This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Infected Computer

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

My computer is running wierd. I got this log from ComboFix. Any help would be greatly appreciated.

ComboFix 08-01-10.2 - Owner 2008-01-10 15:37:08.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.576 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport
C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ShoppingReport\cs\Config.xml
C:\Program Files\akl
C:\Program Files\akl\akl.dll
C:\Program Files\akl\akl.exe
C:\Program Files\akl\curlog.htm
C:\Program Files\akl\keylog.txt
C:\Program Files\akl\uninstall.exe
C:\Program Files\akl\unsetup.dat
C:\Program Files\akl\unsetup.exe
C:\Program Files\amsys
C:\Program Files\amsys\awmsg.dat
C:\Program Files\amsys\mfc42.dll
C:\Program Files\amsys\msvcrt.dll
C:\Program Files\amsys\unins000.dat
C:\Program Files\amsys\unis000.exe
C:\Program Files\amsys\winam.dat
C:\Program Files\p2pnetworks
C:\Program Files\p2pnetworks\amp2pl.exe^
C:\WINDOWS\absolute key logger.lnk
C:\WINDOWS\aconti.exe
C:\WINDOWS\aconti.log
C:\WINDOWS\acontidialer.txt
C:\WINDOWS\adbar.dll
C:\WINDOWS\cbinst$.exe
C:\WINDOWS\daxtime.dll
C:\WINDOWS\default.htm
C:\WINDOWS\dp0.dll
C:\WINDOWS\eventlowg.dll
C:\WINDOWS\fhfmm-Uninstaller.exe
C:\WINDOWS\fhfmm.exe
C:\WINDOWS\flt.dll
C:\WINDOWS\jd2002.dll
C:\WINDOWS\kkcomp$.exe
C:\WINDOWS\kkcomp.exe
C:\WINDOWS\liqad$.exe
C:\WINDOWS\liqad.exe
C:\WINDOWS\liqui-Uninstaller.exe
C:\WINDOWS\liqui.exe
C:\WINDOWS\ngd.dll
C:\WINDOWS\pbar.dll
C:\WINDOWS\spredirect.dll
C:\WINDOWS\system32\ace16win.dll
C:\WINDOWS\system32\acespy
C:\WINDOWS\system32\acespy\__acelog.ndx
C:\WINDOWS\system32\acespy\systune.exe
C:\WINDOWS\system32\din.ip
C:\WINDOWS\system32\drivers\bg_bg.gif
C:\WINDOWS\system32\drivers\blank.gif
C:\WINDOWS\system32\drivers\box_1.gif
C:\WINDOWS\system32\drivers\box_2.gif
C:\WINDOWS\system32\drivers\box_3.gif
C:\WINDOWS\system32\drivers\button_buynow.gif
C:\WINDOWS\system32\drivers\button_freescan.gif
C:\WINDOWS\system32\drivers\cell_bg.gif
C:\WINDOWS\system32\drivers\cell_footer.gif
C:\WINDOWS\system32\drivers\cell_header_block.gif
C:\WINDOWS\system32\drivers\cell_header_remove.gif
C:\WINDOWS\system32\drivers\cell_header_scan.gif
C:\WINDOWS\system32\drivers\close_ico.gif
C:\WINDOWS\system32\drivers\download_box.gif
C:\WINDOWS\system32\drivers\download_btn.jpg
C:\WINDOWS\system32\drivers\download_now_btn.gif
C:\WINDOWS\system32\drivers\footer_back.jpg
C:\WINDOWS\system32\drivers\header_1.gif
C:\WINDOWS\system32\drivers\header_2.gif
C:\WINDOWS\system32\drivers\header_3.gif
C:\WINDOWS\system32\drivers\header_4.gif
C:\WINDOWS\system32\drivers\header_red_bg.gif
C:\WINDOWS\system32\drivers\header_red_free_scan.gif
C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif
C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif
C:\WINDOWS\system32\drivers\icon_warning_big.gif
C:\WINDOWS\system32\drivers\infected.gif
C:\WINDOWS\system32\drivers\main_back.gif
C:\WINDOWS\system32\drivers\perfect_cleaner_box.jpg
C:\WINDOWS\system32\drivers\product_1_header.gif
C:\WINDOWS\system32\drivers\product_1_name_small.gif
C:\WINDOWS\system32\drivers\product_2_header.gif
C:\WINDOWS\system32\drivers\product_2_name_small.gif
C:\WINDOWS\system32\drivers\product_3_header.gif
C:\WINDOWS\system32\drivers\product_3_name_small.gif
C:\WINDOWS\system32\drivers\product_features.gif
C:\WINDOWS\system32\drivers\rating.gif
C:\WINDOWS\system32\drivers\remove_spyware_header.gif
C:\WINDOWS\system32\drivers\screenshot.jpg
C:\WINDOWS\system32\drivers\sep_hor.gif
C:\WINDOWS\system32\drivers\sep_vert.gif
C:\WINDOWS\system32\drivers\shadow.jpg
C:\WINDOWS\system32\drivers\shadow_bg.gif
C:\WINDOWS\system32\drivers\spacer.gif
C:\WINDOWS\system32\drivers\spy_away_box.jpg
C:\WINDOWS\system32\drivers\spyware_detected.gif
C:\WINDOWS\system32\drivers\star.gif
C:\WINDOWS\system32\drivers\star_gray.gif
C:\WINDOWS\system32\drivers\star_gray_small.gif
C:\WINDOWS\system32\drivers\star_small.gif
C:\WINDOWS\system32\drivers\style.css
C:\WINDOWS\system32\drivers\v.gif
C:\WINDOWS\system32\drivers\warning_ico.gif
C:\WINDOWS\system32\drivers\warning_icon.gif
C:\WINDOWS\system32\drivers\win_logo.gif
C:\WINDOWS\system32\drivers\x.gif
C:\WINDOWS\system32\drivers\yellow_warning_ico.gif
C:\WINDOWS\system32\ESHOPEE.exe
C:\WINDOWS\system32\gtv_sd.bin
C:\WINDOWS\system32\msole32.exe
C:\WINDOWS\system32\oembios32.dll
C:\WINDOWS\system32\stfv.bin
C:\WINDOWS\system32\sznf.ascii
C:\WINDOWS\xadbrk.exe
C:\WINDOWS\xadbrk_.exe
C:\WINDOWS\xxxvideo.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-10 to 2008-01-10 )))))))))))))))))))))))))))))))
.

2008-01-10 15:34 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-10 15:01 . 2008-01-10 15:02 d——– C:\WINDOWS\ERUNT
2008-01-10 12:24 . 2008-01-10 12:24 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InstallShield
2008-01-10 12:23 . 2008-01-10 12:23 d—-c— C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\ATI
2008-01-03 11:46 . 2008-01-03 11:46 d—-c— C:\Documents and Settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
2007-12-24 19:13 . 2008-01-02 20:33 d——– C:\Program Files\Guild Wars
2007-12-24 14:59 . 2007-12-24 14:59 d—-c— C:\3d3e9a388af8f1745b76529800ee
2007-12-21 17:34 . 2006-01-26 13:21 34,686 –a—— C:\WINDOWS\system32\drivers\Capt905c.sys
2007-12-21 17:34 . 2006-01-26 13:21 24,569 –a—— C:\WINDOWS\system32\drivers\Camd905c.sys
2007-12-20 20:49 . 2007-12-20 20:49 d——– C:\Program Files\Virtools
2007-12-19 11:54 . 2007-12-19 19:21 25,088 –a—— C:\WINDOWS\system32\winsckdo.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-02 23:08 ——— d—–w C:\Program Files\Motorola Phone Tools
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\InterVideo
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\Kat\Application Data\Leadertech
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Road Runner
2008-01-02 23:05 ——— dc—-w C:\Documents and Settings\All Users\Application Data\CA
2008-01-02 23:05 ——— d—–w C:\Program Files\Yahoo!
2008-01-02 22:58 ——— d—–w C:\Program Files\Windows Installer Clean Up
2008-01-02 22:54 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-02 22:54 ——— d—–w C:\Program Files\Support.com
2008-01-02 22:54 ——— d—–w C:\Program Files\QuickTime
2008-01-02 22:54 ——— d—–w C:\Program Files\MSN Messenger
2008-01-02 22:54 ——— d—–w C:\Program Files\HP Instant Support
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\yahoo!
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-01-02 22:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\BVRP Software
2007-12-24 20:07 ——— d—–w C:\Program Files\Avanquest update
2007-12-07 20:44 24,192 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermptxp.sys
2007-12-07 20:44 22,768 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\usbsermpt.sys
2007-12-07 20:44 22,768 —-a-w C:\WINDOWS\system32\drivers\usbsermpt.sys
2007-12-03 20:56 69,632 —-a-w C:\WINDOWS\system32\realbap1.dll
2007-12-03 20:56 45,568 —-a-w C:\WINDOWS\system32\realbsf1.dll
2007-12-03 14:35 ——— d—–w C:\Program Files\Motorola
2007-12-01 19:05 3,567 —-a-w C:\WINDOWS\system32\drivers\PortTalk.sys
2007-12-01 18:03 ——— d—–w C:\Program Files\Common Files\Motorola Shared
2007-11-15 18:55 ——— d—–w C:\Program Files\Java
2007-11-14 22:08 92,064 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdm.sys
2007-11-14 22:08 9,232 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmmdfl.sys
2007-11-14 22:08 79,328 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmserd.sys
2007-11-14 22:08 66,656 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmbus.sys
2007-11-14 22:08 6,208 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcmnt.sys
2007-11-14 22:08 5,936 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmwhnt.sys
2007-11-14 22:08 4,048 -c–a-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\mqdmcr.sys
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Owner.YOUR-AT5QGAAC3Z\Application Data\VCOM
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\All Users\Application Data\Symantec
2007-11-11 21:53 ——— dc—-w C:\Documents and Settings\Administrator\Application Data\VCOM
2007-11-07 09:26 721,920 —-a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 222,720 —-a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 11:54 5674352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 10:17 135168]
"snpstd"="C:\WINDOWS\vsnpstd.exe" [2003-12-31 16:39 40960]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2003-11-03 19:50 221184]
"QOELOADER"="C:\Program Files\CA\eTrust EZ Armor\eTrust Anti-Spam\QSP-2.1.215.5\QOELoader.exe" [2007-01-11 22:03 6656]
"OneCareUI"="C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe" [ ]
"NWEReboot"="" []
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 19:04 52736]
"CAVRID"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [2007-02-11 22:52 185456]
"CaAvTray"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVTray.exe" [2007-02-11 22:52 230512]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-11-13 21:10 335872]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 09:06 88363 C:\WINDOWS\AGRSMMSG.exe]
"medicsp2"="C:\Program Files\twc\medicsp2\bin\sprtcmd.exe" [2007-03-07 10:53 198184]
"VirusScannerPro"="C:\PROGRA~1\VCOM\Fix-It\MemCheck.exe" [2007-01-29 15:02 62976]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-03-05 10:10 185896]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2005-04-25 12:45 36040]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [ ]

R2 Fix-It Task Manager;Fix-It Task Manager;C:\PROGRA~1\VCOM\Fix-It\mxtask.exe [2007-01-29 15:02]
R2 sprtsvc_medicsp2;SupportSoft Sprocket Service (medicsp2);C:\Program Files\twc\medicsp2\bin\sprtsvc.exe /service []
R3 mxDisk;mxDisk;C:\PROGRA~1\VCOM\Fix-It\mxDisk.sys [2007-01-29 12:01]
S2 UMAXPCLS;Print Port Scanner Driver;C:\WINDOWS\system32\DRIVERS\umaxpcls.sys [2001-08-17 13:58]
S3 CCCP106;CIF USB Camera (2110A);C:\WINDOWS\system32\DRIVERS\cccp106.sys [2003-04-09 10:17]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-04-15 14:11:23 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job"
- C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
"2008-01-10 20:12:35 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-10 15:41:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-10 15:43:06
ComboFix-quarantined-files.txt 2008-01-10 20:42:45
.
2008-01-09 08:02:47 — E O F —
Hello and welcome to the forum. Sorry about the delay in responding :( If you still need help, Scan again with HijackThis, and copy/paste" a new log file into this thread. Also please describe how your computer behaves at the moment.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI