14:25 22,328 —-a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SetDefaultMIDI"="MIDIDef.exe" [2005-04-22 11:27 C:\WINDOWS\MIDIDEF.EXE] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-03 22:32] "PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 22:32] "PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-03 22:32] "VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-28 09:56] "P17Helper"="Rundll32 SPIRun.dll" [] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20] "AVG7_CC"="D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-10-24 07:32] "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40] "NvCplDaemon"="RUNDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe] "nwiz"="nwiz.exe" [2007-08-17 15:23 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="RunDLL32.exe" [2004-08-04 00:56 C:\WINDOWS\system32\rundll32.exe] "QuickTime Task"="D:\Program Files\QuickTime\qttask.exe" [2006-09-01 15:57] "!AVG Anti-Spyware"="D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25] "ZoneAlarm Client"="D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_Run"="D:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe" [2007-10-24 07:32] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsMenu"= 01000000 "NoRecentDocsHistory"= 01000000 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "UserAccess7"=2 (0x2) R3 P17xfi;Sound Blaster X-Fi Xtreme Audio;C:\WINDOWS\system32\drivers\P17xfi.sys R3 p17xfilt;p17xfilt;C:\WINDOWS\system32\drivers\p17xfilt.sys R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{abe1564a-799b-11db-aefc-806d6172696f}] \Shell\AutoRun\command - Z:\ASUSACPI.exe *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2007-12-15 18:10:53 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-15 13:19:25 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes … scanning hidden autostart entries … HKLM\Software\Microsoft\Windows\CurrentVersion\Run P17Helper = Rundll32 SPIRun.dll,RunDLLEntry? scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-12-15 13:20:09 . 2007-11-06 23:43:14 — E O F — Logfile of HijackThis v1.99.1 Scan saved at 1:24:07 PM, on 12/15/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\spoolsv.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe C:\Program Files\Windows Defender\MSASCui.exe D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\explorer.exe D:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32 O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r O4 - HKLM\..\Run: [P17Helper] Rundll32 SPIRun.dll,RunDLLEntry O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [AVG7_CC] D:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [ZoneAlarm Client] "D:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1164162903203 O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: NBService - Nero AG - D:\Program Files\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe One thing that I found a little odd about ComboFix, was that it set IE as my default browser and put an IE shortcut on my desktop. It also reordered some of the icons on my desktop. Dunno if that's normal or not but I figured perhaps worth mentioning. EDIT: Right after I posted Windows Defender popped up notifying me of 6 "Firewall Port Exceptions". Right now I have not selected whether to allow the changes or not.

One thing that I found a little odd about ComboFix, was that it set IE as my default browser and put an IE shortcut on my desktop. It also reordered some of the icons on my desktop. Dunno if that's normal or not but I figured perhaps worth mentioning.

Yes that's normal.

Good job

[*]Click START then RUN

[*]Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.



[*][external image: Posted Image]

[*]If shown the disclaimer, Select "2"


Here's my usual all clean post

Log looks good


You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.


[*]Make your Internet Explorer more secure - This can be done by following these simple instructions:
[*]From within Internet Explorer click on the Tools menu and then click on Options.

[*]Click once on the Security tab

[*]Click once on the Internet icon so it becomes highlighted.

[*]Click once on the Custom Level button.


[*]Change the Download signed ActiveX controls to Prompt

[*]Change the Download unsigned ActiveX controls to Disable

[*]Change the Initialize and script ActiveX controls not marked as safe to Disable

[*]Change the Installation of desktop items to Prompt

[*]Change the Launching programs and files in an IFRAME to Prompt

[*]Change the Navigate sub-frames across different domains to Prompt

[*]When all these settings have been made, click on the OK button.

[*]If it prompts you as to whether or not you want to save the settings, press the Yes button.

[*]Next press the Apply button and then the OK to exit the Internet Properties page.

[*]Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week

(Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


[*]Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.

Without a firewall your computer is succeptible to being hacked and taken over.
I am very serious about this and see it happen almost every day with my clients.
Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls


[*]Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.

This will ensure your computer has always the latest security updates available installed on your computer.
If there are new updates to install, install them immediately, reboot your computer, and revisit the site
until there are no more critical updates.


[*]Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

This will provide realtime spyware & hijacker protection on your computer alongside your virus protection.
You should also scan your computer with this program on a regular basis just as you would an antivirus software.

A tutorial on installing & using this product can be found here:

Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

[*]Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer

settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware


[*]IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all.


Using IE-SPYAD to help block unwanted sites and activities


[*]Update all these programs regularly - Make sure you update all the programs I have listed regularly.

Without regular updates you WILL NOT be protected when new malicious programs are released.
Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein