silvian condoiu
Topic Starter
IM FROM ROMANIA AND MY COPM IL INFECTED LOOK THIS
ComboFix 08-01-09.2 - coty 2008-01-09 16:56:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.225 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\#SharedObjects\ZDBJWA2R\www.broadcaster.com
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\WINDOWS\system32\awtsp.dll
C:\WINDOWS\system32\fcccyaw.dll
C:\WINDOWS\system32\lprvkgny.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pstwa.ini
C:\WINDOWS\system32\pstwa.ini2
C:\WINDOWS\system32\shfkaarb.ini
.
((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
.
2008-01-09 16:39 . 2008-01-09 16:39 d——– C:\Program Files\Trend Micro
2008-01-09 16:37 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 16:19 . 2008-01-09 16:19 340,480 –a—— C:\WINDOWS\system32\awtsp.exe
2008-01-09 15:44 . 2008-01-09 15:44 336,896 –a—— C:\WINDOWS\system32\gebyv.dll.vir
2008-01-09 14:42 . 2008-01-09 15:46 6,723 –ahs—- C:\WINDOWS\system32\vybeg.ini2.vir
2008-01-09 14:42 . 2008-01-09 15:46 6,723 –ahs—- C:\WINDOWS\system32\vybeg.ini.vir
2008-01-09 14:29 . 2008-01-09 14:29 338,944 –a—— C:\WINDOWS\system32\awvtr.dll.vir
2008-01-09 14:25 . 2008-01-09 14:42 d——– C:\Program Files\Trojan Remover
2008-01-09 14:25 . 2008-01-09 14:25 d——– C:\Documents and Settings\coty\Application Data\Simply Super Software
2008-01-09 14:25 . 2008-01-09 14:25 d——– C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-01-09 14:25 . 2003-02-02 20:06 153,088 –a—— C:\WINDOWS\system32\UNRAR3.dll
2008-01-07 11:20 . 2008-01-09 12:57 d——– C:\Program Files\Setup
2008-01-07 10:13 . 2008-01-07 10:13 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2008-01-07 10:13 . 2008-01-07 10:13 298,104 –a—— C:\WINDOWS\system32\imon.dll
2008-01-07 10:13 . 2008-01-07 10:13 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2008-01-07 09:56 . 2008-01-07 09:56 d——– C:\Documents and Settings\All Users\Application Data\AVG7
2008-01-07 09:45 . 2008-01-07 09:45 d——– C:\Program Files\Kaspersky Lab
2008-01-07 09:44 . 2008-01-07 09:44 d——– C:\kav
2008-01-07 01:44 . 2008-01-09 14:28 6,746 –a—— C:\WINDOWS\system32\rtvwa.ini2.vir
2008-01-07 01:44 . 2008-01-09 14:31 6,746 –ahs—- C:\WINDOWS\system32\rtvwa.ini.vir
2008-01-07 00:37 . 2008-01-07 00:37 d——– C:\Documents and Settings\coty\Application Data\Grisoft
2008-01-07 00:37 . 2008-01-07 09:58 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-07 00:37 . 2007-05-30 14:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-06 17:26 . 2008-01-07 00:27 d——– C:\VundoFix Backups
2008-01-06 10:28 . 2008-01-06 10:28 75,840 –a—— C:\WINDOWS\system32\xdjqddvn.dll
2008-01-06 09:47 . 2008-01-06 09:47 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-06 07:31 . 2008-01-06 07:33 d——– C:\Program Files\Yahoo!
2008-01-02 16:25 . 2008-01-06 09:47 d——– C:\Program Files\Bombardix
2008-01-02 07:39 . 2008-01-02 07:39 d——– C:\Program Files\Bricks of Egypt Trial
2008-01-02 07:37 . 2008-01-02 07:37 d——– C:\Program Files\MumboJumbo
2007-12-21 21:57 . 2007-12-21 21:57 d——– C:\Documents and Settings\coty\Application Data\Samsung
2007-12-21 21:55 . 2006-05-03 22:53 174,592 –a—— C:\WINDOWS\system32\framedyn.dll
2007-12-21 21:54 . 2007-12-21 21:55 d——– C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-21 21:54 . 2006-07-24 16:05 5,632 –a—— C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-21 21:54 . 2005-08-28 20:51 766 –a—— C:\WINDOWS\system32\Uninstall.ico
2007-12-21 21:32 . 2004-03-30 10:45 84,352 –a—— C:\WINDOWS\system32\drivers\sscdmdm.sys
2007-12-21 21:32 . 2004-03-30 10:44 52,384 –a—— C:\WINDOWS\system32\drivers\sscdbus.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,080 –a—— C:\WINDOWS\system32\drivers\sscdcmnt.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,080 –a—— C:\WINDOWS\system32\drivers\sscdcm.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,032 –a—— C:\WINDOWS\system32\drivers\sscdmdfl.sys
2007-12-21 21:32 . 2004-03-30 10:44 5,776 –a—— C:\WINDOWS\system32\drivers\sscdwhnt.sys
2007-12-21 21:32 . 2004-03-30 10:44 5,776 –a—— C:\WINDOWS\system32\drivers\sscdwh.sys
2007-12-21 21:30 . 2007-12-21 21:53 d——– C:\Program Files\SAMSUNG
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 13:47 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-09 12:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-07 08:14 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-06 05:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-01-06 05:30 ——— d—–r C:\Program Files\Program Files
2008-01-06 05:28 ——— d—–w C:\Documents and Settings\coty\Application Data\Yahoo!
2008-01-04 18:59 ——— d—–w C:\Program Files\Save
2008-01-04 18:11 ——— d—–w C:\Program Files\DAEMON Tools
2007-12-28 11:20 ——— d—–w C:\Documents and Settings\coty\Application Data\uTorrent
2007-12-21 19:53 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 15:52 ——— d—–w C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2007-11-11 15:50 ——— d—–w C:\Program Files\Winamp
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8955e72f-13f9-4029-8428-69eb6f3491ab}]
2008-01-06 10:28 75840 –a—— C:\WINDOWS\system32\xdjqddvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LocalFile]
@={0D8EDF56-A430-44C2-8233-D30358717A37}
[HKEY_CLASSES_ROOT\CLSID\{0D8EDF56-A430-44C2-8233-D30358717A37}]
C:\WINDOWS\System32\mkdesk32.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"WhenUSave"="C:\Program Files\Save\Save.exe" [ ]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 11:20 6803456]
"nwiz"="nwiz.exe" [2005-06-15 11:20 1519616 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 11:20 86016]
"SAmail"="C:\Documents and Settings\coty\Desktop\e-mail from#[removed]" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Winini.dll"="C:\WINDOWS\system32\winini.vbs" [ ]
"SAmail"="C:\Documents and Settings\coty\Desktop\e-mail from#[removed]" [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 11:15:54]
TrayMin.lnk - C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe [2007-05-17 15:24:11]
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys [2004-07-06 16:45]
R3 phc600;USB PC Camera (phc600);C:\WINDOWS\system32\DRIVERS\phc600.sys [2005-02-22 18:48]
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2007-08-06 00:39]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 13:14]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 17:02:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-01-09 17:03:46 - machine was rebooted [coty]
ComboFix-quarantined-files.txt 2008-01-09 15:03:44
.
2007-12-11 21:52:07 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:47, on 09.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: {ba1943f6-be96-8248-9204-9f31f27e5598} - {8955e72f-13f9-4029-8428-69eb6f3491ab} - C:\WINDOWS\system32\xdjqddvn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SAmail] C:\Documents and Settings\coty\Desktop\e-mail from#[removed]
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-18\..\Run: [Winini.dll] C:\WINDOWS\system32\winini.vbs (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SAmail] C:\Documents and Settings\coty\Desktop\e-mail from#[removed] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Winini.dll] C:\WINDOWS\system32\winini.vbs (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TrayMin.lnk = ?
O9 - Extra button: Voiced Keyboard Homepage - {1ff190e7-38ab-423e-b59c-4d166c2ea5f1} - http://www.yayahoohoo.com (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
–
End of file - 6030 bytes
PLEASE HELPĂ ME….. I DONT SPEAK VERY GOOD ENGL
ComboFix 08-01-09.2 - coty 2008-01-09 16:56:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.225 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\#SharedObjects\ZDBJWA2R\www.broadcaster.com
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\coty\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\FunWebProducts
C:\Program Files\MyWebSearch
C:\Program Files\MyWebSearch\bar\History\search2
C:\Program Files\MyWebSearch\bar\Settings\s_pid.dat
C:\Program Files\MyWebSearch\bar\Settings\setting2.htm
C:\Program Files\MyWebSearch\bar\Settings\settings.dat
C:\WINDOWS\system32\awtsp.dll
C:\WINDOWS\system32\fcccyaw.dll
C:\WINDOWS\system32\lprvkgny.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\pstwa.ini
C:\WINDOWS\system32\pstwa.ini2
C:\WINDOWS\system32\shfkaarb.ini
.
((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
.
2008-01-09 16:39 . 2008-01-09 16:39 d——– C:\Program Files\Trend Micro
2008-01-09 16:37 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-09 16:19 . 2008-01-09 16:19 340,480 –a—— C:\WINDOWS\system32\awtsp.exe
2008-01-09 15:44 . 2008-01-09 15:44 336,896 –a—— C:\WINDOWS\system32\gebyv.dll.vir
2008-01-09 14:42 . 2008-01-09 15:46 6,723 –ahs—- C:\WINDOWS\system32\vybeg.ini2.vir
2008-01-09 14:42 . 2008-01-09 15:46 6,723 –ahs—- C:\WINDOWS\system32\vybeg.ini.vir
2008-01-09 14:29 . 2008-01-09 14:29 338,944 –a—— C:\WINDOWS\system32\awvtr.dll.vir
2008-01-09 14:25 . 2008-01-09 14:42 d——– C:\Program Files\Trojan Remover
2008-01-09 14:25 . 2008-01-09 14:25 d——– C:\Documents and Settings\coty\Application Data\Simply Super Software
2008-01-09 14:25 . 2008-01-09 14:25 d——– C:\Documents and Settings\All Users\Application Data\Simply Super Software
2008-01-09 14:25 . 2003-02-02 20:06 153,088 –a—— C:\WINDOWS\system32\UNRAR3.dll
2008-01-07 11:20 . 2008-01-09 12:57 d——– C:\Program Files\Setup
2008-01-07 10:13 . 2008-01-07 10:13 512,096 –a—— C:\WINDOWS\system32\drivers\amon.sys
2008-01-07 10:13 . 2008-01-07 10:13 298,104 –a—— C:\WINDOWS\system32\imon.dll
2008-01-07 10:13 . 2008-01-07 10:13 15,424 –a—— C:\WINDOWS\system32\drivers\nod32drv.sys
2008-01-07 09:56 . 2008-01-07 09:56 d——– C:\Documents and Settings\All Users\Application Data\AVG7
2008-01-07 09:45 . 2008-01-07 09:45 d——– C:\Program Files\Kaspersky Lab
2008-01-07 09:44 . 2008-01-07 09:44 d——– C:\kav
2008-01-07 01:44 . 2008-01-09 14:28 6,746 –a—— C:\WINDOWS\system32\rtvwa.ini2.vir
2008-01-07 01:44 . 2008-01-09 14:31 6,746 –ahs—- C:\WINDOWS\system32\rtvwa.ini.vir
2008-01-07 00:37 . 2008-01-07 00:37 d——– C:\Documents and Settings\coty\Application Data\Grisoft
2008-01-07 00:37 . 2008-01-07 09:58 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-07 00:37 . 2007-05-30 14:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-06 17:26 . 2008-01-07 00:27 d——– C:\VundoFix Backups
2008-01-06 10:28 . 2008-01-06 10:28 75,840 –a—— C:\WINDOWS\system32\xdjqddvn.dll
2008-01-06 09:47 . 2008-01-06 09:47 d——– C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-06 07:31 . 2008-01-06 07:33 d——– C:\Program Files\Yahoo!
2008-01-02 16:25 . 2008-01-06 09:47 d——– C:\Program Files\Bombardix
2008-01-02 07:39 . 2008-01-02 07:39 d——– C:\Program Files\Bricks of Egypt Trial
2008-01-02 07:37 . 2008-01-02 07:37 d——– C:\Program Files\MumboJumbo
2007-12-21 21:57 . 2007-12-21 21:57 d——– C:\Documents and Settings\coty\Application Data\Samsung
2007-12-21 21:55 . 2006-05-03 22:53 174,592 –a—— C:\WINDOWS\system32\framedyn.dll
2007-12-21 21:54 . 2007-12-21 21:55 d——– C:\WINDOWS\system32\Samsung_USB_Drivers
2007-12-21 21:54 . 2006-07-24 16:05 5,632 –a—— C:\WINDOWS\system32\drivers\StarOpen.sys
2007-12-21 21:54 . 2005-08-28 20:51 766 –a—— C:\WINDOWS\system32\Uninstall.ico
2007-12-21 21:32 . 2004-03-30 10:45 84,352 –a—— C:\WINDOWS\system32\drivers\sscdmdm.sys
2007-12-21 21:32 . 2004-03-30 10:44 52,384 –a—— C:\WINDOWS\system32\drivers\sscdbus.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,080 –a—— C:\WINDOWS\system32\drivers\sscdcmnt.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,080 –a—— C:\WINDOWS\system32\drivers\sscdcm.sys
2007-12-21 21:32 . 2004-03-30 10:45 6,032 –a—— C:\WINDOWS\system32\drivers\sscdmdfl.sys
2007-12-21 21:32 . 2004-03-30 10:44 5,776 –a—— C:\WINDOWS\system32\drivers\sscdwhnt.sys
2007-12-21 21:32 . 2004-03-30 10:44 5,776 –a—— C:\WINDOWS\system32\drivers\sscdwh.sys
2007-12-21 21:30 . 2007-12-21 21:53 d——– C:\Program Files\SAMSUNG
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-09 13:47 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-09 12:39 ——— d—–w C:\Documents and Settings\All Users\Application Data\Symantec
2008-01-07 08:14 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-06 05:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-01-06 05:30 ——— d—–r C:\Program Files\Program Files
2008-01-06 05:28 ——— d—–w C:\Documents and Settings\coty\Application Data\Yahoo!
2008-01-04 18:59 ——— d—–w C:\Program Files\Save
2008-01-04 18:11 ——— d—–w C:\Program Files\DAEMON Tools
2007-12-28 11:20 ——— d—–w C:\Documents and Settings\coty\Application Data\uTorrent
2007-12-21 19:53 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 15:52 ——— d—–w C:\Documents and Settings\All Users\Application Data\Winamp Toolbar
2007-11-11 15:50 ——— d—–w C:\Program Files\Winamp
.
—-a-w 949,376 2008-01-08 18:12:12 C:\Program Files\Eset\nod32kui .exe —-a-w 4,670,704 2008-01-08 18:15:27 C:\Program Files\Yahoo!\Messenger\YAHOOM~1 .EXE
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8955e72f-13f9-4029-8428-69eb6f3491ab}]
2008-01-06 10:28 75840 –a—— C:\WINDOWS\system32\xdjqddvn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\LocalFile]
@={0D8EDF56-A430-44C2-8233-D30358717A37}
[HKEY_CLASSES_ROOT\CLSID\{0D8EDF56-A430-44C2-8233-D30358717A37}]
C:\WINDOWS\System32\mkdesk32.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [ ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [ ]
"WhenUSave"="C:\Program Files\Save\Save.exe" [ ]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [ ]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2005-06-15 11:20 6803456]
"nwiz"="nwiz.exe" [2005-06-15 11:20 1519616 C:\WINDOWS\system32\nwiz.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-04-15 05:01 77824 C:\WINDOWS\SOUNDMAN.EXE]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2005-06-15 11:20 86016]
"SAmail"="C:\Documents and Settings\coty\Desktop\e-mail from#[removed]" [ ]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [ ]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Winini.dll"="C:\WINDOWS\system32\winini.vbs" [ ]
"SAmail"="C:\Documents and Settings\coty\Desktop\e-mail from#[removed]" [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 11:15:54]
TrayMin.lnk - C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe [2007-05-17 15:24:11]
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys [2004-07-06 16:45]
R3 phc600;USB PC Camera (phc600);C:\WINDOWS\system32\DRIVERS\phc600.sys [2005-02-22 18:48]
S3 Boonty Games;Boonty Games;"C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe" [2007-08-06 00:39]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2007-02-15 13:14]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-09 17:02:13
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Eset\pr_imon.dll
.
Completion time: 2008-01-09 17:03:46 - machine was rebooted [coty]
ComboFix-quarantined-files.txt 2008-01-09 15:03:44
.
2007-12-11 21:52:07 — E O F —
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:14:47, on 09.01.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Philips\SPC 600NC PC Camera\TrayMin.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: {ba1943f6-be96-8248-9204-9f31f27e5598} - {8955e72f-13f9-4029-8428-69eb6f3491ab} - C:\WINDOWS\system32\xdjqddvn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SAmail] C:\Documents and Settings\coty\Desktop\e-mail from#[removed]
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WhenUSave] "C:\Program Files\Save\Save.exe"
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKUS\S-1-5-18\..\Run: [Winini.dll] C:\WINDOWS\system32\winini.vbs (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SAmail] C:\Documents and Settings\coty\Desktop\e-mail from#[removed] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Winini.dll] C:\WINDOWS\system32\winini.vbs (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: TrayMin.lnk = ?
O9 - Extra button: Voiced Keyboard Homepage - {1ff190e7-38ab-423e-b59c-4d166c2ea5f1} - http://www.yayahoohoo.com (file missing)
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} - http://ak.exe.imgfarm.com/images/nocache/f…p1.0.0.15-3.cab
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Boonty Games - BOONTY - C:\Program Files\Common Files\BOONTY Shared\Service\Boonty.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
–
End of file - 6030 bytes
PLEASE HELPĂ ME….. I DONT SPEAK VERY GOOD ENGL