Surf1div1
Topic Starter
Hi, While using Bit Defender's Online scan it picked up the following Viruus (JS Kak.Gen@MM) and was unable to delete it from 35 files in F:\Documents and Settings\Arnold\Local\Settings\Application\Data\Microsoft\Outlook\Personal Folders(1) Pst… Bit Defender responds that it is unable to disinfect or delete.
I've tried going into Outlook and deleting the individual message folders that contained the RTF docs that it referred to but still am unable to delete the virus. So that is why I've tried to get some support on ridding it. These are the steps I've done on my own as well- I'm pasting my MGlogs.zip file that contains the batch files that were run to determine the status of my drives and hopefully you can use them as well.
Per LD Tate's "Before Posting A Highjacklog " I've done his self help for Windows XP by doing the followoing:
1- Used ATF Cleaner- first in Safe mode so that I could get each seperate account cleaned out. Then mine again in normal startup.
2- Used the most up to date Spybot V 1.5.2, installed the updates and scanned (with no problems found)
3- Checked through the "self-help"(both pages) on Spy/malware removal - none of them addressed the virus that was found.
4-Made sure that I have only one anti-virus program used- Current AVG Anti-Spyware 7.5, most current definitions.
5-Uninstalled previous versions Microsoft's Java and installed Sun Java.
6-Went into MSConfig and setup for Normal startup mode
7-Emptied Recycle Bin-(no quarantined items from spybot or AVG were found
8-Enabled viewing of all hidden files and file extensions
9-Installed and ran "Combofix" (installed on desktop) and MGTools (Root of F-this is my "C drive" (runs runkeyes. newfiles, and Getunkey batch files).
This is my Hijacklog updated
Logfile of HijackThis v1.99.1
Scan saved at 2:03:38 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\DigitalPersona\Bin\DPWinLct.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\DigitalPersona\Bin\DpHost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
F:\Program Files\HP\HP UT\bin\hppusg.exe
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
F:\Program Files\V Communications\CD Anywhere\cdawman.exe
F:\Program Files\Microsoft IntelliType Pro\type32.exe
F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
F:\Program Files\Microsoft IntelliPoint\point32.exe
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
F:\Program Files\Windows Media Player\WMPNSCFG.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - F:\Program Files\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [DPAgnt] F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToolBoxFX] "F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [HPUsageTracking] "F:\Program Files\HP\HP UT\bin\hppusg.exe" "F:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [cdawman.exe] "F:\Program Files\V Communications\CD Anywhere\cdawman.exe" /startup
O4 - HKLM\..\Run: [type32] "F:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RoxioDragToDisc] F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
O4 - HKLM\..\Run: [NBKeyScan] "F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [InCD] F:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [EasyLinkAdvisor] "F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ATI Remote Control] F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] "F:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = F:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/7…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200087952063
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201034131875
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://surf1div1.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: DPWLN - F:\WINDOWS\system32\DPWLEvHd.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - F:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - F:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - F:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - F:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
This is the Combofix log:
ComboFix 08-02.03.1 - Arnold 2008-02-04 11:45:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1522 [GMT -8:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
H:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.
2008-02-04 10:13 . 2008-02-04 10:13 d——– F:\Program Files\Common Files\L&H;
2008-02-04 09:47 . 2008-02-04 09:48 d——– F:\MGtools
2008-02-04 09:47 . 2008-02-04 09:48 62,440 –a—— F:\MGlogs.zip
2008-02-04 09:47 . 2005-01-13 19:41 11,254 –a—— F:\WINDOWS\system32\locate.com
2008-02-04 09:03 . 2008-02-04 09:03 d——– F:\Documents and Settings\Arnold\Application Data\Grisoft
2008-02-04 09:03 . 2007-05-30 04:10 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 09:02 . 2008-02-04 09:02 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 08:37 . 2008-02-04 08:37 d——– F:\Program Files\Spybot - Search & Destroy
2008-02-04 08:21 . 2008-02-04 08:21 1,238,736 –a—— F:\MGtools.exe
2008-02-04 08:12 . 2008-02-04 08:12 d——– F:\Program Files\CCleaner
2008-02-04 08:10 . 2008-02-04 08:10 d——– F:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Sarah\Application Data\Gtek
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Laura\Application Data\Gtek
2008-02-04 08:01 . 2008-01-12 18:56 d——– F:\Documents and Settings\Administrator\Application Data\Gtek
2008-02-04 07:55 . 2008-02-04 07:55 d——– F:\Program Files\Yahoo!
2008-02-02 13:51 . 2008-02-02 13:58 d——– F:\Program Files\mIRC
2008-02-02 13:51 . 2008-02-02 14:41 d——– F:\Documents and Settings\Arnold\Application Data\mIRC
2008-02-01 01:07 . 2007-08-01 22:47 102,664 –a—— F:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-31 22:34 . 2008-01-31 23:42 d——– F:\Documents and Settings\Arnold\.housecall6.6
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\WINDOWS\system32\Kaspersky Lab
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-31 11:04 . 2008-01-31 12:18 d——– F:\Program Files\EsetOnlineScanner
2008-01-31 09:37 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
2008-01-30 23:19 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\vphaawcprodj.sys
2008-01-30 15:29 . 2008-01-30 15:29 d——– F:\Program Files\Delmar Learning
2008-01-30 15:21 . 2008-01-30 15:23 79,799,972 –a—— F:\CSUN_DIRECTORY_.cdi
2008-01-30 14:42 . 2008-01-30 15:16 2,659,964,545 –a—— F:\Ford DVD.cdi
2008-01-30 14:34 . 2008-01-30 14:37 428,360,977 –a—— F:\Office Disc 2.cdi
2008-01-30 14:30 . 2008-01-30 14:32 326,544,690 –a—— F:\Office Disc 1.cdi
2008-01-30 14:01 . 2008-01-30 14:04 712,508,605 –a—— F:\Windows Xp.cdi
2008-01-30 13:54 . 2008-01-30 13:57 419,421,397 –a—— F:\Pocket PC 2003 Premium w Outlook 2002.cdi
2008-01-30 13:47 . 2008-01-30 13:47 d——– F:\Program Files\V Communications
2008-01-30 13:47 . 2001-08-30 16:26 1,052,672 –a—— F:\WINDOWS\system32\cdawsh.dll
2008-01-30 13:47 . 2001-08-30 16:45 46,864 –a—— F:\WINDOWS\system32\drivers\cdanywhr.sys
2008-01-27 18:47 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
2008-01-27 16:20 . 2008-01-27 16:20 0 –a—— F:\WINDOWS\system32\48F.tmp
2008-01-27 16:19 . 2007-06-05 10:56 44,928 –a—— F:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-27 16:18 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
2008-01-27 13:25 . 2008-01-27 14:50 d——– F:\WINDOWS\system32\NtmsData
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\HP
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Comodo
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\ATI
2008-01-26 17:08 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Gtek
2008-01-26 17:08 . 2008-01-26 17:08 d——– F:\Documents and Settings\Ally\Application Data\DigitalPersona
2008-01-26 12:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
2008-01-26 10:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
2008-01-26 00:45 . 2008-02-04 09:01 d——– F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-25 22:50 . 2008-02-04 07:24 d——– F:\Program Files\ThreatFire
2008-01-25 22:50 . 2008-02-04 07:23 d-a—— F:\Documents and Settings\All Users\Application Data\TEMP
2008-01-25 22:50 . 2008-01-25 22:50 d——– F:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-25 22:30 . 2008-01-31 09:52 d——– F:\Program Files\Copernic Desktop Search 2
2008-01-25 22:22 . 2008-02-02 08:47 54,156 –ah—– F:\WINDOWS\QTFont.qfn
2008-01-25 22:22 . 2008-01-25 22:22 1,409 ——— F:\WINDOWS\QTFont.for
2008-01-25 20:56 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
2008-01-25 16:47 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
2008-01-25 15:43 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys
2008-01-25 15:28 . 2008-01-31 10:07 d——– F:\WINDOWS\system32\ActiveScan
2008-01-25 15:28 . 2008-01-31 09:36 30,590 –a—— F:\WINDOWS\system32\pavas.ico
2008-01-25 15:28 . 2008-01-31 09:36 2,550 –a—— F:\WINDOWS\system32\Uninstall.ico
2008-01-25 15:28 . 2008-01-31 09:36 1,406 –a—— F:\WINDOWS\system32\Help.ico
2008-01-25 11:41 . 2008-02-04 09:52 d——– F:\WINDOWS\BDOSCAN8
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\Arnold\Application Data\HP
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-01-24 13:29 . 2008-01-24 13:29 d——– F:\Program Files\Hewlett-Packard
2008-01-24 13:28 . 2008-01-24 13:28 163 ——— F:\WINDOWS\system32\AddPort.ini
2008-01-24 13:21 . 2008-01-24 13:28 747 ——— F:\WINDOWS\hpntwksetup.ini
2008-01-24 13:19 . 2008-01-30 12:56 d——– F:\Program Files\HP
2008-01-24 13:19 . 2004-08-03 23:08 31,616 –a—— F:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:08 31,616 —–c— F:\WINDOWS\system32\dllcache\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 –a—— F:\WINDOWS\system32\drivers\usbprint.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 —–c— F:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-24 13:16 . 2008-01-24 13:33 93,130 ——— F:\WINDOWS\hppins05.dat
2008-01-24 13:16 . 2006-06-01 05:25 896 ——— F:\WINDOWS\hppmdl05.dat
2008-01-24 13:09 . 2008-01-24 13:09 d——– F:\Program Files\Common Files\SWF Studio
2008-01-23 08:57 . 2004-08-04 00:56 221,184 ——— F:\WINDOWS\system32\wmpns.dll
2008-01-23 08:56 . 2008-01-23 09:04 23,392 ——— F:\WINDOWS\system32\nscompat.tlb
2008-01-23 08:56 . 2008-01-23 09:04 16,832 ——— F:\WINDOWS\system32\amcompat.tlb
2008-01-23 00:28 . 2007-07-30 19:19 271,224 ——— F:\WINDOWS\system32\mucltui.dll
2008-01-23 00:28 . 2007-07-30 19:19 30,072 ——— F:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 15:56 . 2008-01-22 15:56 d——– F:\Program Files\Microsoft Silverlight
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Program Files\SmartSound Software
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-01-22 15:27 . 1999-11-10 12:05 86,016 ——— F:\WINDOWS\unvise32qt.exe
2008-01-22 15:26 . 2008-01-22 15:31 d——– F:\WINDOWS\system32\QuickTime
2008-01-22 15:26 . 2008-01-31 09:59 d——– F:\Program Files\QuickTime
2008-01-22 15:26 . 2008-01-22 21:49 d——– F:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-22 15:26 . 2002-03-19 09:29 14,165 ——— F:\WINDOWS\system32\drivers\Pclepci.sys
2008-01-22 15:24 . 2002-01-05 03:48 974,848 ——— F:\WINDOWS\system32\MFC70.DLL
2008-01-22 15:22 . 2008-01-22 15:24 d——– F:\Program Files\Pinnacle
2008-01-22 15:22 . 2008-02-03 20:46 d——– F:\Documents and Settings\All Users\Application Data\Pinnacle
2008-01-22 12:16 . 2008-01-22 12:16 d——– F:\Documents and Settings\Arnold\Application Data\Microsoft Web Folders
2008-01-22 10:46 . 2008-01-22 10:46 d——– F:\Documents and Settings\All Users\Application Data\Goland
2008-01-22 10:19 . 2008-01-22 10:19 d——– F:\Documents and Settings\LocalService\Application Data\Roxio
2008-01-22 10:19 . 2008-01-22 10:20 d——– F:\Documents and Settings\Arnold\Application Data\Roxio
2008-01-22 09:44 . 2008-01-22 09:44 d——– F:\WINDOWS\ASTULogTemp
2008-01-22 09:44 . 2008-01-30 08:49 35,285 –a—— F:\WINDOWS\system32\ASTULog.cab
2008-01-22 09:44 . 2008-01-30 08:49 1,047 –a—— F:\WINDOWS\system32\setup.inf
2008-01-22 09:44 . 2008-01-30 08:49 283 –a—— F:\WINDOWS\system32\setup.rpt
2008-01-22 07:33 . 2008-01-22 07:36 d——– F:\WINDOWS\system32\DLA
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Program Files\Common Files\SureThing Shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 22:34 ——— d—–w F:\Program Files\microsoft frontpage
2008-01-14 23:31 ——— d—–w F:\Documents and Settings\Arnold\Application Data\.BitTornado
2008-01-11 20:58 ——— d—–w F:\Documents and Settings\All Users\Application Data\ESET
2007-12-21 11:53 2,843,136 —-a-w F:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-21 11:09 368,640 ——w F:\WINDOWS\system32\ATIDEMGX.dll
2007-12-21 11:08 272,384 —-a-w F:\WINDOWS\system32\ati2dvag.dll
2007-12-21 11:02 307,200 ——w F:\WINDOWS\system32\atiiiexx.dll
2007-12-21 10:59 43,520 ——w F:\WINDOWS\system32\ati2edxx.dll
2007-12-21 10:59 26,112 ——w F:\WINDOWS\system32\Ati2mdxx.exe
2007-12-21 10:59 147,456 ——w F:\WINDOWS\system32\atipdlxx.dll
2007-12-21 10:59 122,880 ——w F:\WINDOWS\system32\Oemdspif.dll
2007-12-21 10:58 122,880 ——w F:\WINDOWS\system32\ati2evxx.dll
2007-12-21 10:57 512,000 ——w F:\WINDOWS\system32\ati2evxx.exe
2007-12-21 10:56 53,248 ——w F:\WINDOWS\system32\ATIDDC.DLL
2007-12-21 10:53 9,826,304 ——w F:\WINDOWS\system32\atioglx2.dll
2007-12-21 10:47 3,120,640 —-a-w F:\WINDOWS\system32\ati3duag.dll
2007-12-21 10:36 1,661,696 —-a-w F:\WINDOWS\system32\ativvaxx.dll
2007-12-21 10:24 46,080 ——w F:\WINDOWS\system32\amdpcom32.dll
2007-12-21 10:20 5,435,392 ——w F:\WINDOWS\system32\atioglxx.dll
2007-12-21 10:20 385,024 ——w F:\WINDOWS\system32\atikvmag.dll
2007-12-21 10:18 17,408 ——w F:\WINDOWS\system32\atitvo32.dll
2007-12-21 10:17 49,152 ——w F:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-21 10:15 159,744 ——w F:\WINDOWS\system32\atiok3x2.dll
2007-12-21 10:11 499,712 —-a-w F:\WINDOWS\system32\ati2cqag.dll
2007-12-21 05:05 593,920 ——w F:\WINDOWS\system32\ati2sgag.exe
2007-12-07 18:31 99,712 —-a-w F:\WINDOWS\HPBroker.dll
2007-12-06 17:51 285,952 ——w F:\WINDOWS\system32\drivers\yk51x86.sys
2007-11-07 09:26 721,920 —-a-w F:\WINDOWS\system32\lsasrv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"Copernic Desktop Search 2"="F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2007-08-01 10:26 1514016]
"WMPNSCFG"="F:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ]
"EasyLinkAdvisor"="F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784]
"ATI Remote Control"="F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-08-26 23:51 200704]
"ATI Launchpad"="F:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-12-01 15:32 106575]
"ATI DeviceDetect"="F:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2004-12-01 15:28 69709]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 11:41 24576 F:\WINDOWS\system32\ptipbm.dll]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-11 13:18 1115728]
"DPAgnt"="F:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2004-10-13 18:24 913408]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 F:\WINDOWS\system32\ptipbmf.dll]
"StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"PinnacleDriverCheck"="F:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2008-01-22 15:27 98304]
"ToolBoxFX"="F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 08:43 49152]
"HPUsageTracking"="F:\Program Files\HP\HP UT\bin\hppusg.exe" [2008-01-26 01:37 36864]
"HP Software Update"="F:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"cdawman.exe"="F:\Program Files\V Communications\CD Anywhere\cdawman.exe" [2001-08-30 16:28 475136]
"type32"="F:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46 196608]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 23:54 65536 F:\WINDOWS\SOUNDMAN.EXE]
"RoxioDragToDisc"="F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-11-15 09:05 1121016]
"NBKeyScan"="F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"MaxtorOneTouch"="F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe" [2004-08-31 09:23 823296]
"IntelliPoint"="F:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26 217088]
"InCD"="F:\Program Files\Ahead\InCD\InCD.exe" [ ]
"ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10 344064]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Adobe Photo Downloader"="F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
F:\WINDOWS\system32\DPWLEvHd.dll 2004-10-13 18:29 102400 F:\WINDOWS\system32\DPWLEvHd.dll
R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 03:22]
R1 AmdPPM;AMD HwPState Processor Driver;F:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R1 DLARTL_M;DLARTL_M;F:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-09-15 09:45]
R2 cdanywhr;CD Anywhere Driver;F:\WINDOWS\system32\drivers\cdanywhr.sys [2001-08-30 16:45]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;F:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2004-08-04 16:58]
R3 UsbdpFP;Fingerprint Reader Class Driver;F:\WINDOWS\system32\DRIVERS\UsbdpFP.sys [2004-08-04 16:59]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);F:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 ICDUSB2;Sony IC Recorder (P);F:\WINDOWS\system32\Drivers\ICDUSB2.sys [2002-11-28 21:23]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - "Install FreeAgent Tools.exe" /run
*Newly Created Service* - AVGASCLN
.
Contents of the 'Scheduled Tasks' folder
"2008-01-29 07:00:37 F:\WINDOWS\Tasks\Incremental Back-up.job"
- F:\WINDOWS\system32\ntbackup.exeebackup
"2008-02-04 00:27:29 F:\WINDOWS\Tasks\User_Feed_Synchronization-{329886B2-A930-49D1-977E-BC1CF3378D8C}.job"
- F:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 11:47:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: F:\WINDOWS\explorer.exe [6.00.2900.3156]
-> F:\Program Files\DigitalPersona\Bin\DpOFeedb.dll
-> F:\WINDOWS\system32\DLAAPI_W.DLL
.
Completion time: 2008-02-04 11:48:27
ComboFix-quarantined-files.txt 2008-02-04 19:48:18
ComboFix2.txt 2008-02-04 16:31:47
.
2008-01-27 20:41:59 — E O F —
I've tried going into Outlook and deleting the individual message folders that contained the RTF docs that it referred to but still am unable to delete the virus. So that is why I've tried to get some support on ridding it. These are the steps I've done on my own as well- I'm pasting my MGlogs.zip file that contains the batch files that were run to determine the status of my drives and hopefully you can use them as well.
Per LD Tate's "Before Posting A Highjacklog " I've done his self help for Windows XP by doing the followoing:
1- Used ATF Cleaner- first in Safe mode so that I could get each seperate account cleaned out. Then mine again in normal startup.
2- Used the most up to date Spybot V 1.5.2, installed the updates and scanned (with no problems found)
3- Checked through the "self-help"(both pages) on Spy/malware removal - none of them addressed the virus that was found.
4-Made sure that I have only one anti-virus program used- Current AVG Anti-Spyware 7.5, most current definitions.
5-Uninstalled previous versions Microsoft's Java and installed Sun Java.
6-Went into MSConfig and setup for Normal startup mode
7-Emptied Recycle Bin-(no quarantined items from spybot or AVG were found
8-Enabled viewing of all hidden files and file extensions
9-Installed and ran "Combofix" (installed on desktop) and MGTools (Root of F-this is my "C drive" (runs runkeyes. newfiles, and Getunkey batch files).
This is my Hijacklog updated
Logfile of HijackThis v1.99.1
Scan saved at 2:03:38 PM, on 2/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\Ati2evxx.exe
F:\Program Files\DigitalPersona\Bin\DPWinLct.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
F:\Program Files\Comodo\Firewall\cmdagent.exe
F:\Program Files\DigitalPersona\Bin\DpHost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
F:\WINDOWS\system32\wscntfy.exe
F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
F:\Program Files\HP\HP UT\bin\hppusg.exe
F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
F:\Program Files\V Communications\CD Anywhere\cdawman.exe
F:\Program Files\Microsoft IntelliType Pro\type32.exe
F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
F:\WINDOWS\SOUNDMAN.EXE
F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
F:\Program Files\Microsoft IntelliPoint\point32.exe
F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe
F:\Program Files\Windows Media Player\WMPNSCFG.exe
F:\Program Files\Messenger\msmsgs.exe
F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
F:\WINDOWS\system32\rundll32.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Hijackthis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Copernic Desktop Search 2 - {968631B6-4729-440D-9BF4-251F5593EC9A} - F:\Program Files\Copernic Desktop Search 2\DesktopSearchBand201013011.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [PtiuPbmd] Rundll32.exe ptipbm.dll,SetWriteBack
O4 - HKLM\..\Run: [COMODO Firewall Pro] "F:\Program Files\Comodo\Firewall\CPF.exe" /background
O4 - HKLM\..\Run: [DPAgnt] F:\Program Files\DigitalPersona\Bin\DPAgnt.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [StartCCC] "F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [PinnacleDriverCheck] F:\WINDOWS\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ToolBoxFX] "F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /systrayIcon:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [HPUsageTracking] "F:\Program Files\HP\HP UT\bin\hppusg.exe" "F:\Program Files\HP\HP UT\"
O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [cdawman.exe] "F:\Program Files\V Communications\CD Anywhere\cdawman.exe" /startup
O4 - HKLM\..\Run: [type32] "F:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RoxioDragToDisc] F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
O4 - HKLM\..\Run: [NBKeyScan] "F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe
O4 - HKLM\..\Run: [IntelliPoint] "F:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [InCD] F:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [ATIPTA] F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Copernic Desktop Search 2] "F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" /tray
O4 - HKCU\..\Run: [WMPNSCFG] F:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [swg] F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [EasyLinkAdvisor] "F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [ATI Remote Control] F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] "F:\Program Files\ATI Multimedia\main\launchpd.exe"
O4 - HKCU\..\Run: [ATI DeviceDetect] F:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - Global Startup: ATI CATALYST System Tray.lnk = F:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
O4 - Global Startup: Microsoft Office.lnk = F:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - F:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/7…can_unicode.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {60EFC337-15C2-4369-B2A0-3429B071D8B8} (Hewlett-Packard Printer Diagnostics) - http://h50203.www5.hp.com/HPISWeb/Customer…SWebManager.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1200087952063
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/inst…ctDetection.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201034131875
O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://surf1div1.spaces.live.com/PhotoUpload/MsnPUpld.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O20 - Winlogon Notify: DPWLN - F:\WINDOWS\system32\DPWLEvHd.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe Active File Monitor V4 (AdobeActiveFileMonitor4.0) - Unknown owner - F:\Program Files\Adobe\Photoshop Elements 4.0\PhotoshopElementsFileAgent.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - F:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - F:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Comodo Application Agent (CmdAgent) - COMODO - F:\Program Files\Comodo\Firewall\cmdagent.exe
O23 - Service: Windows XP FUS Manager (DPFUSMgr) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DPFUSMgr.exe
O23 - Service: Biometric Authentication Service (DpHost) - DigitalPersona, Inc. - F:\Program Files\DigitalPersona\Bin\DpHost.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - F:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - F:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - F:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - F:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - F:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
This is the Combofix log:
ComboFix 08-02.03.1 - Arnold 2008-02-04 11:45:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1522 [GMT -8:00]
Running from: F:\Documents and Settings\[removed]\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
H:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-01-04 to 2008-02-04 )))))))))))))))))))))))))))))))
.
2008-02-04 10:13 . 2008-02-04 10:13 d——– F:\Program Files\Common Files\L&H;
2008-02-04 09:47 . 2008-02-04 09:48 d——– F:\MGtools
2008-02-04 09:47 . 2008-02-04 09:48 62,440 –a—— F:\MGlogs.zip
2008-02-04 09:47 . 2005-01-13 19:41 11,254 –a—— F:\WINDOWS\system32\locate.com
2008-02-04 09:03 . 2008-02-04 09:03 d——– F:\Documents and Settings\Arnold\Application Data\Grisoft
2008-02-04 09:03 . 2007-05-30 04:10 10,872 –a—— F:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-04 09:02 . 2008-02-04 09:02 d——– F:\Documents and Settings\All Users\Application Data\Grisoft
2008-02-04 08:37 . 2008-02-04 08:37 d——– F:\Program Files\Spybot - Search & Destroy
2008-02-04 08:21 . 2008-02-04 08:21 1,238,736 –a—— F:\MGtools.exe
2008-02-04 08:12 . 2008-02-04 08:12 d——– F:\Program Files\CCleaner
2008-02-04 08:10 . 2008-02-04 08:10 d——– F:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Sarah\Application Data\Gtek
2008-02-04 08:05 . 2008-01-12 18:56 d——– F:\Documents and Settings\Laura\Application Data\Gtek
2008-02-04 08:01 . 2008-01-12 18:56 d——– F:\Documents and Settings\Administrator\Application Data\Gtek
2008-02-04 07:55 . 2008-02-04 07:55 d——– F:\Program Files\Yahoo!
2008-02-02 13:51 . 2008-02-02 13:58 d——– F:\Program Files\mIRC
2008-02-02 13:51 . 2008-02-02 14:41 d——– F:\Documents and Settings\Arnold\Application Data\mIRC
2008-02-01 01:07 . 2007-08-01 22:47 102,664 –a—— F:\WINDOWS\system32\drivers\tmcomm.sys
2008-01-31 22:34 . 2008-01-31 23:42 d——– F:\Documents and Settings\Arnold\.housecall6.6
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\WINDOWS\system32\Kaspersky Lab
2008-01-31 16:28 . 2008-01-31 16:28 d——– F:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-01-31 11:04 . 2008-01-31 12:18 d——– F:\Program Files\EsetOnlineScanner
2008-01-31 09:37 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\oxdeweugkbwe.sys
2008-01-30 23:19 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\vphaawcprodj.sys
2008-01-30 15:29 . 2008-01-30 15:29 d——– F:\Program Files\Delmar Learning
2008-01-30 15:21 . 2008-01-30 15:23 79,799,972 –a—— F:\CSUN_DIRECTORY_.cdi
2008-01-30 14:42 . 2008-01-30 15:16 2,659,964,545 –a—— F:\Ford DVD.cdi
2008-01-30 14:34 . 2008-01-30 14:37 428,360,977 –a—— F:\Office Disc 2.cdi
2008-01-30 14:30 . 2008-01-30 14:32 326,544,690 –a—— F:\Office Disc 1.cdi
2008-01-30 14:01 . 2008-01-30 14:04 712,508,605 –a—— F:\Windows Xp.cdi
2008-01-30 13:54 . 2008-01-30 13:57 419,421,397 –a—— F:\Pocket PC 2003 Premium w Outlook 2002.cdi
2008-01-30 13:47 . 2008-01-30 13:47 d——– F:\Program Files\V Communications
2008-01-30 13:47 . 2001-08-30 16:26 1,052,672 –a—— F:\WINDOWS\system32\cdawsh.dll
2008-01-30 13:47 . 2001-08-30 16:45 46,864 –a—— F:\WINDOWS\system32\drivers\cdanywhr.sys
2008-01-27 18:47 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\kqbkdepyhmvy.sys
2008-01-27 16:20 . 2008-01-27 16:20 0 –a—— F:\WINDOWS\system32\48F.tmp
2008-01-27 16:19 . 2007-06-05 10:56 44,928 –a—— F:\WINDOWS\system32\drivers\SDTHOOK.SYS
2008-01-27 16:18 . 2007-06-08 09:44 8,576 –a—— F:\WINDOWS\system32\drivers\nlivdkrlakdy.sys
2008-01-27 13:25 . 2008-01-27 14:50 d——– F:\WINDOWS\system32\NtmsData
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\HP
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Comodo
2008-01-26 17:09 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\ATI
2008-01-26 17:08 . 2008-01-26 17:09 d——– F:\Documents and Settings\Ally\Application Data\Gtek
2008-01-26 17:08 . 2008-01-26 17:08 d——– F:\Documents and Settings\Ally\Application Data\DigitalPersona
2008-01-26 12:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\oknxtmifaucr.sys
2008-01-26 10:33 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\vtdoqwbsknqy.sys
2008-01-26 00:45 . 2008-02-04 09:01 d——– F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-25 22:50 . 2008-02-04 07:24 d——– F:\Program Files\ThreatFire
2008-01-25 22:50 . 2008-02-04 07:23 d-a—— F:\Documents and Settings\All Users\Application Data\TEMP
2008-01-25 22:50 . 2008-01-25 22:50 d——– F:\Documents and Settings\All Users\Application Data\PC Tools
2008-01-25 22:30 . 2008-01-31 09:52 d——– F:\Program Files\Copernic Desktop Search 2
2008-01-25 22:22 . 2008-02-02 08:47 54,156 –ah—– F:\WINDOWS\QTFont.qfn
2008-01-25 22:22 . 2008-01-25 22:22 1,409 ——— F:\WINDOWS\QTFont.for
2008-01-25 20:56 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\yasfpaucqcud.sys
2008-01-25 16:47 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\mfdfvtfdkfia.sys
2008-01-25 15:43 . 2007-06-08 09:44 8,576 ——— F:\WINDOWS\system32\drivers\cgbepoflmeqv.sys
2008-01-25 15:28 . 2008-01-31 10:07 d——– F:\WINDOWS\system32\ActiveScan
2008-01-25 15:28 . 2008-01-31 09:36 30,590 –a—— F:\WINDOWS\system32\pavas.ico
2008-01-25 15:28 . 2008-01-31 09:36 2,550 –a—— F:\WINDOWS\system32\Uninstall.ico
2008-01-25 15:28 . 2008-01-31 09:36 1,406 –a—— F:\WINDOWS\system32\Help.ico
2008-01-25 11:41 . 2008-02-04 09:52 d——– F:\WINDOWS\BDOSCAN8
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\Arnold\Application Data\HP
2008-01-24 13:32 . 2008-01-24 13:32 d——– F:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-01-24 13:29 . 2008-01-24 13:29 d——– F:\Program Files\Hewlett-Packard
2008-01-24 13:28 . 2008-01-24 13:28 163 ——— F:\WINDOWS\system32\AddPort.ini
2008-01-24 13:21 . 2008-01-24 13:28 747 ——— F:\WINDOWS\hpntwksetup.ini
2008-01-24 13:19 . 2008-01-30 12:56 d——– F:\Program Files\HP
2008-01-24 13:19 . 2004-08-03 23:08 31,616 –a—— F:\WINDOWS\system32\drivers\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:08 31,616 —–c— F:\WINDOWS\system32\dllcache\usbccgp.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 –a—— F:\WINDOWS\system32\drivers\usbprint.sys
2008-01-24 13:19 . 2004-08-03 23:01 25,856 —–c— F:\WINDOWS\system32\dllcache\usbprint.sys
2008-01-24 13:16 . 2008-01-24 13:33 93,130 ——— F:\WINDOWS\hppins05.dat
2008-01-24 13:16 . 2006-06-01 05:25 896 ——— F:\WINDOWS\hppmdl05.dat
2008-01-24 13:09 . 2008-01-24 13:09 d——– F:\Program Files\Common Files\SWF Studio
2008-01-23 08:57 . 2004-08-04 00:56 221,184 ——— F:\WINDOWS\system32\wmpns.dll
2008-01-23 08:56 . 2008-01-23 09:04 23,392 ——— F:\WINDOWS\system32\nscompat.tlb
2008-01-23 08:56 . 2008-01-23 09:04 16,832 ——— F:\WINDOWS\system32\amcompat.tlb
2008-01-23 00:28 . 2007-07-30 19:19 271,224 ——— F:\WINDOWS\system32\mucltui.dll
2008-01-23 00:28 . 2007-07-30 19:19 30,072 ——— F:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 15:56 . 2008-01-22 15:56 d——– F:\Program Files\Microsoft Silverlight
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Program Files\SmartSound Software
2008-01-22 15:31 . 2008-01-22 15:31 d——– F:\Documents and Settings\All Users\Application Data\SmartSound Software Inc
2008-01-22 15:27 . 1999-11-10 12:05 86,016 ——— F:\WINDOWS\unvise32qt.exe
2008-01-22 15:26 . 2008-01-22 15:31 d——– F:\WINDOWS\system32\QuickTime
2008-01-22 15:26 . 2008-01-31 09:59 d——– F:\Program Files\QuickTime
2008-01-22 15:26 . 2008-01-22 21:49 d——– F:\Documents and Settings\All Users\Application Data\QuickTime
2008-01-22 15:26 . 2002-03-19 09:29 14,165 ——— F:\WINDOWS\system32\drivers\Pclepci.sys
2008-01-22 15:24 . 2002-01-05 03:48 974,848 ——— F:\WINDOWS\system32\MFC70.DLL
2008-01-22 15:22 . 2008-01-22 15:24 d——– F:\Program Files\Pinnacle
2008-01-22 15:22 . 2008-02-03 20:46 d——– F:\Documents and Settings\All Users\Application Data\Pinnacle
2008-01-22 12:16 . 2008-01-22 12:16 d——– F:\Documents and Settings\Arnold\Application Data\Microsoft Web Folders
2008-01-22 10:46 . 2008-01-22 10:46 d——– F:\Documents and Settings\All Users\Application Data\Goland
2008-01-22 10:19 . 2008-01-22 10:19 d——– F:\Documents and Settings\LocalService\Application Data\Roxio
2008-01-22 10:19 . 2008-01-22 10:20 d——– F:\Documents and Settings\Arnold\Application Data\Roxio
2008-01-22 09:44 . 2008-01-22 09:44 d——– F:\WINDOWS\ASTULogTemp
2008-01-22 09:44 . 2008-01-30 08:49 35,285 –a—— F:\WINDOWS\system32\ASTULog.cab
2008-01-22 09:44 . 2008-01-30 08:49 1,047 –a—— F:\WINDOWS\system32\setup.inf
2008-01-22 09:44 . 2008-01-30 08:49 283 –a—— F:\WINDOWS\system32\setup.rpt
2008-01-22 07:33 . 2008-01-22 07:36 d——– F:\WINDOWS\system32\DLA
2008-01-22 07:33 . 2008-01-22 07:33 d——– F:\Program Files\Common Files\SureThing Shared
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-30 22:34 ——— d—–w F:\Program Files\microsoft frontpage
2008-01-14 23:31 ——— d—–w F:\Documents and Settings\Arnold\Application Data\.BitTornado
2008-01-11 20:58 ——— d—–w F:\Documents and Settings\All Users\Application Data\ESET
2007-12-21 11:53 2,843,136 —-a-w F:\WINDOWS\system32\drivers\ati2mtag.sys
2007-12-21 11:09 368,640 ——w F:\WINDOWS\system32\ATIDEMGX.dll
2007-12-21 11:08 272,384 —-a-w F:\WINDOWS\system32\ati2dvag.dll
2007-12-21 11:02 307,200 ——w F:\WINDOWS\system32\atiiiexx.dll
2007-12-21 10:59 43,520 ——w F:\WINDOWS\system32\ati2edxx.dll
2007-12-21 10:59 26,112 ——w F:\WINDOWS\system32\Ati2mdxx.exe
2007-12-21 10:59 147,456 ——w F:\WINDOWS\system32\atipdlxx.dll
2007-12-21 10:59 122,880 ——w F:\WINDOWS\system32\Oemdspif.dll
2007-12-21 10:58 122,880 ——w F:\WINDOWS\system32\ati2evxx.dll
2007-12-21 10:57 512,000 ——w F:\WINDOWS\system32\ati2evxx.exe
2007-12-21 10:56 53,248 ——w F:\WINDOWS\system32\ATIDDC.DLL
2007-12-21 10:53 9,826,304 ——w F:\WINDOWS\system32\atioglx2.dll
2007-12-21 10:47 3,120,640 —-a-w F:\WINDOWS\system32\ati3duag.dll
2007-12-21 10:36 1,661,696 —-a-w F:\WINDOWS\system32\ativvaxx.dll
2007-12-21 10:24 46,080 ——w F:\WINDOWS\system32\amdpcom32.dll
2007-12-21 10:20 5,435,392 ——w F:\WINDOWS\system32\atioglxx.dll
2007-12-21 10:20 385,024 ——w F:\WINDOWS\system32\atikvmag.dll
2007-12-21 10:18 17,408 ——w F:\WINDOWS\system32\atitvo32.dll
2007-12-21 10:17 49,152 ——w F:\WINDOWS\system32\drivers\ati2erec.dll
2007-12-21 10:15 159,744 ——w F:\WINDOWS\system32\atiok3x2.dll
2007-12-21 10:11 499,712 —-a-w F:\WINDOWS\system32\ati2cqag.dll
2007-12-21 05:05 593,920 ——w F:\WINDOWS\system32\ati2sgag.exe
2007-12-07 18:31 99,712 —-a-w F:\WINDOWS\HPBroker.dll
2007-12-06 17:51 285,952 ——w F:\WINDOWS\system32\drivers\yk51x86.sys
2007-11-07 09:26 721,920 —-a-w F:\WINDOWS\system32\lsasrv.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="F:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"Copernic Desktop Search 2"="F:\Program Files\Copernic Desktop Search 2\DesktopSearchService.exe" [2007-08-01 10:26 1514016]
"WMPNSCFG"="F:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"swg"="F:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [ ]
"MSMSGS"="F:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="F:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [ ]
"EasyLinkAdvisor"="F:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" [2007-03-15 18:16 454784]
"ATI Remote Control"="F:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2004-08-26 23:51 200704]
"ATI Launchpad"="F:\Program Files\ATI Multimedia\main\launchpd.exe" [2004-12-01 15:32 106575]
"ATI DeviceDetect"="F:\Program Files\ATI Multimedia\main\ATIDtct.EXE" [2004-12-01 15:28 69709]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PtiuPbmd"="ptipbm.dll" [2003-01-15 11:41 24576 F:\WINDOWS\system32\ptipbm.dll]
"COMODO Firewall Pro"="F:\Program Files\Comodo\Firewall\CPF.exe" [2008-01-11 13:18 1115728]
"DPAgnt"="F:\Program Files\DigitalPersona\Bin\DPAgnt.exe" [2004-10-13 18:24 913408]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 F:\WINDOWS\system32\ptipbmf.dll]
"StartCCC"="F:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"PinnacleDriverCheck"="F:\WINDOWS\system32\PSDrvCheck.exe" [2004-03-10 16:26 406016]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2008-01-22 15:27 98304]
"ToolBoxFX"="F:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2006-06-15 08:43 49152]
"HPUsageTracking"="F:\Program Files\HP\HP UT\bin\hppusg.exe" [2008-01-26 01:37 36864]
"HP Software Update"="F:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11 49152]
"cdawman.exe"="F:\Program Files\V Communications\CD Anywhere\cdawman.exe" [2001-08-30 16:28 475136]
"type32"="F:\Program Files\Microsoft IntelliType Pro\type32.exe" [2005-03-15 01:46 196608]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2004-01-08 23:54 65536 F:\WINDOWS\SOUNDMAN.EXE]
"RoxioDragToDisc"="F:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-11-15 09:05 1121016]
"NBKeyScan"="F:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"MaxtorOneTouch"="F:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe" [2004-08-31 09:23 823296]
"IntelliPoint"="F:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 15:26 217088]
"InCD"="F:\Program Files\Ahead\InCD\InCD.exe" [ ]
"ATIPTA"="F:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-12-07 21:10 344064]
"Adobe Reader Speed Launcher"="F:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"Adobe Photo Downloader"="F:\Program Files\Adobe\Photoshop Elements 4.0\apdproxy.exe" [2005-09-09 01:18 57344]
"!AVG Anti-Spyware"="F:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25 6731312]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DPWLN ]
F:\WINDOWS\system32\DPWLEvHd.dll 2004-10-13 18:29 102400 F:\WINDOWS\system32\DPWLEvHd.dll
R0 viasraid;viasraid;F:\WINDOWS\system32\drivers\viasraid.sys [2003-10-31 03:22]
R1 AmdPPM;AMD HwPState Processor Driver;F:\WINDOWS\system32\DRIVERS\AmdPPM.sys [2007-04-16 21:46]
R1 DLARTL_M;DLARTL_M;F:\WINDOWS\system32\Drivers\DLARTL_M.SYS [2006-09-15 09:45]
R2 cdanywhr;CD Anywhere Driver;F:\WINDOWS\system32\drivers\cdanywhr.sys [2001-08-30 16:45]
R3 dpK0Bx01;Fingerprint Reader Filter Driver;F:\WINDOWS\system32\DRIVERS\dpK0Bx01.sys [2004-08-04 16:58]
R3 UsbdpFP;Fingerprint Reader Class Driver;F:\WINDOWS\system32\DRIVERS\UsbdpFP.sys [2004-08-04 16:59]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);F:\WINDOWS\system32\DRIVERS\A3AB.sys [2007-05-23 04:15]
S3 ICDUSB2;Sony IC Recorder (P);F:\WINDOWS\system32\Drivers\ICDUSB2.sys [2002-11-28 21:23]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\N]
\Shell\AutoRun\command - "Install FreeAgent Tools.exe" /run
*Newly Created Service* - AVGASCLN
.
Contents of the 'Scheduled Tasks' folder
"2008-01-29 07:00:37 F:\WINDOWS\Tasks\Incremental Back-up.job"
- F:\WINDOWS\system32\ntbackup.exeebackup
"2008-02-04 00:27:29 F:\WINDOWS\Tasks\User_Feed_Synchronization-{329886B2-A930-49D1-977E-BC1CF3378D8C}.job"
- F:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-04 11:47:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————
PROCESS: F:\WINDOWS\explorer.exe [6.00.2900.3156]
-> F:\Program Files\DigitalPersona\Bin\DpOFeedb.dll
-> F:\WINDOWS\system32\DLAAPI_W.DLL
.
Completion time: 2008-02-04 11:48:27
ComboFix-quarantined-files.txt 2008-02-04 19:48:18
ComboFix2.txt 2008-02-04 16:31:47
.
2008-01-27 20:41:59 — E O F —