What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Baseline

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I have 4 bad files…vundofix tells me all in C:windows\systems32\ fhhkj.ini fhhkj.ini2 jkhhf.dll jkhhf.exe I have windows xp I have down loaded all things you have mentioned in your help section…look forward to your advice… loaded the HJT log…what other things do I need to provide.??? thx miles
Post #2
Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.

Please copy your HijackThis log and paste it in your next reply so we can start cleaning your PC.
Post #3 last edited

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:57:58 AM, on 12/28/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\LANDesk\LDClient\LocalSch.EXE
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\LANDesk\LDClient\tmcsvc.exe
C:\PROGRA~1\LANDesk\LDClient\issuser.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\PROGRA~1\LANDesk\LDClient\collector.exe
C:\PROGRA~1\LANDesk\LDClient\rcgui.exe
C:\Program Files\LANDesk\LDClient\softmon.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\ARConsole\ARConsole.exe
C:\Program Files\ARConsole\ARCIEMon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Reuters\Plus\Nav.exe
C:\Reuters\Plus\CONNSVR.exe
C:\Reuters\Plus\DiagServ.exe
C:\Reuters\Plus\ListMan.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lawncrest.***.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lawncrest.***.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lawncrest.***.com/
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhhf.exe
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RJ VPN Test - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra 'Tools' menuitem: VPN Test for Raymond James - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra button: RJ Remote - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe (file missing)
O9 - Extra 'Tools' menuitem: Raymond James Support - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe (file missing)
O9 - Extra button: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com (file missing)
O9 - Extra 'Tools' menuitem: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://lawncrest.***.com/
O15 - Trusted Zone: www.advisorinsight.com
O15 - Trusted Zone: *.advisorinsight.com
O15 - Trusted Zone: rjf.bizcarta.com
O15 - Trusted Zone: www.bonddesk.com
O15 - Trusted Zone: *.bonddesk.com
O15 - Trusted Zone: *.extensity-hosting.com
O15 - Trusted Zone: *.forefield.com
O15 - Trusted Zone: rjf.ossid.net
O15 - Trusted Zone: *.reports.standardandpoors.com
O15 - Trusted Zone: chancery.***.com
O15 - Trusted Zone: chanceryxa.***.com
O15 - Trusted Zone: crm.***.com
O15 - Trusted Zone: *.***.com
O15 - Trusted Zone: *.standardandpoors.com
O15 - Trusted Zone: *.successfactors.com
O15 - Trusted IP range: http://***.65.3.68
O15 - Trusted IP range: ***.12.137.*
O15 - Trusted IP range: http://192.108.247.200
O15 - Trusted IP range: ***.12.143.*
O15 - Trusted IP range: http://170.12.*.*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {3C4C243E-89CE-11D4-AD0A-00508B0AE258} (acxPayroll.Utility) - https://gandy.***.com/controls/acxPayroll.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {88F3DCEE-3BE9-45A5-A70F-5E42ED61ACDB} (RJUpdWeb.RJUpdLoader) - http://gandy.***.com/Controls/RJUpdWeb.CAB
O16 - DPF: {897DF421-6987-11D2-9411-00C04F8E641F} (DocDue.RJDoc) - https://gandy.***.com/Controls/RJDocDue.CAB
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://elearning.***.com/SiteRoots/main/In…aDownloader.cab
O16 - DPF: {D98B9AEA-2B6D-11D2-9411-00C04F8E641F} (RJRanks.RJRank) - https://gandy.***.com/Controls/RJRank.CAB
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://secureaccess.***.com/dana-cached/se…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ***.com
O17 - HKLM\Software\..\Telephony: DomainName = ***.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ***.com
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\LocalSch.EXE
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LANDesk Targeted Multicast (Intel Targeted Multicast) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\tmcsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LANDesk Remote Control Service (ISSUSER) - LANDesk Software, Ltd. - C:\PROGRA~1\LANDesk\LDClient\issuser.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: LANDesk® Software Monitoring Service (Softmon) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\softmon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe

–
End of file - 7954 bytes

Post #4 last edited

Hi :)

First a few questions, as there are some unknown files in your log.
 

C:\Program Files\ARConsole\ARConsole.exe
C:\Program Files\ARConsole\ARCIEMon.exe
C:\Reuters\Plus\Nav.exe
C:\Reuters\Plus\CONNSVR.exe
C:\Reuters\Plus\DiagServ.exe
C:\Reuters\Plus\ListMan.exe
C:\Program Files\Common Files\vpn-ping.exe

Do you know what the above files are?
 

O15 - Trusted Zone: www.advisorinsight.com
O15 - Trusted Zone: *.advisorinsight.com
O15 - Trusted Zone: rjf.bizcarta.com
O15 - Trusted Zone: www.bonddesk.com
O15 - Trusted Zone: *.bonddesk.com
O15 - Trusted Zone: *.extensity-hosting.com
O15 - Trusted Zone: *.forefield.com
O15 - Trusted Zone: rjf.ossid.net
O15 - Trusted Zone: *.reports.standardandpoors.com
O15 - Trusted Zone: chancery.***.com
O15 - Trusted Zone: chanceryxa.***.com
O15 - Trusted Zone: crm.***.com
O15 - Trusted Zone: *.***.com
O15 - Trusted Zone: *.standardandpoors.com
O15 - Trusted Zone: *.successfactors.com
O15 - Trusted IP range: http://***.65.3.68
O15 - Trusted IP range: ***.12.137.*
O15 - Trusted IP range: http://192.108.247.200
O15 - Trusted IP range: ***.12.143.*
O15 - Trusted IP range: http://***.12.*.*

Have you added these sites/IP addresses to the Trusted Zone yourself?

Open HijackThis.
 

  • Click on the Config button.
  • Click on the Misc Tools button.
  • Click on the Open Uninstall Manager button.
  • Click on the Save list… button and save the file to a convenient location. When you press Save, Notepad will open with the contents of that file.

Please post the answers to my questions in your next reply, along with the HijackThis Uninstall List (uninstall_list.txt)

Post #6
Simon V. sorry didn't see the things you asked for…every time i click the save list button, the whole site goes away, like i exited out.???? i can't cut and paste..not sure how to proceed.??? thx miles
Post #7
Hi :)

If this is a company computer, please inform you organization that you are being helped here. We do not want to replace your IT department, and they should know what's going on with their PC's.

Do you know what the files are that I asked you about?

There is another way to create an Uninstall List:

Please download and install CCleaner.

  • Open CCleaner. In the Left Pane, click Tools.
  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save, then exit Ccleaner.

Please post the CCleaner Uninstall List (install.txt) in your next reply.
Post #8
I own this computer, and my IT dept did work on it remote and can't clean this up, so it is up to me…that is why i am here…thx..here is the info you asked for… Adobe Flash Player ActiveX Adobe Reader 8 Advisor's Resource Account Inquiry Advisor's Resource Console Agere Systems HDA Modem Apple Mobile Device Support Apple Software Update ATI Display Driver CCleaner (remove only) CentraOne Client Reports Crystal Reports for Visual Studio .NET Crystal Reports for Visual Studio .NET FA Book HighMAT Extension to Microsoft Windows XP CD Writing Wizard HijackThis 2.0.2 Hotfix for Windows XP (KB896344) Hotfix for Windows XP (KB935448) HP Quick Launch Buttons 6.30 A3 Identity Management Suite DIRECT! Intel® Graphics Media Accelerator Driver InterVideo DVD Check InterVideo WinDVD iTunes Java 2 Runtime Environment, SE v1.4.2_07 Java 2 Runtime Environment, SE v1.4.2_12 Juniper Networks Network Connect 5.3.0 Juniper Networks Network Connect 5.5.0 LANDesk Advance Agent LANDesk® Antivirus LANDesk® Common Base Agent 8 LoadPicture Microsoft .NET Framework 1.1 Hotfix (KB928366) Microsoft .NET Framework 1.1 SP1 with KB886903 Hotfix Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Base Smart Card Cryptographic Service Provider Package Microsoft Office Live Meeting 2005 Microsoft Office PowerPoint Viewer 2003 Microsoft Office Professional Edition 2003 MSXML 4.0 SP2 (KB927978) MSXML 4.0 SP2 (KB936181) MSXML 4.0 SP2 Parser and SDK QuickTime Raymond James Investment Policy Statement System RegSupreme Reuters Plus RJ Wep Shell Security Update for Microsoft .NET Framework 2.0 (KB928365) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows Media Player 10 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899589) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917159) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920214) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921398) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB921883) Security Update for Windows XP (KB922616) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB944653) Sonic Audio Module Sonic Copy Module Sonic Data Module Sonic DLA Sonic Express Labeler Sonic Update Manager Spybot - Search & Destroy 1.4 SUPERAntiSpyware Free Edition Trend Micro OfficeScan Client Update for Windows XP (KB894391) Update for Windows XP (KB896727) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB900930) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920342) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) WebFldrs XP Windows Genuine Advantage Validation Tool (KB892130) Windows Installer 3.1 (KB893803) Windows Media Connect Windows Media Format Runtime Windows Media Player 10 Hotfix - KB892313 Windows Media Player 10 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB884020 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB887797 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781
Post #10
Hi :)

Simon V….the files you high lighted are all work related…reuters are quotes and news…the others are pure work sites…miles

Ok, that's fine :thumbup:

Step 1

Open CCleaner. On the Windows tab, leave the default options alone.

  • On the Applications tab, check (tick) all the boxes except Saved Form Information. This will remove all your saved passwords if you leave this box checked.
  • Click on the Run Cleaner button at the bottom right hand corner.
  • Close CCleaner.

Step 2

Please download Combofix:

  • From BleepingComputer
  • From InfoSpyware
  • From GeeksToGo

Double-click on combofix.exe and follow the prompts.
When finished, it will produce a log for you. Save it to a convenient location.

Note: Do not mouseclick Combofix's window whilst it's running. That may cause it to stall.

Step 3

Click on Start, then Control Panel. Double click on Add or Remove Programs.

Please remove the following program(s):

  • Java 2 Runtime Environment, SE v1.4.2_07
  • Java 2 Runtime Environment, SE v1.4.2_12

Then download and install Java Runtime Environment (JRE) 6 Update 3.

Step 4

In your next reply, please post:

  • the Combofix log (C:\Combofix.txt)
  • a new HijackThis log
Post #12
I'm not sure what you mean. When following my link, you should download the fourth down the list. Download it to your desktop, or to your regular download folder. Then double-click the file to install the new Java version.
Post #13 last edited
Simon V…since I took out the two old ones, just wasn't sure where to put the new one….here are the two logs…
 
 
ComboFix 07-12-21.4 - mmagyar 2007-12-28 14:24:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1471 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
 
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\Documents and Settings\mmagyar\Application Data\CROSOF~1
C:\Documents and Settings\mmagyar\Application Data\YSTEM~1
C:\Documents and Settings\mmagyar\Application Data\YSTEM~1\?ystem\
C:\Documents and Settings\mmagyar\Application Data\YSTEM~1\nslookup.exe
C:\Program Files\Temporary
C:\temp\tn3
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\fhhkj.ini
C:\WINDOWS\system32\fhhkj.ini2
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\x64
 
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
 
.
——-\LEGACY_CORE
——-\core
 
 
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-28 )))))))))))))))))))))))))))))))
.
 
2007-12-28 14:23 . 2007-12-28 14:23 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-28 14:20 . 2007-12-28 14:20 d——– C:\Program Files\Yahoo!
2007-12-28 13:27 . 2007-12-28 13:27 335,360 –a—— C:\WINDOWS\system32\RCXCE.tmp
2007-12-28 11:35 . 2007-12-28 11:35 335,360 –a—— C:\WINDOWS\system32\RCX69.tmp
2007-12-28 11:04 . 2007-12-28 11:04 335,360 –a—— C:\WINDOWS\system32\RCX4B.tmp
2007-12-28 09:05 . 2007-12-28 09:05 335,360 –a—— C:\WINDOWS\system32\RCXD.tmp
2007-12-27 16:48 . 2007-12-28 14:28 335,360 –a—— C:\WINDOWS\system32\jkhhf.exe
2007-12-27 14:52 . 2007-12-28 14:21 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-21 16:12 . 2007-12-21 16:17 206 –a—— C:\WINDOWS\system32\febfaa2_g.ocx
2007-12-21 10:30 . 2007-12-27 09:50 d——– C:\VundoFix Backups
2007-12-21 09:28 . 2007-12-21 16:17 206 –a—— C:\WINDOWS\system32\ebeaaef9_g.dll
2007-12-21 09:27 . 2007-12-21 09:28 d——– C:\Program Files\RegSupreme
2007-12-21 09:18 . 2007-12-21 09:46 d——– C:\WINDOWS\BDOSCAN8
2007-12-20 18:26 . 2007-12-20 18:26 335,360 –a—— C:\WINDOWS\system32\RCXA.tmp
2007-12-20 16:14 . 2007-12-20 16:14 d——– C:\Documents and Settings\LocalService\Application Data\Juniper Networks
2007-12-20 16:01 . 2007-12-28 14:28 d——– C:\Program Files\SUPERAntiSpyware
2007-12-20 16:01 . 2007-12-20 16:01 d——– C:\Documents and Settings\mmagyar\Application Data\SUPERAntiSpyware.com
2007-12-20 16:01 . 2007-12-20 16:01 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-20 16:00 . 2007-12-24 17:47 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-20 15:58 . 2007-12-20 15:58 d——– C:\Program Files\CCleaner
2007-12-20 15:39 . 2007-12-20 15:39 335,360 –a—— C:\WINDOWS\system32\RCX31.tmp
2007-12-20 14:24 . 2007-12-20 14:24 335,360 –a—— C:\WINDOWS\system32\RCX2F.tmp
2007-12-20 13:58 . 2007-12-20 13:58 335,360 –a—— C:\WINDOWS\system32\RCX2E.tmp
2007-12-07 17:15 . 2007-12-07 17:15 d——– C:\Documents and Settings\mmagyar\Application Data\Panasonic
 
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 19:28 ——— d—–w C:\Program Files\QuickTime
2007-12-28 19:26 ——— d—–w C:\Documents and Settings\All Users\Application Data\vulScan
2007-12-28 14:31 ——— d—–w C:\Program Files\AREquityOptionOrderEntry
2007-12-26 18:32 ——— d—–w C:\Program Files\Trend Micro
2007-12-21 15:12 158,208 —-a-w C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe
2007-12-20 20:46 ——— d—–w C:\Program Files\iTunes
2007-12-20 18:11 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(6).dsk
2007-12-20 18:11 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(5).dsk
2007-12-20 18:11 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2007-12-20 18:11 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2007-12-20 18:11 166,945 —-a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2007-11-30 16:40 ——— d—–w C:\Program Files\ClientReports
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 21:17 ——— d—–w C:\Program Files\CentraOne
2007-10-29 15:35 ——— d—–w C:\Program Files\ARCalculator
2007-10-25 15:26 53,248 —-a-w C:\WINDOWS\bdoscandel.exe
2007-10-12 15:11 63,311 —-a-w C:\Program Files\Common Files\vpn-ping.exe
.
 
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
 
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39336A32-F14B-401F-9C93-647DDE4997D4}]
2007-12-28 14:28 331776 –a—— C:\WINDOWS\system32\jkhhf.dll
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-12-28 14:28]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2007-12-28 14:28]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2007-12-28 14:28]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)
"consentpromptbehavioradmin"= 1 (0x1)
"enableinstallerdetection"= 0 (0x0)
"filteradministratortoken"= 1 (0x1)
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"RunLogonScriptSync"= 1 (0x1)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=C:\WINDOWS\system32\jkhhf.exe
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkhhf
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD Check.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
backup=C:\WINDOWS\pss\DVD Check.lnkCommon Startup
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bjvbu]
C:\Documents and Settings\mmagyar\Application Data\??crosoft\w?wexec.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CustomScript]
C:\Windows\System32\WSCRIPT.EXE C:\Windows\System32\glp85.vbe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIRECT!]
2007-12-20 15:45 436224 –a—— C:\Program Files\Courion Corporation\Identity Management Suite DIRECT!\direct.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2007-12-20 15:45 484864 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-12-20 15:45 693760 –a—— C:\Program Files\iTunes\iTunesHelper.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
2007-12-28 14:28 335360 –a—— C:\WINDOWS\system32\jkhhf.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor]
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe -HideWindow
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask .exe -atboottime
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDClientMonitor]
2007-12-20 15:45 616448 –a—— C:\Program Files\LANDesk\LDClient\webportal\sdclientmonitor.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-12-20 15:45 1265152 –a—— C:\Program Files\Analog Devices\Core\smax4pnp.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uros]
C:\DOCUME~1\mmagyar\APPLIC~1\YSTEM~1\nslookup.exe -vt yazb
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
2007-12-20 15:46 184320 –a—— C:\Program Files\InterVideo\DVD Check\DVDCheck .exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
 
R2 CBA8;LANDesk® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe" [2006-11-21 13:03]
R2 Softmon;LANDesk® Software Monitoring Service;"C:\Program Files\LANDesk\LDClient\softmon.exe" [2007-02-23 18:18]
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [2005-06-07 13:53]
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys [2007-06-22 14:03]
R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2006-04-06 14:49]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2006-04-25 16:26]
R3 ldmirror;ldmirror;C:\WINDOWS\system32\DRIVERS\ldmirror.sys [2005-07-01 17:48]
R3 mirrorflt;Mirror Filter Driver for Uninstall;C:\WINDOWS\system32\DRIVERS\mirrorflt.sys [2005-07-01 17:48]
S3 ldblank;Screen Blanking driver for Remote Control;C:\WINDOWS\system32\DRIVERS\ldblank.sys [2005-07-01 17:48]
 
.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 02:21:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
 
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-28 14:28:08
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes …
 
scanning hidden autostart entries …
 
scanning hidden files …
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
 
PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\WINDOWS\system32\jkhhf.dll
.
Completion time: 2007-12-28 14:29:01 - machine was rebooted
 
 
 
and here is new HJT Log…..
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:49, on 2007-12-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\LANDesk\LDClient\LocalSch.EXE
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\LANDesk\LDClient\tmcsvc.exe
C:\PROGRA~1\LANDesk\LDClient\issuser.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\PROGRA~1\LANDesk\LDClient\collector.exe
C:\PROGRA~1\LANDesk\LDClient\rcgui.exe
C:\Program Files\LANDesk\LDClient\softmon.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon .exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lawncrest..com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lawncrest.***.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lawncrest.***.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F3 - REG:win.ini: load=C:\WINDOWS\system32\jkhhf.exe
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RJ VPN Test - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra 'Tools' menuitem: VPN Test for Raymond James - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra button: RJ Remote - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe(file missing)
O9 - Extra 'Tools' menuitem: Raymond James Support - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe(file missing)
O9 - Extra button: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com(file missing)
O9 - Extra 'Tools' menuitem: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com(file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://lawncrest.***.com/
O15 - Trusted Zone: www.advisorinsight.com
O15 - Trusted Zone: *.advisorinsight.com
O15 - Trusted Zone: ***.bizcarta.com
O15 - Trusted Zone: www.bonddesk.com
O15 - Trusted Zone: *.bonddesk.com
O15 - Trusted Zone: *.extensity-hosting.com
O15 - Trusted Zone: *.forefield.com
O15 - Trusted Zone: ***.ossid.net
O15 - Trusted Zone: *.reports.standardandpoors.com
O15 - Trusted Zone: chancery.***.com
O15 - Trusted Zone: chanceryxa.***.com
O15 - Trusted Zone: crm.***.com
O15 - Trusted Zone: *.***.com
O15 - Trusted Zone: *.standardandpoors.com
O15 - Trusted Zone: *.successfactors.com
O15 - Trusted IP range: http://216.65.3.68
O15 - Trusted IP range: 170.12.137.*
O15 - Trusted IP range: http://192.108.247.200
O15 - Trusted IP range: 170.12.143.*
O15 - Trusted IP range: http://170.12.*.*
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3C4C243E-89CE-11D4-AD0A-00508B0AE258} (acxPayroll.Utility) - https://gandy.***.com/controls/acxPayroll.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {88F3DCEE-3BE9-45A5-A70F-5E42ED61ACDB} (RJUpdWeb.RJUpdLoader) - http://gandy.***.com/Controls/RJUpdWeb.CAB
O16 - DPF: {897DF421-6987-11D2-9411-00C04F8E641F} (DocDue.RJDoc) - https://gandy.***.com/Controls/RJDocDue.CAB
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://elearning.***.com/SiteRoots/main/In…aDownloader.cab
O16 - DPF: {D98B9AEA-2B6D-11D2-9411-00C04F8E641F} (RJRanks.RJRank) - https://gandy.***.com/Controls/RJRank.CAB
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://secureaccess.***.com/dana-cached/se…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ***.com
O17 - HKLM\Software\..\Telephony: DomainName = ***.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ***.com
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\LocalSch.EXE
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LANDesk Targeted Multicast (Intel Targeted Multicast) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\tmcsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LANDesk Remote Control Service (ISSUSER) - LANDesk Software, Ltd. - C:\PROGRA~1\LANDesk\LDClient\issuser.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: LANDesk® Software Monitoring Service (Softmon) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\softmon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
 
–
End of file - 7957 bytes
Post #14
Hi :)

Copy/paste the results in Notepad and save them to your desktop.

Step 2

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINDOWS\system32\RCXCE.tmp
C:\WINDOWS\system32\RCX69.tmp
C:\WINDOWS\system32\RCX4B.tmp
C:\WINDOWS\system32\RCXD.tmp
C:\WINDOWS\system32\jkhhf.exe
C:\WINDOWS\system32\febfaa2_g.ocx
C:\WINDOWS\system32\ebeaaef9_g.dll
C:\WINDOWS\system32\RCXA.tmp
C:\WINDOWS\system32\RCX31.tmp
C:\WINDOWS\system32\RCX2F.tmp
C:\WINDOWS\system32\RCX2E.tmp
C:\WINDOWS\system32\drivers\core.cache(6).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\jkhhf.dll

Folder::

C:\VundoFix Backups

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{39336A32-F14B-401F-9C93-647DDE4997D4}]
[HKEY_CURRENT_USER\software\microsoft\windows nt\currentversion\windows]
"load"=-
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bjvbu]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CustomScript]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uros]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]

FileLook::

C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 3

Please do an online scan with Kaspersky WebScanner.

Click on Kaspersky Online Scanner. On the welcome screen, click Accept.

You will be promted to install an ActiveX component from Kaspersky, click Install.

  • The program will launch and then begin downloading the latest definition files.
  • Once the files have been downloaded click on Next.
  • Now click on Scan Settings.
  • In the scan settings make sure that the following are selected:

  • Scan using the following Anti-Virus database:

    Extended (if available, otherwise Standard)

  • Scan Options:

    Scan Archives
    Scan Mail Bases

  • Click OK.
  • Now under Select a Target to Scan:

    Select My Computer.

  • The program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button and save the file to your desktop.

Step 4

In your next reply, please post:

  • the Combofix log (C:\Combofix.txt)
  • the Kaspersky Online Scan report
  • a new HijackThis log
Post #15 last edited
Kaspersky report:
 
2007-12-28 16:41
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/12/2007
Kaspersky Anti-Virus database records: 499123
 
 
Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true
 
Scan Target My Computer
C:\
D:\
F:\
H:\
K:\
M:\
 
Scan Statistics
Total number of scanned objects 38808
Number of viruses found 3
Number of infected objects 57
Number of suspicious objects 0
Duration of the scan process 00:28:59
 
Infected Object Name Virus Name Last Action
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
 
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
 
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
 
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
 
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
 
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
 
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
 
C:\Documents and Settings\mmagyar\Application Data\Microsoft\Outlook\Miles Magyar.srs Object is locked skipped
 
C:\Documents and Settings\mmagyar\Application Data\Microsoft\Outlook\outitems.log Object is locked skipped
 
C:\Documents and Settings\mmagyar\Application Data\Microsoft\Templates\Normal.dot Object is locked skipped
 
C:\Documents and Settings\mmagyar\Cookies\index.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Application Data\Microsoft\Outlook\outlook.ost Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\History\History.IE5\index.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\History\History.IE5\MSHist012007122820071229\index.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Temp\ExchangePerflog_8484fa31372f88ceccf8722c.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Temp\~DF21B6.tmp Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Temp\~DF8E0B.tmp Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Temp\~DF8F53.tmp Object is locked skipped
 
C:\Documents and Settings\mmagyar\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\ntuser.dat Object is locked skipped
 
C:\Documents and Settings\mmagyar\ntuser.dat.LOG Object is locked skipped
 
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
 
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
 
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
 
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
 
C:\Program Files\Analog Devices\Core\smax4pnp.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\Courion Corporation\Identity Management Suite DIRECT!\direct.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\InterVideo\DVD Check\DVDCheck.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\iTunes\iTunesHelper.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\Juniper Networks\Common Files\NCService.log Object is locked skipped
 
C:\Program Files\LANDesk\LDClient\WebPortal\sdclientmonitor.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask .exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\QuickTime\qttask.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\Documents and Settings\mmagyar\Application Data\YSTEM~1\nslookup.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\VundoFix Backups\jkhhf.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clc skipped
 
C:\qoobox\Quarantine\C\VundoFix Backups\jkhhf.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\VundoFix Backups\MSConfig.exe.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\jkhhf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.clc skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\jkhhf.exe.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX2E.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX2F.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX31.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX4B.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCX69.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCXA.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCXCE.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\C\WINDOWS\system32\RCXD.tmp.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\qoobox\Quarantine\catchme2007-12-28_142800.03.zip/core.sys Infected: Rootkit.Win32.Agent.sg skipped
 
C:\qoobox\Quarantine\catchme2007-12-28_142800.03.zip/jkhhf.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clc skipped
 
C:\qoobox\Quarantine\catchme2007-12-28_142800.03.zip ZIP: infected - 2 skipped
 
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP2\A0000005.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP2\A0000006.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP2\A0000007.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP2\A0000008.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000010.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000017.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clc skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000038.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000040.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000041.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP3\A0000042.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP7\A0000276.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP7\A0000277.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP7\A0000278.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP7\A0000279.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP8\A0000281.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clc skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP8\A0000290.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP8\A0000306.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\System Volume Information\_restore{E5A845CA-B802-48C8-B432-64FECBA93A35}\RP8\change.log Object is locked skipped
 
C:\WINDOWS\CSC\00000001 Object is locked skipped
 
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
 
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
 
C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
 
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
 
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
 
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
 
C:\WINDOWS\system32\config\default Object is locked skipped
 
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
 
C:\WINDOWS\system32\config\SAM Object is locked skipped
 
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
 
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
 
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
 
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
 
C:\WINDOWS\system32\config\software Object is locked skipped
 
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
 
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
 
C:\WINDOWS\system32\config\system Object is locked skipped
 
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
 
C:\WINDOWS\system32\DLA\DLACTRLW.EXE Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
 
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
 
C:\WINDOWS\system32\wscript.exe.tmp Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped
 
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
 
Scan process completed.
 
 
 
 
 
Combofix.txt Report:
ComboFix 07-12-21.4 - mmagyar 2007-12-28 15:21:26.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1472 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\mmagyar\Desktop\CFScript.txt
* Created a new restore point
 
FILE
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\drivers\core.cache(6).dsk
C:\WINDOWS\system32\ebeaaef9_g.dll
C:\WINDOWS\system32\febfaa2_g.ocx
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkhhf.exe
C:\WINDOWS\system32\RCX2E.tmp
C:\WINDOWS\system32\RCX2F.tmp
C:\WINDOWS\system32\RCX31.tmp
C:\WINDOWS\system32\RCX4B.tmp
C:\WINDOWS\system32\RCX69.tmp
C:\WINDOWS\system32\RCXA.tmp
C:\WINDOWS\system32\RCXCE.tmp
C:\WINDOWS\system32\RCXD.tmp
.
 
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\fhhkj.ini.bad
C:\VundoFix Backups\fhhkj.ini2.bad
C:\VundoFix Backups\jkhhf.dll.bad
C:\VundoFix Backups\jkhhf.exe.bad
C:\VundoFix Backups\MSConfig.exe.bad
C:\WINDOWS\system32\cfx32.ocx
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\drivers\core.cache(6).dsk
C:\WINDOWS\system32\ebeaaef9_g.dll
C:\WINDOWS\system32\febfaa2_g.ocx
C:\WINDOWS\system32\fhhkj.ini
C:\WINDOWS\system32\fhhkj.ini2
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkhhf.exe
C:\WINDOWS\system32\RCX2E.tmp
C:\WINDOWS\system32\RCX2F.tmp
C:\WINDOWS\system32\RCX31.tmp
C:\WINDOWS\system32\RCX4B.tmp
C:\WINDOWS\system32\RCX69.tmp
C:\WINDOWS\system32\RCXA.tmp
C:\WINDOWS\system32\RCXCE.tmp
C:\WINDOWS\system32\RCXD.tmp
 
.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-28 )))))))))))))))))))))))))))))))
.
 
2007-12-28 14:23 . 2007-12-28 14:23 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2007-12-28 14:20 . 2007-12-28 14:20 d——– C:\Program Files\Yahoo!
2007-12-27 14:52 . 2007-12-28 14:21 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-21 09:27 . 2007-12-21 09:28 d——– C:\Program Files\RegSupreme
2007-12-21 09:18 . 2007-12-21 09:46 d——– C:\WINDOWS\BDOSCAN8
2007-12-20 16:14 . 2007-12-20 16:14 d——– C:\Documents and Settings\LocalService\Application Data\Juniper Networks
2007-12-20 16:01 . 2007-12-28 15:21 d——– C:\Program Files\SUPERAntiSpyware
2007-12-20 16:01 . 2007-12-20 16:01 d——– C:\Documents and Settings\mmagyar\Application Data\SUPERAntiSpyware.com
2007-12-20 16:01 . 2007-12-20 16:01 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-20 16:00 . 2007-12-24 17:47 d——– C:\Program Files\Common Files\Wise Installation Wizard
2007-12-20 15:58 . 2007-12-20 15:58 d——– C:\Program Files\CCleaner
2007-12-20 13:11 . 2007-12-20 16:13 d–hs—- C:\WINDOWS\UHJlZmVycmVkIEN1c3RvbWVy
2007-12-20 13:11 . 2007-12-20 16:13 d——– C:\WINDOWS\system32\no9
2007-12-20 13:11 . 2007-12-20 16:13 d——– C:\WINDOWS\system32\jc2
2007-12-20 13:11 . 2007-12-20 16:13 d——– C:\WINDOWS\system32\ineWc01
2007-12-20 13:11 . 2007-12-20 16:13 d——– C:\WINDOWS\system32\hl9
2007-12-20 13:11 . 2007-12-21 09:45 d——– C:\WINDOWS\system32\hd1
2007-12-20 13:11 . 2007-12-20 16:13 d——– C:\WINDOWS\system32\ax1
2007-12-07 17:15 . 2007-12-07 17:15 d——– C:\Documents and Settings\mmagyar\Application Data\Panasonic
 
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 20:24 ——— d—–w C:\Documents and Settings\All Users\Application Data\vulScan
2007-12-28 20:21 ——— d—–w C:\Program Files\QuickTime
2007-12-28 19:31 ——— d—–w C:\Program Files\Java
2007-12-28 14:31 ——— d—–w C:\Program Files\AREquityOptionOrderEntry
2007-12-26 18:32 ——— d—–w C:\Program Files\Trend Micro
2007-12-20 20:46 ——— d—–w C:\Program Files\iTunes
2007-11-30 16:40 ——— d—–w C:\Program Files\ClientReports
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 21:17 ——— d—–w C:\Program Files\CentraOne
2007-10-29 15:35 ——— d—–w C:\Program Files\ARCalculator
2007-10-25 15:26 53,248 —-a-w C:\WINDOWS\bdoscandel.exe
2007-10-12 15:11 63,311 —-a-w C:\Program Files\Common Files\vpn-ping.exe
.
 
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
 
—- C:\WINDOWS\pchealth\helpctr\binaries\MSConfig .exe —-
 
Company: Microsoft Corporation
File Description: System Configuration Utility
File Version: 5.1.2600.2180 (xpsp_sp2_rtm.040803-2158)
Product Name: Microsoftr Windowsr Operating System
Copyright: c Microsoft Corporation. All rights reserved.
Original file name: msconfig.EXE
 
 
((((((((((((((((((((((((((((( snapshot@2007-12-28_14.28.37.58 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-12-28 14:03:28 61,358 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2007-12-28 19:31:07 61,358 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2007-12-28 14:03:28 398,250 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-28 19:31:07 398,250 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2007-12-28 20:25:39 16,384 —-atw C:\WINDOWS\temp\Perflib_Perfdata_42c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-12-28 15:21]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2007-12-28 15:21]
"QuickTime Task"="C:\Program Files\QuickTime\qttask .exe" [2007-12-28 15:25]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"disablecad"= 0 (0x0)
"consentpromptbehavioradmin"= 1 (0x1)
"enableinstallerdetection"= 0 (0x0)
"filteradministratortoken"= 1 (0x1)
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"RunLogonScriptSync"= 1 (0x1)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\\WINDOWS\\system32\\jkhhf
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD Check.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\DVD Check.lnk
backup=C:\WINDOWS\pss\DVD Check.lnkCommon Startup
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DIRECT!]
2007-12-20 15:45 436224 –a—— C:\Program Files\Courion Corporation\Identity Management Suite DIRECT!\direct.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
2007-12-20 15:45 484864 –a—— C:\WINDOWS\System32\DLA\DLACTRLW.EXE
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-12-20 15:45 693760 –a—— C:\Program Files\iTunes\iTunesHelper.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OfficeScanNT Monitor]
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe -HideWindow
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PTHOSTTR]
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask .exe -atboottime
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SDClientMonitor]
2007-12-20 15:45 616448 –a—— C:\Program Files\LANDesk\LDClient\webportal\sdclientmonitor.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
2007-12-20 15:45 1265152 –a—— C:\Program Files\Analog Devices\Core\smax4pnp.exe
 
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WatchDog]
2007-12-20 15:46 184320 –a—— C:\Program Files\InterVideo\DVD Check\DVDCheck .exe
 
R2 CBA8;LANDesk® Management Agent;"C:\Program Files\LANDesk\Shared Files\residentagent.exe" [2006-11-21 13:03]
R2 Softmon;LANDesk® Software Monitoring Service;"C:\Program Files\LANDesk\LDClient\softmon.exe" [2007-02-23 18:18]
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [2005-06-07 13:53]
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys [2007-06-22 14:03]
R3 GTIPCI21;GTIPCI21;C:\WINDOWS\system32\DRIVERS\gtipci21.sys [2006-04-06 14:49]
R3 IFXTPM;IFXTPM;C:\WINDOWS\system32\DRIVERS\IFXTPM.SYS [2006-04-25 16:26]
R3 ldmirror;ldmirror;C:\WINDOWS\system32\DRIVERS\ldmirror.sys [2005-07-01 17:48]
R3 mirrorflt;Mirror Filter Driver for Uninstall;C:\WINDOWS\system32\DRIVERS\mirrorflt.sys [2005-07-01 17:48]
S3 ldblank;Screen Blanking driver for Remote Control;C:\WINDOWS\system32\DRIVERS\ldblank.sys [2005-07-01 17:48]
 
.
Contents of the 'Scheduled Tasks' folder
"2007-09-24 02:21:39 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
 
catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-28 15:26:01
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes …
 
scanning hidden autostart entries …
 
scanning hidden files …
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
Completion time: 2007-12-28 15:26:55 - machine was rebooted
C:\ComboFix2.txt … 2007-12-28 14:29
 
 
HJT Log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:44, on 2007-12-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\LANDesk\Shared Files\residentagent.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\LANDesk\LDClient\LocalSch.EXE
C:\WINDOWS\system32\CBA\pds.exe
C:\Program Files\LANDesk\LDClient\tmcsvc.exe
C:\PROGRA~1\LANDesk\LDClient\issuser.exe
C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
C:\PROGRA~1\LANDesk\LDClient\rcgui.exe
C:\PROGRA~1\LANDesk\LDClient\collector.exe
C:\Program Files\LANDesk\LDClient\softmon.exe
C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\OfficeScan Client\pccntmon .exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
 
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://lawncrest.***.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://lawncrest.***.com/
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://lawncrest.***.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RJ VPN Test - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra 'Tools' menuitem: VPN Test for Raymond James - {D7721A38-ABCD-3586-DCAB-40E2A90F3736} - C:\Program Files\Common Files\vpn-ping.exe
O9 - Extra button: RJ Remote - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe(file missing)
O9 - Extra 'Tools' menuitem: Raymond James Support - {D7721A38-ABCD-3586-DCAB-40E2A90F3737} - http://ballast.***.com/download/RJGateway/RJGateway.exe(file missing)
O9 - Extra button: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com(file missing)
O9 - Extra 'Tools' menuitem: Raymond James VPN - {D7721A38-ABCD-3586-DCAB-40E2A90F3738} - https://secureaccess.***.com(file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://lawncrest.***.com/
O15 - Trusted Zone: www.advisorinsight.com
O15 - Trusted Zone: *.advisorinsight.com
O15 - Trusted Zone: ***.bizcarta.com
O15 - Trusted Zone: www.bonddesk.com
O15 - Trusted Zone: *.bonddesk.com
O15 - Trusted Zone: *.extensity-hosting.com
O15 - Trusted Zone: *.forefield.com
O15 - Trusted Zone: ***.ossid.net
O15 - Trusted Zone: *.reports.standardandpoors.com
O15 - Trusted Zone: chancery.***.com
O15 - Trusted Zone: chanceryxa.***.com
O15 - Trusted Zone: crm.***.com
O15 - Trusted Zone: *.***.com
O15 - Trusted Zone: *.standardandpoors.com
O15 - Trusted Zone: *.successfactors.com
O15 - Trusted IP range: http://216.65.3.68
O15 - Trusted IP range: 170.12.137.*
O15 - Trusted IP range: http://192.108.247.200
O15 - Trusted IP range: 170.12.143.*
O15 - Trusted IP range: http://170.12.*.*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3C4C243E-89CE-11D4-AD0A-00508B0AE258} (acxPayroll.Utility) - https://gandy.***.com/controls/acxPayroll.CAB
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {88F3DCEE-3BE9-45A5-A70F-5E42ED61ACDB} (RJUpdWeb.RJUpdLoader) - http://gandy.***.com/Controls/RJUpdWeb.CAB
O16 - DPF: {897DF421-6987-11D2-9411-00C04F8E641F} (DocDue.RJDoc) - https://gandy.***.com/Controls/RJDocDue.CAB
O16 - DPF: {B24F0664-7DDA-40B6-B38C-A4FD68DE8685} (CentraDownloaderCtl Class) - http://elearning.***.com/SiteRoots/main/In…aDownloader.cab
O16 - DPF: {D98B9AEA-2B6D-11D2-9411-00C04F8E641F} (RJRanks.RJRank) - https://gandy.***.com/Controls/RJRank.CAB
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetupSP1 Control) - https://secureaccess.***.com/dana-cached/se…perSetupSP1.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ***.com
O17 - HKLM\Software\..\Telephony: DomainName = ***.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ***.com
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: LANDesk® Management Agent (CBA8) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\Shared Files\residentagent.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel Local Scheduler Service - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\LocalSch.EXE
O23 - Service: Intel PDS - LANDesk Software Ltd. - C:\WINDOWS\system32\CBA\pds.exe
O23 - Service: LANDesk Targeted Multicast (Intel Targeted Multicast) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\tmcsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LANDesk Remote Control Service (ISSUSER) - LANDesk Software, Ltd. - C:\PROGRA~1\LANDesk\LDClient\issuser.exe
O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\ntrtscan.exe
O23 - Service: LANDesk® Software Monitoring Service (Softmon) - LANDesk Software, Ltd. - C:\Program Files\LANDesk\LDClient\softmon.exe
O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\tmlisten.exe
O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\OfficeScan Client\TmProxy.exe
 
–
End of file - 8483 bytes

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI