Spyware / Malware / Virus Removal

Help, I infected my computer

31 min read

Looking for the outcome? Ask AI

fabulousdazaster1 Topic Starter

Post #1February 23, 2008, 5:02 AM UTC last edited February 25, 2008, 6:24 AM UTC

Hi WhatTheTech,

I downloaded a virus from Limewire and now Explorer is a mess of pop ups and infected files. My spyware and antivirus program is unable to remove the tracking cookies.

When I open Explorer it redirects me to pages like this:

http://www.vortal.com/results.php?search=n…ferer%20present

When I run my spyware program, it finds: atlas.dmt.com and webtrends trackers, and sometimes darksma.

I installed Spybot and Windows Defender. Spybot is constantly denying a 22:24 registry changes, and Windows Defender is asking to permit win23/ssttu.dll.

– Argh! I don't know what I was thinking. I should have known better.

I would appreciate you help and have posted my logfile.

Sincerely,

–FabulousDazaster

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:44:25 PM, on 2/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O15 - Trusted Zone: http://www.musiciansfriend.com
O15 - Trusted Zone: http://citrix.prosum.com
O15 - Trusted Zone: http://www.socalmoving.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124517799234
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 9437 bytes

Noviciate

Post #2February 26, 2008, 9:34 PM UTC

Go here and click the Kaspersky Online Scanner button - I.E. is required for this scan.

Read the Requirements and limitations before you click Accept.
Allow the ActiveX download if necessary.
Once the database has downloaded click Next.
Click Scan Settings and check the "Scan using the following antivirus database" is set to extended, not standard, and then click OK.
Click on "My Computer" and then put the kettle on!
When the scan has completed, click Save Report As…
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

Copy and paste the report into your next reply along with a fresh HJT log, run in Normal Mode, and a description of how your PC is behaving.

Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

Also, run HJT and click on Open the Misc Tools section.

Click Open Uninstall Manager…
Click Save list… and save it to your Desktop.
Copy and paste the file uninstall_list.txt into your next reply.

fabulousdazaster1

Post #3February 28, 2008, 2:50 AM UTC last edited February 28, 2008, 3:38 AM UTC

Great, thank you for helping. Explorer is still having pop ups. I get redirected sites like these:
http://www.setthetrend.com/search.php?quer…p;adkw=pos&
and

http://67.201.36.14/cgi-bin/feedred?c=2611…JmFmZmlkPTI2MTE

My CA Antivirus software found this last night.

Win32/Vundo.OT trojan.
2/26/2008 22:18:52 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan.
2/26/2008 22:18:52 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan.
2/26/2008 22:18:53 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan.
2/27/2008 6:53:00 AM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan

Here is the Kaspersky report:

KKASPERSKY ONLINE SCANNER REPORT
Wednesday, February 27, 2008 7:17:38 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 27/02/2008
Kaspersky Anti-Virus database records: 582651

Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases true

Scan Target My Computer
C:\
D:\
E:\
F:\
G:\

Scan Statistics
Total number of scanned objects 128288
Number of viruses found 10
Number of infected objects 26
Number of suspicious objects 2
Duration of the scan process 03:50:20

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-02252008-183201.log Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DloaderAgentWN.zip/crackmasters.exe Suspicious: Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\DloaderAgentWN.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-02-26_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\09431A90 Infected: Backdoor.Win32.IRCBot.qc skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\25C82897 Infected: Trojan-Downloader.JS.IstBar.j skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50B40351/Cabs.w1.cab/loadadv458.exe Infected: Trojan-Downloader.Win32.Agent.xq skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50B40351/Cabs.w1.cab Infected: Trojan-Downloader.Win32.Agent.xq skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50B40351 Embedded: infected - 2 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\50B40351 CryptFF: infected - 2 skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AA17CAA Infected: Backdoor.Win32.IRCBot.qc skipped

C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\7AAB7A9F Infected: Backdoor.Win32.IRCBot.qc skipped

C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked skipped

C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\cert8.db Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\GoogleToolbarData\googlesafebrowsing.db Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\history.dat Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\key3.db Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\parent.lock Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\search.sqlite Object is locked skipped

C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\urlclassifier2.sqlite Object is locked skipped

C:\Documents and Settings\The Emperor\Cookies\INDEX.DAT Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{1C7BAE1D-DA1A-4EF9-B746-85AC7ECA10EE} Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows Media\11.0\WMSDKNSD.XML Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_001_ Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_002_ Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_003_ Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_MAP_ Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\History\History.IE5\MSHist012008022620080227\index.dat Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF1E4E.tmp Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF2701.tmp Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF6221.tmp Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFB77F.tmp Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFEBBD.tmp Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\GLU34HM3\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\GLU34HM3\css4[2] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\GLU34HM3\help[1].htm Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\GLU34HM3\offline[1].htm Object is locked skipped

C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\The Emperor\ntuser.dat Object is locked skipped

C:\Documents and Settings\The Emperor\ntuser.dat.LOG Object is locked skipped

C:\Program Files\CA\SharedComponents\PPRT\logs\2008-02-26.csv Object is locked skipped

C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087555.exe Infected: Trojan-Downloader.Win32.Small.ijp skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087556.exe/data0006 Infected: Trojan-Downloader.Win32.VB.cgu skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087556.exe NSIS: infected - 1 skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087559.exe Infected: Trojan-Downloader.Win32.Small.ijp skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087562.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087669.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087677.dll Infected: not-a-virus:AdWare.Win32.Agent.acn skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll Object is locked skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP396\A0089061.dll Infected: not-a-virus:AdWare.Win32.TTC.d skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP396\A0089062.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP397\A0089093.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP399\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\SchedLgU.Txt Object is locked skipped

C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped

C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped

C:\WINDOWS\SYSTEM32\ddayv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\WINDOWS\SYSTEM32\efcyabc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped

C:\WINDOWS\SYSTEM32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped

C:\WINDOWS\SYSTEM32\nGpxx18\nGpxx182328.exe Infected: Trojan-Downloader.Win32.VB.cgu skipped

C:\WINDOWS\SYSTEM32\p9\liopud89104.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped

C:\WINDOWS\SYSTEM32\p9\liopud89104.exe NSIS: infected - 1 skipped

C:\WINDOWS\SYSTEM32\ssttu.dll_old Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Temp\TMP00000146BB55602041274449 Object is locked skipped

C:\WINDOWS\WIADEBUG.LOG Object is locked skipped

C:\WINDOWS\WIASERVC.LOG Object is locked skipped

C:\WINDOWS\WindowsUpdate.log Object is locked skipped

F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

Scan process completed.

… And here is the HJThis logfile:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:31:16 PM, on 2/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autofix
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O15 - Trusted Zone: http://www.musiciansfriend.com
O15 - Trusted Zone: http://citrix.prosum.com
O15 - Trusted Zone: http://www.socalmoving.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124517799234
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 10137 bytes

However, the 'save list' button does not seem to be working in the uninstall misc tools of HJThis.

I'm going to try rebooting and see if anything changes.

Thanks, Dan

Noviciate

Post #4February 28, 2008, 10:09 PM UTC last edited February 28, 2008, 10:10 PM UTC

Don't worry about the Uninstall list - the problem is caused by the slime on your machine. Run the following and post accordingly:

Download Combofix by sUBs from here and save it to your Desktop.

Double click combo.exe to run it and follow the prompts.
Please Note: This may require the PC to be rebooted so close any programs you have open before you start.
When the tool has finished, it will produce a log C:\ComboFix.txt - copy and paste it into your next reply.
Post a fresh HJT log as well.
Let me know how the PC is behaving.

Please Note:

Do not mouse click in the combofix window while it is running - this may cause your system to hang/crash.
Disable Script Blocking if you have Norton Anti Virus installed, and your version has this option, as it will interfere with the normal working of this tool.
Should any security program warnings appear, ignore them as they are false-positives - this tool isn't malicious.

EDIT: I'll have the Uninstall list now - it should be produced OK.

fabulousdazaster1

Post #5February 29, 2008, 5:09 AM UTC last edited February 29, 2008, 4:01 PM UTC

Hi there,

I ran the program. Everything went smoothly. Afterwards, Spybot detected registry changes and I allowed them. Explorer seems to be normal.

But myy CA AntiVirus Software found this: win32/vundo.ot

Here is the log file:

ComboFix 08-02-25.3 - The Emperor 2008-02-28 20:07:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.688 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\1cb
C:\Temp\isgTi19
C:\Temp\isgTi19\lPig.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\a1
C:\WINDOWS\system32\ddayv.dll
C:\WINDOWS\system32\efcyabc.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nGpxx18
C:\WINDOWS\system32\nGpxx18\nGpxx182328.exe
C:\WINDOWS\system32\p9
C:\WINDOWS\system32\p9\liopud89104.exe
C:\WINDOWS\SYSTEM32\ptdkbfwr.ini
C:\WINDOWS\SYSTEM32\uttss.ini
C:\WINDOWS\SYSTEM32\uttss.ini2
C:\WINDOWS\system32\v6
C:\WINDOWS\SYSTEM32\vyadd.ini
C:\WINDOWS\SYSTEM32\vyadd.ini2
C:\WINDOWS\system32\w11
C:\WINDOWS\system32\w11\hiba3133.exe
C:\WINDOWS\SYSTEM32\xphybhnc.ini
C:\WINDOWS\SYSTEM32\yybeg.ini
C:\WINDOWS\SYSTEM32\yybeg.ini2
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-01-28 to 2008-02-29 )))))))))))))))))))))))))))))))
.

2008-02-28 17:12 . 2008-02-28 17:12 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-28 17:12 . 2008-02-28 17:12 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-26 18:57 . 2008-02-26 18:57 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-26 18:57 . 2008-02-26 18:57 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 22:04 . 2008-02-24 22:04 322,656 –a—— C:\WINDOWS\SYSTEM32\ssttu.dll_old
2008-02-24 17:11 . 2008-02-24 17:11 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 20:43 . 2008-02-22 20:43 d——– C:\Program Files\Trend Micro
2008-02-16 20:43 . 2008-02-16 20:43 d——– C:\Program Files\Windows Defender
2008-02-16 20:15 . 2008-02-16 20:15 d——– C:\Program Files\Common Files\Scanner
2008-02-16 11:55 . 2008-02-16 11:55 33 –a—— C:\WINDOWS\SYSTEM32\7806c36e
2008-02-16 11:47 . 2008-02-24 21:19 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-16 11:46 . 2008-02-17 02:13 d–hs—- C:\WINDOWS\VGhlIEVtcGVyb3I
2008-02-16 11:44 . 2008-02-16 11:44 d——– C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-16 11:02 . 2008-02-16 11:04 d——– C:\Documents and Settings\The Emperor\.SunDownloadManager
2008-02-03 21:33 . 2008-02-03 21:33 8,192 –ahs—- C:\WINDOWS\Thumbs.db

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k7
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k6
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k5
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k4
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k3
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k2
2008-02-29 04:18 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k1
2008-02-29 04:18 118,762 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k0
2008-02-25 01:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 04:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\CA
2008-02-17 03:33 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-01-01 07:26 ——— d—–w C:\Documents and Settings\The Emperor\Application Data\gtk-2.0
2008-01-01 07:10 ——— d—–w C:\Program Files\LinuxSampler
2007-06-17 17:56 60,968 —-a-w C:\Documents and Settings\The Emperor\GoToAssistDownloadHelper.exe
2005-03-03 21:20 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0E0A2AD5-1ADC-4EC3-90FC-0FB793C9259E}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53828D18-648B-4A44-BA58-A0E89291431F}]
C:\WINDOWS\system32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66007BCD-B77A-4C0D-AC74-1221202C389A}]
C:\WINDOWS\system32\gebyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A0EB3E5-BD54-49CE-DE8F-69E12811CBB5}]
C:\Program Files\Outlook Express\rybil.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c948d07-6064-4187-9fe2-2f2e3829e2a0}]
C:\WINDOWS\system32\eosfjsgl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 22:25 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 12:42 230664]
"cafwc"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-02-19 13:40 1193224]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-02-19 13:40 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-02-19 13:40 259336]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-01-28 11:43 5146448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\SYSTEM32\UmxWNP.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Program Neighborhood Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Program Neighborhood Agent.lnk
backup=C:\WINDOWS\pss\Program Neighborhood Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
–a—— 2004-12-14 01:12 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2006-07-17 11:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"SharedAccess"=2 (0x2)
"Macromedia Licensing Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 09:46]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 13:28]
R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 17:09]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 09:46]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 03:54]
R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 17:09]
R2 RVIEG01;VSC Engine;C:\Audio\Cakewalk\SONAR 1\Shared Dxi\Roland\RVIEg01.sys [2001-03-16 12:49]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-04 08:23]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 08:39]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-12 11:02]
R3 L6DP;L6DP;C:\WINDOWS\system32\Drivers\l6dp.sys [2007-09-17 11:31]
R3 L6TPortA;Service - Line 6 TonePort UX1;C:\WINDOWS\system32\Drivers\L6TPortA.sys [2007-09-17 11:25]
R3 MovRVDrv32;MovRVDrv32;C:\WINDOWS\system32\DRIVERS\MovRVDrv32.sys [2007-12-14 17:06]
R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2007-08-16 21:10]
R3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2007-12-14 17:06]
S3 SoundMovieServer;SoundMovieServer;"C:\WINDOWS\system32\snmvtsvc.exe" [2007-12-14 17:06]
S3 UnlockerDriver4;UnlockerDriver4 Driver;C:\Program Files\Unlocker\UnlockerDriver4.sys [2005-07-25 05:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 05:15:50 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as The Emperor at 8 15 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
"2008-02-29 04:22:42 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-28 20:21:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
.
**************************************************************************
.
Completion time: 2008-02-28 20:25:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-29 04:25:40
.
2008-02-23 01:11:37 — E O F —

And here is the HJThis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:03:09 PM, on 2/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53828D18-648B-4A44-BA58-A0E89291431F} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: (no name) - {66007BCD-B77A-4C0D-AC74-1221202C389A} - C:\WINDOWS\system32\gebyy.dll (file missing)
O2 - BHO: 0 - {6A0EB3E5-BD54-49CE-DE8F-69E12811CBB5} - C:\Program Files\Outlook Express\rybil.dll (file missing)
O2 - BHO: {0a2e9283-e2f2-2ef9-7814-460670d849c6} - {6c948d07-6064-4187-9fe2-2f2e3829e2a0} - C:\WINDOWS\system32\eosfjsgl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autofix
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O15 - Trusted Zone: http://www.musiciansfriend.com
O15 - Trusted Zone: http://citrix.prosum.com
O15 - Trusted Zone: http://www.socalmoving.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124517799234
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 11023 bytes

And here is the uninstall list. It is working now!

Adobe Acrobat 7.0 Professional
Adobe Acrobat 7.0.1 and Reader 7.0.1 Update
Adobe Acrobat 7.0.2 and Reader 7.0.2 Update
Adobe Flash Player 9 ActiveX
Adobe Photoshop 7.0
Adobe Premiere 6.0
Advanced RealMedia Export Plug-in for Premiere 6.0
Banctec Service Agreement
CA Internet Security Suite
Cakewalk Sonar v1.01
Cakewalk VST Adapter 4
Camera Driver
CheckIt Diagnostics
Citrix Presentation Server Client
cleaner XL
Dell Driver Reset Tool
Dell ResourceCD
Dell Support
Desktop
DreamStation DXi2
DSound Stomp`n FX Vol.1 v1.5
DSound Stomp'n FX Vol.2 v1.0
DVD Decrypter (Remove Only)
DVD Shrink 3.2
Final Draft 7
Flash DVD Ripper
Fritz 8
GearBox 3.00 (Remove Only)
GearBox 3.50 (Remove Only)
Gtk+ Runtime Environment 2.10.11-1
gtkmm Runtime Environment 2.10
Guitar Pro 4
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
HP Photo and Imaging 2.0 - hp psc 1200 series
hp psc 1200 series
hp psc 1200 series
IK Multimedia Amplitube v1.3
Intel® 537EP V9x DF PCI Modem
Intel® Extreme Graphics 2 Driver
Intel® PRO Network Adapters and Drivers
Intel® PROSet
Internet Explorer Default Page
InterVideo MP3 + DVD XPack
J2SE Runtime Environment 5.0 Update 9
Java™ 6 Update 2
Java™ 6 Update 3
Joystick 2 Mouse 3
Kaspersky Online Scanner
Line 6 Drivers 3.3.3.6 (Remove Only)
Line 6 Monkey 1.16 (Remove Only)
Line 6 Monkey 1.18 (Remove Only)
Line 6 Monkey 1.19 (Remove Only)
Line 6 Monkey 1.20 (Remove Only)
Line 6 Monkey 1.21 (Remove Only)
LinuxSampler 20071207
Live 5.2.2
LiveUpdate 3.0 (Symantec Corporation)
LucasArts' Curse of Monkey Island
Macromedia Dreamweaver MX 2004
Macromedia Extension Manager
Macromedia Fireworks MX
Macromedia Flash MX
Macromedia Shockwave Player
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Outlook 2003
Microsoft Office Professional Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Event Monitor
Mozilla Firefox (2.0.0.12)
MSXML 4.0 SP2 (KB936181)
Napster for Windows Media Player
Nero 6 Ultra Edition
NeroVision Express 2
Netflix Movie Viewer
Nomad Factory Rock Amp Legends VST v1.0
QuickTime
RadLight MPC DirectShow Filter (remove only)
RealPlayer
ReValver
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB918899)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922760)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925486)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB946026)
Skype 2.5
Snes9x
Sonic Foundry Sound Forge 6.0e
SoundTaxi 3.1.8
Spybot - Search & Destroy
Symantec Technical Support Web Controls
TMPGEnc 3.0 XPress
TMPGEnc 4.0 XPress Trial Version
TMPGEnc DVD Author 1.6
TMPGEnc MPEG Editor
TMPGEnc Sound Player
Unlocker 1.6.7
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
URGE
VDMSound 2.0.4
Virtual Sound Canvas DXi
Warp VST V1.0
Waves 4.0
Windows Defender
Windows Defender Signatures
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Format SDK Hotfix - KB891122
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB885884
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinRAR archiver

Noviciate

Post #6February 29, 2008, 9:07 PM UTC

Can you give me the full file name(s) and path(s) that your AV is detecting - they may be files that have already been disabled by CF.

fabulousdazaster1

Post #7March 1, 2008, 1:52 AM UTC

Here is the AV log for the last few days since it started.

2/16/2008 22:40:54 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP381\A0087557.exe may have unknown infection. Quarantined 2/16/2008 22:41:02 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087572.exe is Win32/NetMon.A trojan. Deleted 2/16/2008 22:41:06 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087573.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:11 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087584.exe is Win32/Pushbot.AV worm. Deleted 2/16/2008 22:41:11 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087585.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:12 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087587.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:12 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP382\A0087588.exe is Win32/SillyDl.YQ trojan. Deleted 2/16/2008 22:41:14 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP384\A0087616.exe is Win32/Zquest.E trojan. Deleted 2/16/2008 22:41:21 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087688.exe is Win32/Pushbot.AV worm. Deleted 2/16/2008 22:41:27 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087690.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:32 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087721.dll is Win32/Zquest.E trojan. Deleted 2/16/2008 22:41:33 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087722.exe is Win32/NetMon.A trojan. Deleted 2/16/2008 22:41:34 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087723.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:36 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087724.exe is Win32/Fonhos.A worm. Deleted 2/16/2008 22:41:38 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087725.exe is Win32/SillyDl.YQ trojan. Deleted 2/19/2008 14:26:14 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:16 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:16 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:17 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:17 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:18 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:18 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:19 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:21 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:21 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:22 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:22 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:23 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:23 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:24 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:25 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:25 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:25 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:26 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:26 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:27 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:27 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:27 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:28 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:28 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:29 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:29 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:29 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:30 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:30 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:31 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:31 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:32 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:32 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:33 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:33 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:34 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:34 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:35 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:36 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:36 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:38 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:39 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:39 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:40 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:41 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:42 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:42 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:43 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:43 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:44 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. Quarantined 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:45 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:46 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:47 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:48 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:49 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:50 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:51 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:52 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:53 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:54 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:55 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:56 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:57 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:58 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:26:59 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:00 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:01 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:02 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:03 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:04 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:05 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:06 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:07 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:08 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:09 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:10 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:11 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 14:27:12 PM File infection: C:\WINDOWS\system32\cnhbyhpx.dll is Win32/Nisrest.I trojan. 2/19/2008 18:40:59 PM File infection: C:\WINDOWS\mrofinu1188.exe is Win32/VMalum.BWLZ infection. Quarantined 2/19/2008 19:03:29 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP393\A0088852.dll is Win32/Nisrest.I trojan. Deleted 2/22/2008 17:49:30 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP393\A0088887.exe is Win32/VMalum.BWLZ infection. Quarantined 2/22/2008 20:08:01 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:02 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:02 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:03 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:03 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:03 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:04 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:04 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:05 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:05 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:06 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:12 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:13 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. Deleted 2/22/2008 20:08:14 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:14 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:14 PM File infection: C:\WINDOWS\system32\eosfjsgl.dll is Win32/Vundo.OT trojan. 2/22/2008 20:08:17 PM File infection: C:\WINDOWS\SYSTEM32\XYLXTXXO.DLL is Win32/Vundo.OT trojan. Deleted 2/22/2008 20:08:18 PM File infection: C:\WINDOWS\SYSTEM32\YYPSQDHR.DLL is Win32/Vundo.OR trojan. Deleted 2/22/2008 20:44:29 PM File infection: C:\WINDOWS\SYSTEM32\RWFBKDTP.DLL is Win32/Vundo.PE trojan. Deleted 2/22/2008 20:44:29 PM File infection: C:\WINDOWS\SYSTEM32\RWFBKDTP.DLL is Win32/Vundo.PE trojan. 2/24/2008 23:14:35 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/24/2008 23:14:37 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/24/2008 23:14:37 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/24/2008 23:14:37 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/24/2008 23:14:38 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/24/2008 23:15:54 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:55 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:55 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:56 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:57 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:58 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:58 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/24/2008 23:15:59 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/24/2008 23:16:00 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/24/2008 23:16:00 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/24/2008 23:16:01 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/24/2008 23:16:01 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/24/2008 23:16:01 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/24/2008 23:16:03 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/24/2008 23:16:03 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/24/2008 23:16:04 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/24/2008 23:16:04 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/24/2008 23:16:05 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/24/2008 23:16:06 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/24/2008 23:16:07 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/25/2008 16:08:10 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/26/2008 7:57:06 AM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/26/2008 22:17:31 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP385\A0087822.exe is Win32/VMalum.BWLZ infection. 2/26/2008 22:18:52 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/26/2008 22:18:52 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088934.dll is Win32/Vundo.OT trojan. 2/26/2008 22:18:52 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088935.dll is Win32/Vundo.OR trojan. 2/26/2008 22:18:53 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088957.dll is Win32/Vundo.PE trojan. 2/27/2008 6:53:00 AM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/27/2008 21:42:37 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/28/2008 19:34:43 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/28/2008 21:26:59 PM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan. 2/29/2008 8:20:54 AM File infection: C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP395\A0088933.dll is Win32/Vundo.OT trojan.

Noviciate

Post #8March 1, 2008, 9:16 PM UTC

Copy and paste the following into Notepad (Start > All Programs > Accessories > Notepad):

File::
C:\WINDOWS\system32\cnhbyhpx.dll
C:\WINDOWS\system32\eosfjsgl.dll

Save it to your Desktop with the following filename: CFScript
Drag and drop CFScript.txt onto your copy of Combofix and let it do it's thing.
Let me have the log produced, as before, as well as a fresh HJT log and a description of how the PC is behaving now. Let me know if the AV is flagging anything else as well - it appears that the log you posted got cut short. You'll need to edit the log a bit, as a lot of what you posted is just repeats of the same file being detected.

fabulousdazaster1

Post #9March 4, 2008, 3:35 AM UTC

Hi Noviciate,

Here is the Combofix log and HJT log. I will run my AV and see if it finds anything new.

ComboFix 08-02-25.3 - The Emperor 2008-03-03 19:24:01.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.718 [GMT -8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\The Emperor\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\system32\cnhbyhpx.dll
C:\WINDOWS\system32\eosfjsgl.dll
.

((((((((((((((((((((((((( Files Created from 2008-02-04 to 2008-03-04 )))))))))))))))))))))))))))))))
.

2008-02-28 17:12 . 2008-02-28 17:12 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-02-28 17:12 . 2008-02-28 17:12 1,409 –a—— C:\WINDOWS\QTFont.for
2008-02-26 18:57 . 2008-02-26 18:57 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2008-02-26 18:57 . 2008-02-26 18:57 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-24 22:04 . 2008-02-24 22:04 322,656 ——— C:\WINDOWS\SYSTEM32\ssttu.dll_old
2008-02-24 17:11 . 2008-02-24 17:11 d——– C:\Program Files\Spybot - Search & Destroy
2008-02-22 20:43 . 2008-02-22 20:43 d——– C:\Program Files\Trend Micro
2008-02-16 20:43 . 2008-02-16 20:43 d——– C:\Program Files\Windows Defender
2008-02-16 20:15 . 2008-02-16 20:15 d——– C:\Program Files\Common Files\Scanner
2008-02-16 11:55 . 2008-02-16 11:55 33 –a—— C:\WINDOWS\SYSTEM32\7806c36e
2008-02-16 11:47 . 2008-02-24 21:19 d——– C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-16 11:46 . 2008-02-17 02:13 d–hs—- C:\WINDOWS\VGhlIEVtcGVyb3I
2008-02-16 11:44 . 2008-02-16 11:44 d——– C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-16 11:02 . 2008-02-16 11:04 d——– C:\Documents and Settings\The Emperor\.SunDownloadManager

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k7
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k6
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k5
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k4
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k3
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k2
2008-03-01 02:44 64 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k1
2008-03-01 02:44 118,762 —-a-w C:\WINDOWS\system32\drivers\kmxcfg.u2k0
2008-02-25 01:20 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-17 04:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\CA
2008-02-17 03:33 ——— d—–w C:\Program Files\Windows Media Connect 2
2008-01-11 05:53 44,544 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
2007-12-19 23:01 347,136 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
2007-12-18 09:51 179,584 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mrxdav.sys
2007-12-15 01:06 513,152 —-a-w C:\WINDOWS\SYSTEM32\SndTDriverV32.sys
2007-12-15 01:06 3,768 —-a-w C:\WINDOWS\SYSTEM32\MovRVDrv32.sys
2007-12-15 01:06 184,320 —-a-w C:\WINDOWS\SYSTEM32\snmvtsvc.exe
2007-12-15 01:06 10,552 —-a-w C:\WINDOWS\SYSTEM32\MovRVDrv32.dll
2007-12-08 18:51 3,592,192 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-12-07 00:44 474,112 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
2007-12-07 00:44 151,040 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
2007-12-07 00:44 1,499,136 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
2007-12-07 00:44 1,054,208 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
2007-12-07 00:44 1,024,000 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
2007-12-06 11:01 625,664 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\iexplore.exe
2007-12-06 11:00 70,656 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ie4uinit.exe
2007-12-06 11:00 13,824 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieudinit.exe
2007-12-06 04:59 161,792 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\ieakui.dll
2007-12-04 18:38 550,912 —-a-w C:\WINDOWS\SYSTEM32\oleaut32.dll
2007-12-04 18:38 550,912 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\oleaut32.dll
2007-06-17 17:56 60,968 —-a-w C:\Documents and Settings\The Emperor\GoToAssistDownloadHelper.exe
2005-03-03 21:20 164 —ha-w C:\Documents and Settings\All Users\hpothb07.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{53828D18-648B-4A44-BA58-A0E89291431F}]
C:\WINDOWS\system32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66007BCD-B77A-4C0D-AC74-1221202C389A}]
C:\WINDOWS\system32\gebyy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A0EB3E5-BD54-49CE-DE8F-69E12811CBB5}]
C:\Program Files\Outlook Express\rybil.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6c948d07-6064-4187-9fe2-2f2e3829e2a0}]
C:\WINDOWS\system32\eosfjsgl.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" [ ]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 22:25 177416]
"CAVRID"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe" [2007-08-20 12:42 230664]
"cafwc"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-02-19 13:40 1193224]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-02-19 13:40 173320]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-02-19 13:40 259336]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-01-28 11:43 5146448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"SpybotDeletingA543"="command /c del C:\WINDOWS\SYSTEM32\ssttu.dll_old" [ ]
"SpybotDeletingC9554"="cmd /c del C:\WINDOWS\SYSTEM32\ssttu.dll_old" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
UmxWnp.Dll 2007-05-18 13:30 79368 C:\WINDOWS\SYSTEM32\UmxWNP.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=C:\WINDOWS\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Program Neighborhood Agent.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Program Neighborhood Agent.lnk
backup=C:\WINDOWS\pss\Program Neighborhood Agent.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 7.0]
–a—— 2004-12-14 01:12 483328 C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
–a—— 2006-07-17 11:57 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WZCSVC"=2 (0x2)
"wuauserv"=2 (0x2)
"SharedAccess"=2 (0x2)
"Macromedia Licensing Service"=3 (0x3)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\MSMSGS.EXE"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2007-10-18 09:46]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2007-05-18 13:30]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2007-05-18 13:30]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2007-10-18 13:28]
R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 17:09]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2007-10-18 09:46]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2007-11-02 03:54]
R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 17:09]
R2 RVIEG01;VSC Engine;C:\Audio\Cakewalk\SONAR 1\Shared Dxi\Roland\RVIEg01.sys [2001-03-16 12:49]
R2 UmxAgent;HIPS Event Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe" [2007-10-04 08:23]
R2 UmxCfg;HIPS Configuration Interpreter;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe" [2007-10-18 08:39]
R2 UmxPol;HIPS Policy Manager;"C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe" [2007-05-18 13:30]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2007-09-12 11:02]
R3 L6DP;L6DP;C:\WINDOWS\system32\Drivers\l6dp.sys [2007-09-17 11:31]
R3 L6TPortA;Service - Line 6 TonePort UX1;C:\WINDOWS\system32\Drivers\L6TPortA.sys [2007-09-17 11:25]
R3 MovRVDrv32;MovRVDrv32;C:\WINDOWS\system32\DRIVERS\MovRVDrv32.sys [2007-12-14 17:06]
R3 PPCtlPriv;PPCtlPriv;"C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe" [2007-08-16 21:10]
R3 SndTDriverV32;SndTDriverV32;C:\WINDOWS\system32\drivers\SndTDriverV32.sys [2007-12-14 17:06]
S3 SoundMovieServer;SoundMovieServer;"C:\WINDOWS\system32\snmvtsvc.exe" [2007-12-14 17:06]
S3 UnlockerDriver4;UnlockerDriver4 Driver;C:\Program Files\Unlocker\UnlockerDriver4.sys [2005-07-25 05:31]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-17 05:15:50 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as The Emperor at 8 15 PM.job"
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe
"2008-03-03 18:07:37 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-03 19:28:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-03 19:31:02
ComboFix-quarantined-files.txt 2008-03-04 03:30:50
ComboFix2.txt 2008-02-29 04:25:55
.
2008-02-29 06:29:41 — E O F —

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:33:27 PM, on 3/3/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {53828D18-648B-4A44-BA58-A0E89291431F} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: (no name) - {66007BCD-B77A-4C0D-AC74-1221202C389A} - C:\WINDOWS\system32\gebyy.dll (file missing)
O2 - BHO: 0 - {6A0EB3E5-BD54-49CE-DE8F-69E12811CBB5} - C:\Program Files\Outlook Express\rybil.dll (file missing)
O2 - BHO: {0a2e9283-e2f2-2ef9-7814-460670d849c6} - {6c948d07-6064-4187-9fe2-2f2e3829e2a0} - C:\WINDOWS\system32\eosfjsgl.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autofix
O4 - HKLM\..\RunOnce: [SpybotDeletingA543] command /c del "C:\WINDOWS\SYSTEM32\ssttu.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9554] cmd /c del "C:\WINDOWS\SYSTEM32\ssttu.dll_old"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Rip YouTube File - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra 'Tools' menuitem: Rip YouTube file embedded in this page - {38E51477-DDB4-4aed-9D61-D0C193E10749} - C:\Program Files\SoundTaxi\YouTubeRipper.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.line6.net
O15 - Trusted Zone: http://www.musiciansfriend.com
O15 - Trusted Zone: http://citrix.prosum.com
O15 - Trusted Zone: http://www.socalmoving.com
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1124517799234
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?326
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: SoundMovieServer - SoundMovieServer - C:\WINDOWS\system32\snmvtsvc.exe
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 11152 bytes

Noviciate

Post #10March 4, 2008, 8:57 PM UTC

Let me know what, if anything, the AV flags up and i'll get back to you - let me know how the PC is performing in general as well.

fabulousdazaster1

Post #11March 6, 2008, 4:00 AM UTC

Hi Noviciate, Thanks for all the help. The computer and Internet Explore are running much better. The AV found the Vundo.QH virus and the Anti-Spyware found KaZaA and BiFrost. Here are the AV and Spyware logs. Started scanning at 3/5/2008 6:01:19 PM. Engine Ver: 31.1.0. Sig Ver:5588. Sig Date: 3/5/2008. ArcLib Ver: 7.3.0.9. C:\hiberfil.sys - Could not open the file. C:\pagefile.sys - Could not open the file. C:\Documents and Settings\All Users\Application Data\CA\Consumer\AV\ond4.tmp - Could not open the file. C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-02252008-183201.log - Could not open the file. C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-03-05_Log.ALUSchedulerSvc.LiveUpdate - Could not open the file. C:\Documents and Settings\LocalService\NTUSER.DAT - Could not open the file. C:\Documents and Settings\LocalService\ntuser.dat.LOG - Could not open the file. C:\Documents and Settings\LocalService\Cookies\INDEX.DAT - Could not open the file. C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file. C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file. C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT - Could not open the file. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT - Could not open the file. C:\Documents and Settings\NetworkService\NTUSER.DAT - Could not open the file. C:\Documents and Settings\NetworkService\ntuser.dat.LOG - Could not open the file. C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file. C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file. C:\Documents and Settings\The Emperor\ntuser.dat - Could not open the file. C:\Documents and Settings\The Emperor\ntuser.dat.LOG - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\cert8.db - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\history.dat - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\key3.db - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\parent.lock - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\search.sqlite - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\urlclassifier2.sqlite - Could not open the file. C:\Documents and Settings\The Emperor\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\GoogleToolbarData\googlesafebrowsing.db - Could not open the file. C:\Documents and Settings\The Emperor\Cookies\INDEX.DAT - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{291A3018-5168-4BC7-8BCD-74F68A0C6240} - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_001_ - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_002_ - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_003_ - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Application Data\Mozilla\Firefox\Profiles\v50cx1fg.default\Cache\_CACHE_MAP_ - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\History\History.IE5\INDEX.DAT - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\History\History.IE5\MSHist012008030520080306\index.dat - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF510E.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF5145.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF531D.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF55F8.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF6741.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DF85D9.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFAE68.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFC6BB.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFD50F.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temp\~DFEE56.tmp - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat - Could not open the file. C:\Documents and Settings\The Emperor\Local Settings\Temporary Internet Files\Content.IE5\index.dat - Could not open the file. C:\Program Files\CA\SharedComponents\PPRT\logs\2008-03-05.csv - Could not open the file. C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT - Could not open the file. C:\QooBox\Quarantine\catchme2008-02-28_202017.46.zip - Win32/Vundo.QH trojan. Quarantined. C:\WINDOWS\SchedLgU.Txt - Could not open the file. C:\WINDOWS\Sti_Trace.log - Could not open the file. C:\WINDOWS\WIADEBUG.LOG - Could not open the file. C:\WINDOWS\WIASERVC.LOG - Could not open the file. C:\WINDOWS\WindowsUpdate.log - Could not open the file. C:\WINDOWS\Debug\PASSWD.LOG - Could not open the file. C:\WINDOWS\SoftwareDistribution\ReportingEvents.log - Could not open the file. C:\WINDOWS\SYSTEM32\H323LOG.TXT - Could not open the file. C:\WINDOWS\SYSTEM32\CatRoot2\edb.log - Could not open the file. C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SAM - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SECURITY - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM - Could not open the file. C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG - Could not open the file. C:\WINDOWS\SYSTEM32\LogFiles\WUDF\WUDFTrace.etl - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA - Could not open the file. C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP - Could not open the file. C:\WINDOWS\Temp\TMP0000007CCE8F45CF0ADAF9A6 - Could not open the file. G:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP405\A0090361.ini - INI/Helpud.CL trojan. Deleted. Files Scanned: 425527 Files Infected: 2 Files Cleaned \ Deleted: 1 Files Quarantined: 1 Memory Infections: 0 Memory Infections Cleaned: 0 Boot Infections: 0 Boot Infections Cleaned: 0 Top infections found during scan (Limited to 10). INI/Helpud.CL Win32/Vundo.QH Files not Cleaned\Deleted\Quarantined (Limit 100): 0 Finished scanning at 3/5/2008 7:13:23 PM. …And here is the AntiSpyware log: 3/5/2008-7:54:29 PM , Detected , KaZaA , P2P , Key "hkey_users \S-1-5-21-747789747-3206723062-2325115949-1006\software\kazaa" , -1 3/5/2008-7:54:30 PM , Detected , Bifrost , Backdoor , Key "hkey_users \S-1-5-21-747789747-3206723062-2325115949-1006\software\wget" , -1 3/5/2008-7:54:31 PM , Detected , 2o7.net , Tracking Cookie , Cookie "the_emperor@2o7[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@2o7[1].txt" , 541797163 3/5/2008-7:54:31 PM , Detected , Advertising.com , Tracking Cookie , Cookie "the_emperor@advertising[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@advertising[1].txt" , 1812459115 3/5/2008-7:54:31 PM , Detected , AtlasDMT.com , Tracking Cookie , Cookie "the_emperor@atdmt[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@atdmt[2].txt" , 1953866871 3/5/2008-7:54:31 PM , Detected , quantserve.com , Tracking Cookie , Cookie "the_emperor@quantserve[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@quantserve[2].txt" , -1611924851 3/5/2008-7:54:31 PM , Detected , RealMedia.com , Tracking Cookie , Cookie "the_emperor@realmedia[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@realmedia[1].txt" , 659738503 3/5/2008-7:54:31 PM , Detected , washingtonpost.com , Tracking Cookie , Cookie "the_emperor@washingtonpost[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@washingtonpost[1].txt" , -820322062 3/5/2008-7:55:03 PM , Quarantined , KaZaA , P2P , Key "hkey_users \S-1-5-21-747789747-3206723062-2325115949-1006\software\kazaa" , -1 3/5/2008-7:55:04 PM , Quarantined , Bifrost , Backdoor , Key "hkey_users \S-1-5-21-747789747-3206723062-2325115949-1006\software\wget" , -1 3/5/2008-7:55:04 PM , Deleted , 2o7.net , Tracking Cookie , Cookie "the_emperor@2o7[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@2o7[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , 2o7.net , Tracking Cookie , Cookie "the_emperor@2o7[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@2o7[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , Advertising.com , Tracking Cookie , Cookie "the_emperor@advertising[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@advertising[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , Advertising.com , Tracking Cookie , Cookie "the_emperor@advertising[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@advertising[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , AtlasDMT.com , Tracking Cookie , Cookie "the_emperor@atdmt[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@atdmt[2].txt" , -1 3/5/2008-7:55:04 PM , Deleted , AtlasDMT.com , Tracking Cookie , Cookie "the_emperor@atdmt[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@atdmt[2].txt" , -1 3/5/2008-7:55:04 PM , Deleted , quantserve.com , Tracking Cookie , Cookie "the_emperor@quantserve[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@quantserve[2].txt" , -1 3/5/2008-7:55:04 PM , Deleted , quantserve.com , Tracking Cookie , Cookie "the_emperor@quantserve[2].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@quantserve[2].txt" , -1 3/5/2008-7:55:04 PM , Deleted , RealMedia.com , Tracking Cookie , Cookie "the_emperor@realmedia[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@realmedia[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , RealMedia.com , Tracking Cookie , Cookie "the_emperor@realmedia[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@realmedia[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , washingtonpost.com , Tracking Cookie , Cookie "the_emperor@washingtonpost[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@washingtonpost[1].txt" , -1 3/5/2008-7:55:04 PM , Deleted , washingtonpost.com , Tracking Cookie , Cookie "the_emperor@washingtonpost[1].txt" File "C:\Documents and Settings\The Emperor\cookies\the_emperor@washingtonpost[1].txt" , -1

Noviciate

Post #12March 6, 2008, 8:43 PM UTC

1) You will need to disable Windows Defender's real-time protection, if it is running, as it may interfere with the fix. To do this,
Open Windows Defender:

Go to "Tools" > "General Settings"
Scroll down to "Real-time protection options"
Uncheck "Turn on real-time protection (recommended)"
Click Save.

2) You will need to disable Spybot's Tea Timer function, if it is running, as it may interfere with this fix. - this is a two step process.
First step:

Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
If you have Version 1.4, Click on Exit Spybot S&D Resident

Second step, For Either Version :

Open Spybot S&D
Click Mode, choose Advanced Mode
Go To the bottom of the Vertical Panel on the Left, Click Tools
then, also in left panel, click Resident shows a red/white shield.
If your firewall raises a question, say OK
In the Resident protection status frame, Uncheck the box labelled Resident "Tea-Timer"(Protection of over-all system settings) active
OK any prompts.
Use File, Exit to terminate Spybot
Reboot your machine for the changes to take effect.

3) Run HijackThis as you did to generate a log, but this time click on 'Do a system scan only'.
Place a checkmark in the boxes to the left of the following entries, by clicking on them:

O2 - BHO: (no name) - {53828D18-648B-4A44-BA58-A0E89291431F} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: (no name) - {66007BCD-B77A-4C0D-AC74-1221202C389A} - C:\WINDOWS\system32\gebyy.dll (file missing)
O2 - BHO: 0 - {6A0EB3E5-BD54-49CE-DE8F-69E12811CBB5} - C:\Program Files\Outlook Express\rybil.dll (file missing)
O2 - BHO: {0a2e9283-e2f2-2ef9-7814-460670d849c6} - {6c948d07-6064-4187-9fe2-2f2e3829e2a0} - C:\WINDOWS\system32\eosfjsgl.dll (file missing)

O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u

CLOSE ALL OPEN WINDOWS AND BROWSERS - EXCEPT HJT and click on Fix checked

I want you to run your PC as normal for a few days and when you are happy that everything is fine, do the following:

Go to Start > Run, enter the following into the textbox and click OK: combofix /u
This will uninstall Combofix and do a little housework besides.

4) Create a new Restore Point - this will give a clean one should you need it in the future.
A tutorial for System Restore is available here.

The reason for waiting is that if removing the malware has caused a problem, which it occasionally does, you can put your PC back to how it was before the fix. This will re-install the malware, but an infected PC is better than an expensive paperweight!

Some bedtime reading: This is a very good tutorial about keeping your computer safe and secure on the internet.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help, I infected my computer

✨ Ask AI

Ask AI