What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] IE popups and other issues

10 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
Hi.

First, I'd like to say that this is an awesome thing you guys are doing.

Mostly, I've been having problems with IE popups advertising SettheTrend.com as well as several saying that my computer was infected and wouldn't I like to download their Spyware Remover? Microsoft Runtime Library has been giving me an error message that says there's a buffer overrun and that IE can't run properly.
I've tried scanning with AdAware, but whatever it removes just keeps showing up again later.
I was having problems with Limewire, where whatever infection I stupidly managed to pick up from there would repeatedly open Limewire after I'd closed it. I eventually just uninstalled Limewire to prevent anything further from happening. I believe one of the files I downloaded allowed something to be installed, which I later found under Program Files/RABCO. I deleted the file, hoping that that would stop the popups as well, but they continued. Here's the HT log:

Logfile of HijackThis v1.99.1
Scan saved at 4:21:46 AM, on 2/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\System32\ACS.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Atheros\ACU.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\system32\rundll32.exe
C:\WINNT\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINNT\System32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Host Process] C:\WINNT\Fonts\svchost.exe
O4 - HKLM\..\Run: [7c60fe60] rundll32.exe "C:\WINNT\system32\qsqxjovb.dll",b
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381577645
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381553009
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINNT\System32\ACS.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


Thanks for your help.
Post #2
Hello, and welcome to the forum.

My name is Simon V., and I'll be glad to help you with your computer problems.

Step 1

Please download and install CCleaner.

Open CCleaner. On the Windows tab, leave the default options alone.

  • On the Applications tab, check (tick) all the boxes except Saved Form Information. This will remove all your saved passwords if you leave this box checked.
  • Click on the Run Cleaner button at the bottom right hand corner.
  • When the cleaner has completed, click Tools in the Left Pane.
  • Verify that Uninstall is highlighted in color, or click on it.
  • In the lower right, click Save to Text File.
  • Pull down the arrow at the top of the Save dialog and choose Desktop as the location.
  • You can leave the filename as install.txt.
  • Click Save, then exit Ccleaner.

Step 2

Print these instructions or copy them to Notepad and save it to your desktop, as you won't be able to access internet in Safe Mode.

Please download SDFix and save it to your desktop.

Double click SDFix.exe and it will extract the files to %systemdrive% (Drive that contains the Windows directory, typically C:\SDFix)

Please reboot into Safe Mode. To do this, go to Start > Turn off Computer, and select Restart. Rapidly tap F8 just before Windows starts to load. In the menu that appears, select Safe Mode (Without Networking)

Log in to your usual account.

Once in Safe Mode, do the following:

Open the extracted SDFix folder and double-click RunThis.bat to start the script.

  • Type Y to begin the cleanup process.
  • It will remove any trojan services and registry entries that it finds, then prompt you to press any key to reboot; press any key and it will restart the PC.
  • When the PC restarts SDFix will run again and complete the removal process then display Finished. Press any key to end the script and load your desktop icons.
  • Once the desktop icons load, the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to clipboard ready for posting back on the forum).

Step 3

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix (C:\Combofix.txt) when you've accomplished that, along with a new HijackThis log, the CCleaner Uninstall List (install.txt) and the SDFix report (C:\SDFix\Report.txt).
Post #3
CCleaner List:

Ad-Aware 2007
Adobe Flash Player Plugin
Adobe Photoshop 7.0
Adobe Reader 8.1.1
Adobe Shockwave Player
Adobe® Photoshop® Album Starter Edition 3.2
AIM 6
Atheros Client Utility
Azureus
Big Fish Games Client
Bluetooth Stack for Windows by Toshiba
CCleaner (remove only)
CD/DVD Drive Acoustic Silencer
DivX Codec
DivX Content Uploader
DivX Converter
DivX Player
DivX Web Player
Dot1XCfg
EVEREST Home Edition v2.20
FastAccess® DSL Help Center 4.1
Fishie Fishie 1.0
GIMP 2.4.2
Hijackthis 1.99.1
HijackThis 1.99.1
Hotfix for Windows XP (KB914440)
Intel® Graphics Media Accelerator Driver
Intel® PROSet/Wireless Software
Java™ 6 Update 2
MA111 Configuration Utility
Macromedia Flash Player 8
mCore
mDrWiFi
mHelp
Microsoft .NET Framework 2.0
Microsoft Word 2002
Microsoft Works
Microsoft Works 2004 Setup Launcher
Microsoft Works Suite Add-in for Microsoft Word
mIRC
mIWA
mIWCA
mLogView
mMHouse
Mozilla Firefox (2.0.0.11)
mPfMgr
mPfWiz
mProSafe
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 6.0 Parser (KB933579)
mWlsSafe
mXML
mZConfig
Opera 9.25
Polychromatic Funk Monkey 1.4
Realtek AC'97 Audio
Replay Converter 2.8
Security Update for Microsoft .NET Framework 2.0 (KB917283)
Security Update for Microsoft .NET Framework 2.0 (KB922770)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901190)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923810)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944653)
SimPE 0.62 (alpha)
Sims 2 Wardrobe Wrangler v1.0
Sims2Pack Clean Installer
SMSC IrCC V5.1.3600.5 SP2
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515 drivers.
The Compressorizer! Version 1.01
The Sims 2
The Sims 2 Nightlife
The Sims 2 University
TIxx21/x515
TOSHIBA Assist
TOSHIBA Software Modem
Toshiba Tbiosdrv Driver
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
VideoLAN VLC media player 0.8.2
Viewpoint Media Player
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver

SDFix Report:


SDFix: Version 1.137

Run by [removed] on Wed 02/06/2008 at 06:25 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting…


Normal Mode:
Checking Files:

Trojan Files Found:

C:\PROGRA~1\COMPLU~1\VIKOJ~1.HTM - Deleted
C:\PROGRA~1\COMPLU~1\RYBIT - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\WINNT\mrofinu1000106.exe - Deleted
C:\WINNT\mrofinu1188.exe - Deleted
C:\WINNT\Fonts\Crack.exe - Deleted
C:\WINNT\system32\pac.txt - Deleted
C:\WINNT\uninstall_nmon.vbs - Deleted
C:\WINNT\Fonts\*.zip - 1 File(s) 637,936 bytes - Deleted
C:\WINNT\Fonts\'\*.zip - 1 File(s) 637,937 bytes - Deleted


Could Not Remove C:\WINNT\system32\drivers\core.cache.dsk

Folder C:\Program Files\Temporary - Removed
Folder C:\Temp\1cb - Removed
Folder C:\Temp\tn3 - Removed
Folder C:\WINNT\Fonts\' - Removed


Removing Temp Files…

ADS Check:



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-06 18:39:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:6d1b3502
"s1"=dword:a8c4c472
"s2"=dword:a7afb0b1
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:2a,27,e9,4a,b6,46,bd,f4,c3,07,a5,96,6a,59,a6,1b,ee,08,26,b0,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d5,8a,07,10,f2,e7,d2,f3,4d,2c,e4,ab,73,90,03,d0,ab,..
"khjeh"=hex:8b,0f,a2,04,71,79,c5,e4,7f,ab,95,31,39,a7,20,e9,18,2a,ea,8a,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:67,b0,71,1d,78,95,2f,60,f7,9c,e4,af,d6,e3,37,35,c5,11,7d,c8,80,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0d,12,70,30,da,ce,be,b3,05,a7,a4,2d,4e,d7,97,86,70,fc,64,e5,90,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools\"
"h0"=dword:00000000
"khjeh"=hex:2a,27,e9,4a,b6,46,bd,f4,c3,07,a5,96,6a,59,a6,1b,ee,08,26,b0,9b,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,d5,8a,07,10,f2,e7,d2,f3,4d,2c,e4,ab,73,90,03,d0,ab,..
"khjeh"=hex:8b,0f,a2,04,71,79,c5,e4,7f,ab,95,31,39,a7,20,e9,18,2a,ea,8a,46,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:67,b0,71,1d,78,95,2f,60,f7,9c,e4,af,d6,e3,37,35,c5,11,7d,c8,80,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:0d,12,70,30,da,ce,be,b3,05,a7,a4,2d,4e,d7,97,86,70,fc,64,e5,90,..

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
——————



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
—————
C:\WINNT\system32\drivers\core.cache.dsk Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 26 Jun 2005 616,448 A.SHR — "C:\Program Files\Replay Converter\cygwin1.dll"
Wed 22 Jun 2005 45,568 A.SHR — "C:\Program Files\Replay Converter\cygz.dll"
Mon 9 Dec 2002 102,437 A..HR — "C:\Program Files\Replay Converter\drv13260.dll"
Mon 9 Dec 2002 176,165 A..HR — "C:\Program Files\Replay Converter\drv23260.dll"
Mon 9 Dec 2002 208,935 A..HR — "C:\Program Files\Replay Converter\drv33260.dll"
Mon 9 Dec 2002 217,127 A..HR — "C:\Program Files\Replay Converter\drv43260.dll"
Sun 9 Jun 2002 40,448 A..HR — "C:\Program Files\Replay Converter\dspr3260.dll"
Sat 3 Nov 2001 225,280 A..HR — "C:\Program Files\Replay Converter\ivvideo.dll"
Tue 10 Apr 2001 225,280 A..HR — "C:\Program Files\Replay Converter\qtmlClient.dll"
Fri 20 Feb 2004 232,960 A..HR — "C:\Program Files\Replay Converter\raac.dll"
Sun 9 Jun 2002 525,824 A..HR — "C:\Program Files\Replay Converter\rnco3260.dll"
Mon 9 Dec 2002 245,805 A..HR — "C:\Program Files\Replay Converter\rnlt3260.dll"
Mon 9 Dec 2002 45,093 A..HR — "C:\Program Files\Replay Converter\rv103260.dll"
Mon 9 Dec 2002 98,341 A..HR — "C:\Program Files\Replay Converter\rv203260.dll"
Mon 9 Dec 2002 94,247 A..HR — "C:\Program Files\Replay Converter\rv303260.dll"
Mon 9 Dec 2002 90,151 A..HR — "C:\Program Files\Replay Converter\rv403260.dll"
Sun 9 Jun 2002 49,152 A..HR — "C:\Program Files\Replay Converter\tokr3260.dll"
Fri 9 Mar 2007 27,648 A.SH. — "C:\WINNT\system32\AVSredirect.dll"
Wed 6 Feb 2008 23,888 ..SH. — "C:\WINNT\system32\mvjpjdhw.dllbox"
Sun 27 Jan 2008 0 A..H. — "C:\WINNT\SoftwareDistribution\Download\585dc2612ebcefc90e7dee4c276ee95e\BIT9.tmp"

Finished!

ComboFIx Log:

ComboFix 08-02.05.3 - Dan 2008-02-06 21:58:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.268 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINNT\system32\drivers\cbidf2kk.sys
C:\WINNT\system32\drivers\core.cache.dsk
C:\WINNT\system32\gebxutt.dll
C:\WINNT\system32\pmnmm.dll
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\temp\tn3
C:\WINNT\cookies.ini
C:\WINNT\system32\agqnxbhf.dll
C:\WINNT\system32\bvojxqsq.ini
C:\WINNT\system32\drivers\cbidf2kk.sys
C:\WINNT\system32\drivers\core.cache.dsk
C:\WINNT\system32\eurlyotl.ini
C:\WINNT\system32\gebxutt.dll
C:\WINNT\system32\gewtcuoy.dll
C:\WINNT\system32\hrcyuges.dll
C:\WINNT\system32\kdhaexvj.ini
C:\WINNT\system32\mmnmp.ini
C:\WINNT\system32\mmnmp.ini2
C:\WINNT\system32\mvjpjdhw.dll
C:\WINNT\system32\mvjpjdhw.dll . . . . failed to delete
C:\WINNT\system32\mvjpjdhw.dllbox
C:\WINNT\system32\pmnmm.dll
C:\WINNT\system32\tdgdqdbp.dll
C:\WINNT\Web\default.htt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CBIDF2KK
——-\LEGACY_NETWORK_MONITOR
——-\cbidf2kk


((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-06 18:21 . 2008-02-06 18:22 d——– C:\WINNT\ERUNT
2008-02-06 18:14 . 2008-02-06 18:43 d——– C:\SDFix
2008-02-06 18:10 . 2008-02-06 18:10 d——– C:\Program Files\CCleaner
2008-02-06 05:25 . 2008-02-06 05:25 90,688 –a—— C:\WINNT\system32\ltoylrue.dll
2008-02-03 23:06 . 2008-02-06 22:08 163,904 –a—— C:\WINNT\system32\mvjpjdhw.dll
2008-02-03 23:01 . 2008-02-03 23:01 147,456 –a—— C:\WINNT\system32\vbzip10.dll
2008-02-03 23:00 . 2008-02-03 23:00 d——– C:\Documents and Settings\Dan\Application Data\PlayFirst
2008-02-03 23:00 . 2008-02-03 23:00 d——– C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-02-03 22:59 . 2008-02-03 22:59 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-03 22:58 . 2008-02-03 23:40 d——– C:\WINNT\system32\tip4
2008-02-03 22:58 . 2008-02-03 22:58 d——– C:\WINNT\system32\nGpxx18
2008-02-03 22:58 . 2008-02-03 23:57 d——– C:\WINNT\system32\lis6
2008-02-03 22:58 . 2008-02-03 22:58 d——– C:\WINNT\system32\kps5
2008-02-03 22:58 . 2008-02-03 22:58 d——– C:\WINNT\system32\hs9
2008-02-03 22:58 . 2008-02-04 00:28 d–hs—- C:\WINNT\RGFu
2008-02-03 22:58 . 2008-02-03 22:58 d——– C:\Temp\gTiis19
2008-02-03 22:58 . 2008-02-03 22:58 d——– C:\Temp\cXzz9
2008-02-03 22:58 . 2008-02-06 21:58 d——– C:\Temp
2008-02-03 22:57 . 2008-02-03 22:57 d——– C:\Program Files\Chocolatier
2008-01-29 22:26 . 2008-01-29 22:26 d——– C:\Program Files\Wardrobe Wrangler
2008-01-27 16:46 . 2008-01-27 16:46 d——– C:\Program Files\The Compressorizer
2008-01-27 02:00 . 2004-08-04 02:56 221,184 –a—— C:\WINNT\system32\wmpns.dll
2008-01-26 23:27 . 2007-07-09 08:09 584,192 —–c— C:\WINNT\system32\dllcache\rpcrt4.dll
2008-01-26 23:26 . 2007-09-07 05:04 524,317 —–c— C:\WINNT\system32\dllcache\kodakimg.exe
2008-01-26 23:26 . 2007-09-07 12:57 448,029 —–c— C:\WINNT\system32\dllcache\oieng400.dll
2008-01-26 23:26 . 2007-09-07 05:04 73,245 —–c— C:\WINNT\system32\dllcache\kodakprv.exe
2008-01-26 23:26 . 2007-09-07 12:57 38,941 —–c— C:\WINNT\system32\dllcache\jpeg2x32.dll
2008-01-26 23:26 . 2007-09-07 12:57 33,307 —–c— C:\WINNT\system32\dllcache\tifflt.dll
2008-01-26 17:49 . 2007-07-30 19:19 271,224 –a—— C:\WINNT\system32\mucltui.dll
2008-01-26 17:49 . 2007-07-30 19:19 30,072 –a—— C:\WINNT\system32\mucltui.dll.mui
2008-01-26 16:06 . 2007-07-30 19:19 25,944 –a—— C:\WINNT\system32\wuapi.dll.mui
2008-01-22 15:57 . 2008-01-22 20:20 d——– C:\Program Files\Polychromatic Funk Monkey
2008-01-20 21:31 . 2008-01-20 21:31 d——– C:\Program Files\Fishie Fishie
2008-01-10 00:23 . 2008-01-10 00:23 d——– C:\Documents and Settings\Dan\.thumbnails
2008-01-10 00:22 . 2008-01-10 02:37 d——– C:\Documents and Settings\Dan\.gimp-2.4

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-06 23:05 4,450 —-a-w C:\Documents and Settings\Dan\Application Data\wklnhst.dat
2008-02-04 04:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-04 04:47 12,632 —-a-w C:\WINNT\system32\lsdelete.exe
2008-02-04 04:01 ——— d—–w C:\Documents and Settings\Dan\Application Data\LimeWire
2008-02-04 03:57 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-01 05:04 ——— d—–w C:\Program Files\EA GAMES
2008-01-05 05:32 ——— d—–w C:\Program Files\Gargoyle
2007-12-31 00:49 ——— d—–w C:\Program Files\Sims2Pack Clean Installer
2007-12-30 05:34 ——— d—–w C:\Program Files\Opera
2007-12-29 19:00 223,128 —-a-w C:\WINNT\system32\drivers\dtscsi.sys
2007-12-29 19:00 ——— d—–w C:\Program Files\DAEMON Tools
2007-12-27 23:55 ——— d—–w C:\Program Files\SimPE
2007-12-25 15:40 ——— d—–w C:\Documents and Settings\Dan\Application Data\mIRC
2007-12-25 13:34 ——— d—–w C:\Program Files\mIRC
2007-12-22 03:42 ——— d—–w C:\Documents and Settings\Dan\Application Data\Azureus
2007-12-18 23:25 ——— d—–w C:\Program Files\GIMP-2.0
2007-12-09 01:48 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-09 01:46 54,124 —-a-w C:\Program Files\INSTALL.LOG
2007-12-08 14:42 ——— d—–w C:\Program Files\Replay Converter
2007-12-08 14:01 ——— d—–w C:\Program Files\Common Files\Motive
2007-12-08 01:51 737,280 —-a-w C:\WINNT\iun6002.exe
2007-12-08 01:51 ——— d—–w C:\Documents and Settings\Dan\Application Data\GetRightToGo
2007-12-08 01:45 ——— d—–w C:\Program Files\Common Files\SupportSoft
2007-12-08 01:45 ——— d—–w C:\Program Files\BellSouth
2007-12-08 01:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Motive
2007-12-08 01:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\MotiveSysIDs
2007-11-07 09:26 721,920 —-a-w C:\WINNT\system32\lsasrv.dll
2007-06-19 07:09 271 –sh–w C:\Program Files\desktop.ini
2007-06-19 07:09 21,952 -c-h–w C:\Program Files\folder.htt
2005-07-29 21:24 472 –sha-r C:\WINNT\RGFu\l3IR.vbs
2007-03-09 08:12 27,648 –sha-w C:\WINNT\system32\AVSredirect.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}]
C:\Program Files\ContextTool\ContextTool-2.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7978A254-AC21-4225-A579-EF4C9F9701E0}]
C:\Program Files\Outlook Express\nipybakot4444.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
2008-02-06 22:08 163904 –a—— C:\WINNT\system32\mvjpjdhw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E200A501-C1B3-4848-A136-EC1D3BC23402}]
C:\Program Files\Outlook Express\nipybakot83122.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 02:32 65536]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 10:20 50528]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 02:56 143360 C:\WINNT\system32\mobsync.exe]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-01-27 07:12 401408]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-01-27 07:13 385024]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-04-12 18:18 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 18:17 88358 C:\WINNT\agrsmmsg.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 17:28 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 17:26 688218]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2005-03-28 16:28 290816]
"IgfxTray"="C:\WINNT\System32\igfxtray.exe" [2007-01-13 11:47 131072]
"HotKeysCmds"="C:\WINNT\System32\hkcmd.exe" [2007-01-13 11:47 163840]
"Persistence"="C:\WINNT\System32\igfxpers.exe" [2007-01-13 11:46 135168]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 07:00 132496]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"HelpCenter4.1"="C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe" [2007-06-28 19:02 198184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-08 17:00 128920]
"7c60fe60"="C:\WINNT\system32\ltoylrue.dll" [2008-02-06 05:25 90688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 02:56 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 00:59 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-23 23:16:47 113664]
MA111 Configuration Utility.lnk - C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe [2007-11-22 12:14:02 459264]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 04:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\ComPlus Applications\vikoj.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2006-01-27 07:12 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mvjpjdhw]
mvjpjdhw.dll 2008-02-06 22:08 163904 C:\WINNT\system32\mvjpjdhw.dll

R2 McciCMService;McciCMService;"C:\Program Files\Common Files\Motive\McciCMService.exe" [2007-09-01 11:40]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S3 IWCA2K;Intel Wireless Connection Agent Miniport for Win 2K;C:\WINNT\system32\DRIVERS\iwca2k.sys [2004-08-12 10:43]
S3 USB-100;SMC Compact USB to Ethernet converter;C:\WINNT\system32\DRIVERS\SMC2208.SYS [2001-09-25 16:02]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINNT\system32\DRIVERS\usb8023.sys [2004-08-04 01:04]
S3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys [2003-06-19 14:05]
S3 w29n50;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows 2000;C:\WINNT\system32\DRIVERS\w29n50.sys [2006-01-17 03:34]
S3 WLAN_USB;Wireless LAN USB Driver;C:\WINNT\system32\DRIVERS\MA111nd5.sys [2002-12-23 12:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09aa4fe2-743f-11dc-8bd2-0013cea7d993}]
\Shell\AutoRun\command - setupSNK.exe

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-06 22:13:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINNT\system32\winlogon.exe
-> C:\WINNT\system32\mvjpjdhw.dll

PROCESS: C:\WINNT\Explorer.EXE [6.00.2900.3156]
-> C:\WINNT\system32\mvjpjdhw.dll
-> C:\WINNT\system32\ltoylrue.dll
.
———————— Other Running Processes ————————
.
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\System32\ACS.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINNT\system32\wscntfy.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE
C:\Program Files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2008-02-06 22:15:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-07 03:15:41
.
2008-01-29 05:43:18 — E O F —

And the new HT log:

Logfile of HijackThis v1.99.1
Scan saved at 10:21:36 PM, on 2/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\System32\ACS.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINNT\system32\wscntfy.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINNT\AGRSMMSG.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Atheros\ACU.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Java\jre1.6.0_02\bin\jucheck.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Media Holding Enterprises, LLC - {0D39A900-0F3A-4C29-A254-3E65244FDC34} - C:\Program Files\ContextTool\ContextTool-2.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7978A254-AC21-4225-A579-EF4C9F9701E0} - C:\Program Files\Outlook Express\nipybakot4444.dll (file missing)
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINNT\system32\mvjpjdhw.dll
O2 - BHO: (no name) - {E200A501-C1B3-4848-A136-EC1D3BC23402} - C:\Program Files\Outlook Express\nipybakot83122.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINNT\System32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [7c60fe60] rundll32.exe "C:\WINNT\system32\ltoylrue.dll",b
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381577645
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381553009
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O20 - Winlogon Notify: mvjpjdhw - C:\WINNT\SYSTEM32\mvjpjdhw.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINNT\System32\ACS.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

Again, thank you for your help, Simon. ^^
Post #4
Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System

[external image: Posted Image]

Download the file & save it as it's originally named, next to ComboFix.exe.

[external image: Posted Image]

Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.
Post #5
Here we go: WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
Post #6
Hi :)

[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

That's looking good; you can now reboot your computer if you wish to do so.

I understand that downloading music and other files may be important to you; however, the Peer-to-Peer programs that you are using to do that, even if they are not infected with malware, will bring malware into your system. Therefore, the chances of you becoming infected again are very high. This obviously can result in disabling your computer and could even lead to someone stealing sensitive personal data from your computer. Beyond the inconvenience this causes you, these programs also tend to use your computer as a server to spread more infection all over the internet, so your computer becomes a part of the malware problem.

Remember that no matter how clean the program you're using for Peer-to-Peer filesharing may be, it offers no guarantees regarding the cleanliness of files you may choose to download. All files available via Peer-to-Peer filesharing carry a high risk, particularly those that offer you illegitimate methods of using legitimate software programs without paying for them. Any program or file that offers you the ability to access non-freeware programs at no cost, e.g., pirated software and/or cracks/key generators for gaining access to legitimate software, is 100% guaranteed to contain malware.

Here is some information that looks at the rates of infection:

http://www.benedelman.org/spyware/p2p/

With that being said, I recommend that you remove the following Peer-to-Peer program(s):

(Click on Start, then Control Panel. Double click on Add or Remove Programs)

Azureus

Also remove the following programs:

Dot1XCfg
Java™ 6 Update 2
Viewpoint Media Player <– Only remove this program if you haven't installed it yourself.

Then download and install Java Runtime Environment (JRE) 6 Update 4.

Step 1

Go to Start > Control Panel > Display Properties > Desktop > Customize Desktop… > Web tab.
Uncheck and Delete everything you find in there. (Except for "My Current Home Page")

Step 2

Open Notepad (Go to Start > Run, type Notepad and hit Enter), and copy/paste the text in the quotebox below into it:

File::

C:\WINNT\system32\ltoylrue.dll
C:\WINNT\system32\mvjpjdhw.dll
C:\WINNT\iun6002.exe

Folder::

C:\WINNT\system32\tip4
C:\WINNT\system32\nGpxx18
C:\WINNT\system32\lis6
C:\WINNT\system32\kps5
C:\WINNT\system32\hs9
C:\WINNT\RGFu
C:\Temp\gTiis19
C:\Temp\cXzz9

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0D39A900-0F3A-4C29-A254-3E65244FDC34}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7978A254-AC21-4225-A579-EF4C9F9701E0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A95B2816-1D7E-4561-A202-68C0DE02353A}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E200A501-C1B3-4848-A136-EC1D3BC23402}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"7c60fe60"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mvjpjdhw]

Click on File > Save as….

In the File Name box, copy/paste CFScript.txt (Note: Do not change the filename!)

Click Save (Save the CFScript in the same location as Combofix.exe)

Close any open windows.

Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.

[external image: Posted Image]

Referring to the picture above, drag CFScript into ComboFix.exe.
It will create a log. Be sure to save it to a convenient location.

Step 3

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please save it to a convenient location.
  • You can also access the log by doing the following:

  • Click on the Malwarebytes' Anti-Malware icon to launch the program.
  • Click on the Logs tab.
  • Click on the log at the bottom of those listed to highlight it.
  • Click Open.

Step 4

In your next reply, please post:

  • the Combofix log (C:\Combofix.txt)
  • the Malwarebytes' Anti-Malware log
  • a new HijackThis log
Post #7
Combofix log:

ComboFix 08-02.05.3 - Dan 2008-02-07 17:20:08.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.228 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dan\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINNT\iun6002.exe
C:\WINNT\system32\ltoylrue.dll
C:\WINNT\system32\mvjpjdhw.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\cXzz9
C:\Temp\gTiis19
C:\Temp\gTiis19\lTig.log
C:\WINNT\iun6002.exe
C:\WINNT\RGFu
C:\WINNT\RGFu\l3IR.vbs
C:\WINNT\system32\eurlyotl.ini
C:\WINNT\system32\hs9
C:\WINNT\system32\hs9\corab2130.exe
C:\WINNT\system32\kps5
C:\WINNT\system32\kps5\covstadcom7.exe
C:\WINNT\system32\lis6
C:\WINNT\system32\ltoylrue.dll
C:\WINNT\system32\mvjpjdhw.dllbox
C:\WINNT\system32\nGpxx18
C:\WINNT\system32\nGpxx18\nGpxx182328.exe
C:\WINNT\system32\tip4
C:\WINNT\system32\windows

.
((((((((((((((((((((((((( Files Created from 2008-01-07 to 2008-02-07 )))))))))))))))))))))))))))))))
.

2008-02-07 17:13 . 2008-02-07 17:13 d——– C:\Program Files\Sun
2008-02-07 17:13 . 2007-12-14 01:59 69,632 –a—— C:\WINNT\system32\javacpl.cpl
2008-02-07 17:10 . 2008-02-07 17:13 d——– C:\Program Files\Java
2008-02-07 17:09 . 2008-02-07 17:09 d——– C:\Program Files\Common Files\Java
2008-02-07 16:17 . 2004-08-03 23:00 260,272 –a—— C:\cmldr
2008-02-06 21:43 . 2004-08-04 02:56 388,608 –a—— C:\kmd.exe
2008-02-06 18:21 . 2008-02-06 18:22 d——– C:\WINNT\ERUNT
2008-02-06 18:14 . 2008-02-06 18:43 d——– C:\SDFix
2008-02-06 18:10 . 2008-02-06 18:10 d——– C:\Program Files\CCleaner
2008-02-03 23:01 . 2008-02-03 23:01 147,456 –a—— C:\WINNT\system32\vbzip10.dll
2008-02-03 23:00 . 2008-02-03 23:00 d——– C:\Documents and Settings\Dan\Application Data\PlayFirst
2008-02-03 23:00 . 2008-02-03 23:00 d——– C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-02-03 22:59 . 2008-02-03 22:59 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-03 22:58 . 2008-02-07 17:20 d——– C:\Temp
2008-02-03 22:57 . 2008-02-03 22:57 d——– C:\Program Files\Chocolatier
2008-01-29 22:26 . 2008-01-29 22:26 d——– C:\Program Files\Wardrobe Wrangler
2008-01-27 16:46 . 2008-01-27 16:46 d——– C:\Program Files\The Compressorizer
2008-01-27 02:00 . 2004-08-04 02:56 221,184 –a—— C:\WINNT\system32\wmpns.dll
2008-01-26 23:27 . 2007-07-09 08:09 584,192 —–c— C:\WINNT\system32\dllcache\rpcrt4.dll
2008-01-26 23:26 . 2007-09-07 05:04 524,317 —–c— C:\WINNT\system32\dllcache\kodakimg.exe
2008-01-26 23:26 . 2007-09-07 12:57 448,029 —–c— C:\WINNT\system32\dllcache\oieng400.dll
2008-01-26 23:26 . 2007-09-07 05:04 73,245 —–c— C:\WINNT\system32\dllcache\kodakprv.exe
2008-01-26 23:26 . 2007-09-07 12:57 38,941 —–c— C:\WINNT\system32\dllcache\jpeg2x32.dll
2008-01-26 23:26 . 2007-09-07 12:57 33,307 —–c— C:\WINNT\system32\dllcache\tifflt.dll
2008-01-26 17:49 . 2007-07-30 19:19 271,224 –a—— C:\WINNT\system32\mucltui.dll
2008-01-26 17:49 . 2007-07-30 19:19 30,072 –a—— C:\WINNT\system32\mucltui.dll.mui
2008-01-26 16:06 . 2007-07-30 19:19 25,944 –a—— C:\WINNT\system32\wuapi.dll.mui
2008-01-22 15:57 . 2008-01-22 20:20 d——– C:\Program Files\Polychromatic Funk Monkey
2008-01-20 21:31 . 2008-01-20 21:31 d——– C:\Program Files\Fishie Fishie
2008-01-10 00:23 . 2008-01-10 00:23 d——– C:\Documents and Settings\Dan\.thumbnails
2008-01-10 00:22 . 2008-01-10 02:37 d——– C:\Documents and Settings\Dan\.gimp-2.4

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-07 21:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-02-07 21:50 ——— d—–w C:\Program Files\Azureus
2008-02-07 05:27 4,450 —-a-w C:\Documents and Settings\Dan\Application Data\wklnhst.dat
2008-02-04 04:48 ——— d—–w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-02-04 04:47 12,632 —-a-w C:\WINNT\system32\lsdelete.exe
2008-02-04 04:01 ——— d—–w C:\Documents and Settings\Dan\Application Data\LimeWire
2008-02-04 03:57 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-01 05:04 ——— d—–w C:\Program Files\EA GAMES
2008-01-05 05:32 ——— d—–w C:\Program Files\Gargoyle
2007-12-31 00:49 ——— d—–w C:\Program Files\Sims2Pack Clean Installer
2007-12-30 05:34 ——— d—–w C:\Program Files\Opera
2007-12-29 19:00 223,128 —-a-w C:\WINNT\system32\drivers\dtscsi.sys
2007-12-29 19:00 ——— d—–w C:\Program Files\DAEMON Tools
2007-12-27 23:55 ——— d—–w C:\Program Files\SimPE
2007-12-25 15:40 ——— d—–w C:\Documents and Settings\Dan\Application Data\mIRC
2007-12-25 13:34 ——— d—–w C:\Program Files\mIRC
2007-12-22 03:42 ——— d—–w C:\Documents and Settings\Dan\Application Data\Azureus
2007-12-18 23:25 ——— d—–w C:\Program Files\GIMP-2.0
2007-12-09 01:48 ——— d–h–w C:\Program Files\InstallShield Installation Information
2007-12-09 01:46 54,124 —-a-w C:\Program Files\INSTALL.LOG
2007-12-08 14:42 ——— d—–w C:\Program Files\Replay Converter
2007-12-08 14:01 ——— d—–w C:\Program Files\Common Files\Motive
2007-12-08 01:51 ——— d—–w C:\Documents and Settings\Dan\Application Data\GetRightToGo
2007-12-08 01:45 ——— d—–w C:\Program Files\Common Files\SupportSoft
2007-12-08 01:45 ——— d—–w C:\Program Files\BellSouth
2007-12-08 01:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\Motive
2007-12-08 01:25 ——— d—–w C:\Documents and Settings\All Users\Application Data\MotiveSysIDs
2007-11-07 09:26 721,920 —-a-w C:\WINNT\system32\lsasrv.dll
2007-06-19 07:09 271 –sh–w C:\Program Files\desktop.ini
2007-06-19 07:09 21,952 -c-h–w C:\Program Files\folder.htt
2007-03-09 08:12 27,648 –sha-w C:\WINNT\system32\AVSredirect.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 02:32 65536]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-10-04 10:20 50528]
"ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [2004-08-04 02:56 143360 C:\WINNT\system32\mobsync.exe]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-01-27 07:12 401408]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-01-27 07:13 385024]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2005-04-12 18:18 184320]
"AGRSMMSG"="AGRSMMSG.exe" [2005-04-12 18:17 88358 C:\WINNT\agrsmmsg.exe]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-10-14 17:28 98394]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-10-14 17:26 688218]
"ACU"="C:\Program Files\Atheros\ACU.exe" [2005-03-28 16:28 290816]
"IgfxTray"="C:\WINNT\System32\igfxtray.exe" [2007-01-13 11:47 131072]
"HotKeysCmds"="C:\WINNT\System32\hkcmd.exe" [2007-01-13 11:47 163840]
"Persistence"="C:\WINNT\System32\igfxpers.exe" [2007-01-13 11:46 135168]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"HelpCenter4.1"="C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe" [2007-06-28 19:02 198184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-11-08 17:00 128920]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 03:42 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 02:56 214528]
"tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-04 00:59 44544]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-23 23:16:47 113664]
MA111 Configuration Utility.lnk - C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe [2007-11-22 12:14:02 459264]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 04:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2006-01-27 07:12 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

R2 McciCMService;McciCMService;"C:\Program Files\Common Files\Motive\McciCMService.exe" [2007-09-01 11:40]
S3 IWCA2K;Intel Wireless Connection Agent Miniport for Win 2K;C:\WINNT\system32\DRIVERS\iwca2k.sys [2004-08-12 10:43]
S3 USB-100;SMC Compact USB to Ethernet converter;C:\WINNT\system32\DRIVERS\SMC2208.SYS [2001-09-25 16:02]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINNT\system32\DRIVERS\usb8023.sys [2004-08-04 01:04]
S3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys [2003-06-19 14:05]
S3 w29n50;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows 2000;C:\WINNT\system32\DRIVERS\w29n50.sys [2006-01-17 03:34]
S3 WLAN_USB;Wireless LAN USB Driver;C:\WINNT\system32\DRIVERS\MA111nd5.sys [2002-12-23 12:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{09aa4fe2-743f-11dc-8bd2-0013cea7d993}]
\Shell\AutoRun\command - setupSNK.exe

*Newly Created Service* - PCANDIS5
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-07 17:22:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-07 17:23:34
ComboFix-quarantined-files.txt 2008-02-07 22:23:20
ComboFix2.txt 2008-02-07 03:15:48
.
2008-01-29 05:43:18 — E O F —

Anti-Malware Log:
Malwarebytes' Anti-Malware 1.02
Database version: 326

Scan type: Quick Scan
Objects scanned: 23234
Time elapsed: 4 minute(s), 35 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\RABCO (Adware.RABCO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\kernelexe (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\Application Data\Rabio\Search Enhancer (Adware.SearchEnhancer) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Dan\Start Menu\Programs\Startup\RABCO - Auto Update.lnk (Adware.RABCO) -> Quarantined and deleted successfully.
C:\Documents and Settings\Dan\Desktop\Help and Support Center.lnk (Rogue.Link) -> Quarantined and deleted successfully.

New HT log:
Logfile of HijackThis v1.99.1
Scan saved at 5:37:45 PM, on 2/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINNT\System32\ACS.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\ltmoh\Ltmoh.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Atheros\ACU.exe
C:\WINNT\System32\hkcmd.exe
C:\WINNT\System32\igfxpers.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg4.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINNT\System32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HelpCenter4.1] C:\Program Files\Bellsouth\HelpCenter40b\bin\sprtcmd.exe /P HelpCenter4.1
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: MA111 Configuration Utility.lnk = C:\Program Files\NETGEAR\MA111 Configuration Utility\wlancfg.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381577645
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1201381553009
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINNT\System32\ACS.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe


By the way, I couldn't find the Dot1XCfg program under Add/Remove, nor could I find a program folder for it, but I'm pretty sure I saw the process running. Any idea where it might be?
Post #8
Hi :)

By the way, I couldn't find the Dot1XCfg program under Add/Remove, nor could I find a program folder for it, but I'm pretty sure I saw the process running. Any idea where it might be?

There's a legit Dot1XCfg.exe located in C:\Program Files\Intel\Wireless\Bin\, and a malware one in C:\Program Files\Dot1XCfg\. The first one is essential and should be left alone, the other should be removed if present. It's good that you didn't find the entry in Add/Remove Programs, or the folder in the Program Files folder. It means the malware got removed by something else.

Your logs are looking good; how are things running now?
Post #9
Pretty good, actually. No popups, no files, folders or programs I know I didn't download, no two hundred plus pos files in my documents or under the C: folder. My computer's running as quickly as it was before. Does this mean all is well in the land o' My Computer? If so, thank you so much. :notworthy:
Post #10 last edited
Hi :)

My computer's running as quickly as it was before.

I'm glad to hear your computer is running OK again. Here are some tips to keep your computer clean in the future:

Click Start then Run….

  • Type Combofix /u in the runbox and click OK. (Note: The space between the x and the /u needs to be there)

    [external image: Posted Image]

  • This will uninstall Combofix.

You can delete SDFix.exe and C:\SDFix\.

You aren't running anti-virus software. Please make sure you download and install one anti-virus program.

Use an Anti-Virus Program - It is very important that your computer has an anti-virus program running on your machine. This alone can save you a lot of trouble with malware in the future.

Here are a few (free) anti-virus programs, please download and install one of them:


Update your Anti-Virus Software - It is very important that you update your anti-virus software at least once a week (even more if you wish). If you do not update your anti-virus software then it will not be able to catch any of the new variants that will come out.

Make your Internet Explorer More Secure

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab.
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.

  • Change the Download signed ActiveX controls to Prompt.
  • Change the Download unsigned ActiveX controls to Disable.
  • Change the Initialise and script ActiveX controls not marked as safe to Disable.
  • Change the Installation of desktop items to Prompt.
  • Change the Launching programs and files in an IFRAME to Prompt.
  • Change the Navigate sub-frames across different domains to Prompt.
  • When all these settings have been made, click on the OK button.
  • If it prompts you as to whether or not you want to save the settings, press the Yes button.

  • Next press the Apply button and then the OK to exit the Internet Properties page.

Use a Firewall - Without a firewall your computer is susceptible to being hacked and taken over. The Windows firewall isn't sufficient as it only monitors incoming connections.

Here are a few (free) firewalls, please download and install one of them:


Visit Microsoft's Update Site Frequently - It is important that you visit http://update.microsoft.com/ regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install WinPatrol - An excellent startup manager, notifies you if programs are added to startup, allows delayed startup, … A must have! An installation guide can be found here: http://www.winpatrol.com/download.html

Install Spybot - Search and Destroy - You should scan your computer with the program on a regular basis just as you would with your anti-virus software. A tutorial on installing and using this product can be found here (do not install TeaTimer): http://www.bleepingcomputer.com/tutorials/tutorial43.html

Install SpywareBlaster - SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A tutorial can be found here: http://www.bleepingcomputer.com/tutorials/tutorial49.html

Install IE-Spyad - IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here: http://www.spywarewarrior.com/uiuc/resource.htm#IESPYAD

Update All Your Security Programs Regularly - Make sure you update all your security programs (Anti-Virus, Firewall, Anti-Spyware) regularly (once a weak, at least). Without regular updates you WILL NOT be protected when new malicious programs are released.

You can also read this excellent article by TonyKlein: So how did I get infected in the first place?

Follow this list and your potential for being infected again will reduce dramatically.

Stand Up and Be Counted! - Please take the time to tell us what you would like to be done about the people who are behind all the problems you have had. We can only get something done about this if the people that we help, like you, are prepared to complain. We have a dedicated forum for collecting these complaints: Malware Complaints. You have to be registered to post. After registering just find your country room and register your complaint. The infection you had was Vundo (Virtumundo).
Post #11
Oh, wow. I was looking for some more protective measures. With all this installed and running, it looks like I've got all my bases covered. Hopefully, I won't be back for help anytime soon. Thank you so much for your time and assistance. I have no idea what I would have done if this place didn't exist. Happy dance emote for you: :yeah: PS. I posted a complaint in the appropriate thread, like you suggested. ^^
Post #12

Oh, wow. I was looking for some more protective measures. With all this installed and running, it looks like I've got all my bases covered.
Hopefully, I won't be back for help anytime soon.
Thank you so much for your time and assistance. I have no idea what I would have done if this place didn't exist.
Happy dance emote for you: :yeah:

PS. I posted a complaint in the appropriate thread, like you suggested. ^^

You're very welcome, and thanks for posting your complaint :)

Happy surfing and stay safe!

Since this issue appears to be resolved … this topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a new topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI