What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] ff.exe, tavo.exe, cc.exe problems, malware related

47 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please help me remove some of these problems. When I start up my computer, sometimes a message will pop up and it will have a name call either taxo.eve or ff.exe or cc.exe any of these will show up both of them at the same or maybe one of them each time i start up my computer. In this message it was say that this address (0x00000 something) cannot be read and it will ask to terminate the program by pressing ok. Please help me remove this, thank you.

Logfile of HijackThis v1.99.1
Scan saved at 9:20:48 PM, on 3/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\avg75free_516a1225.exe
C:\Documents and Settings\Administrator\Desktop\avg75free_516a1225.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX1\avgsetup.exe
C:\HJT\HijackThis.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX2\avgsetup.exe
c:\program files\internet explorer\iexplore.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: TB Class - {0CB66BA8-5E1F-4963-93D1-E1D6B78FE9A2} - C:\Program Files\WinBudget\bin\matrix.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [tasa] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\taso.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [kava] C:\WINDOWS\system32\kavo.exe
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://n4.peel.edu.on.ca/qp2.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://s.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab50997.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
Post #2
Hello Siiic812 and welcome to the What the Tech Forums

My name is Trevuren and I will be helping you with your problem.


A. Please provide a list of uninstallable programs.

To Provide a List of Installed Programs
  • Run HijackThis.
  • Click Config>>Miscellaneous Tools>>Open Uninstall Manager>>Save List
  • Save list to Desktop
  • Copy the Notepad list and Paste it into this thread.


B. We need to disable one of your security programs so that it does not interfere with our tools:

AVG
Please open the AVG Control Center program -> double-click on the "AVG Resident Shield" component (looks like this: [external image: Posted Image]) -> deselect the "Turn on AVG Resident Shield" checkmark and save the setting.
When you need to enable the AVG Resident Shield, ( I’ll let you know when) just open the AVG Control Center program -> double-click on the "AVG Resident Shield" component -> select the "Turn on AVG Resident Shield" checkmark and save the setting.


C. Please download ComboFix by sUBs from HERE or HERE directly to your Desktop.

Note: If you already have ComboFix on your machine, please DELETE it from your desktop before downloading the newest version.

Go to [external image: Posted Image] -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

[external image: Posted Image]
  • ComboFix will automatically start. Any monitoring programs will be shut down like your antivirus, antispyware programs for example.
  • ComboFix may restart your computer, this is normal.
  • When finished, it will produce a log, ComboFix.txt.
  • Please post ComboFix.txt in your next reply along with a new HijackThis log.


Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #3
i did as you told me, but when it came to combofix, yes it did restart my computer but in the end, there was no combofix log on my desktop, everything else went fine
Post #4
1. Please look here C:\ComboFix.txt

2. If you find it, please copy/paste it in your reply along with a new HijackThis log
Post #5
Here are the new combo and hijackthis log.

ComboFix.txt

ComboFix 08-03-01.3 - Administrator 2008-03-02 0:46:48.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.257 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\desktop\combofix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\Documents and Settings\Administrator\Application Data\Install.dat
C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\carp**.1167286535.old
C:\Program Files\WinBudget\bin\carp**.1167574782.old
C:\Program Files\WinBudget\bin\carp**.1167833198.old
C:\Program Files\WinBudget\bin\carp**.1168095120.old
C:\Program Files\WinBudget\bin\carp**.1168382413.old
C:\Program Files\WinBudget\bin\carp**.1168988352.old
C:\Program Files\WinBudget\bin\carp**.1187054529.old
C:\Program Files\WinBudget\bin\carp**.1189338492.old
C:\Program Files\WinBudget\bin\matrix.dll
C:\Program Files\WinBudget\bin\matrix.dll.1167574782.old
C:\Program Files\WinBudget\bin\matrix.dll.1167833197.old
C:\Program Files\WinBudget\bin\matrix.dll.1168095119.old
C:\Program Files\WinBudget\bin\matrix.dll.1168382413.old
C:\Program Files\WinBudget\bin\matrix.dll.1168988351.old
C:\Program Files\WinBudget\bin\matrix.dll.1187054525.old
C:\Program Files\WinBudget\bin\matrix.dll.1189338489.old
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\kavo0.dll
C:\WINDOWS\system32\kavo1.dll
C:\WINDOWS\taskmgr.exe

.
((((((((((((((((((((((((( Files Created from 2008-02-02 to 2008-03-02 )))))))))))))))))))))))))))))))
.

2008-03-01 23:10 . 2008-03-01 23:10 117,740 -r-hs—- C:\cfv90h.com
2008-03-01 23:05 . 2008-03-01 23:05 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-01 23:01 . 2004-08-04 00:56 388,608 –a—— C:\CF20248.exe
2008-03-01 21:01 . 2008-03-02 00:51 81,408 -r-hs—- C:\WINDOWS\system32\tavo0.dll
2008-03-01 08:11 . 2006-11-29 13:06 3,426,072 –a—— C:\WINDOWS\system32\d3dx9_32.dll
2008-03-01 08:09 . 2008-03-01 08:09 d——– C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-01 08:06 . 2008-03-01 08:07 d——– C:\Program Files\Windows Live Toolbar
2008-03-01 08:06 . 2008-03-01 08:06 d——– C:\Program Files\Windows Live Favorites
2008-03-01 07:41 . 2008-03-01 07:52 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-24 22:53 . 2008-02-26 22:03 d——– C:\Program Files\PartyGaming.Net
2008-02-24 20:00 . 2008-02-24 22:52 d——– C:\Program Files\PokerStars
2008-02-21 21:48 . 2008-02-21 21:48 24 –a—— C:\WINDOWS\mhrebook.ini
2008-02-21 21:47 . 2008-02-21 21:47 d——– C:\WINDOWS\Profiles
2008-02-15 13:48 . 2008-02-15 13:48 96,768 -r-hs—- C:\WINDOWS\system32\kavo2.dll
2008-02-09 18:49 . 2008-02-09 18:55 94,208 –a—— C:\WINDOWS\ScUnin.exe
2008-02-09 18:49 . 2008-02-09 18:55 35,382 –a—— C:\WINDOWS\scunin.dat
2008-02-09 18:49 . 2008-02-09 18:55 967 –a—— C:\WINDOWS\ScUnin.pif
2008-02-03 15:55 . 2008-02-03 15:55 d——– C:\Program Files\Common Files\INCA Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 04:25 ——— d—–w C:\Program Files\Starcraft
2008-03-02 04:04 ——— d—–w C:\Program Files\Windows Live
2008-03-02 03:50 ——— d—–w C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-02 02:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-03-02 01:22 90,112 —-a-w C:\WINDOWS\DUMPbac4.tmp
2008-03-01 12:43 ——— d—–w C:\Program Files\MSN Messenger
2008-03-01 12:41 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-22 05:11 ——— d—–w C:\Program Files\iTunes
2008-02-22 05:10 ——— d—–w C:\Program Files\iPod
2008-02-22 05:08 ——— d—–w C:\Program Files\QuickTime
2008-02-22 02:47 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-09 23:59 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Hamachi
2008-02-01 16:11 586,240 —-a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-20 03:29 ——— d—–w C:\Program Files\Messenger Plus! Live
2008-01-19 15:35 3,532 —-a-w C:\drmHeader.bin
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 185,784 2006-10-07 14:43:36 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 163,576 2006-10-17 03:55:41 C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\bak\GoogleToolbarNotifier.exe

—-a-w 6,266,880 2006-10-07 12:20:00 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe

—-a-w 406,016 2006-11-25 15:24:45 C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe

—-a-w 278,528 2006-02-23 19:45:20 C:\Program Files\iTunes\bak\iTunesHelper.exe
—-a-w 267,048 2008-02-19 18:10:32 C:\Program Files\iTunes\iTunesHelper.exe

—-a-w 49,263 2006-10-12 08:10:54 C:\Program Files\Java\jre1.5.0_09\bin\bak\jusched.exe
—-a-w 69,632 2006-12-13 01:43:55 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

—-a-w 155,648 2006-10-06 01:40:45 C:\Program Files\QuickTime\bak\qttask.exe
—-a-w 385,024 2008-02-01 04:13:08 C:\Program Files\QuickTime\QTTask.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"Update Manager"="C:\Program Files\Rogers\Update Manager\UpdateManager.exe" [2004-06-29 14:01 131072]
"tava"="C:\WINDOWS\system32\tavo.exe" [2008-03-01 23:10 112496]
"kava"="C:\WINDOWS\system32\kavo.exe" [2008-03-02 00:52 117740]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-01 21:28 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 15:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 15:37 2178832]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-01 21:26 219136]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\ijji\\ENGLISH\\Gunbound Revolution\\GunBound.gme"=
"C:\\ijji\\ENGLISH\\u_gbound.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"9707:TCP"= 9707:TCP:BitComet 9707 TCP
"9707:UDP"= 9707:UDP:BitComet 9707 UDP

R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 11:12]
S3 sejt1;sejt1;C:\Documents and Settings\Administrator\Desktop\AkumaEngine33\sejt.sys []
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]
S3 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\system32\DRIVERS\ATINTTXX.sys [2005-02-01 13:36]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{276e65e2-08aa-11dc-9bc5-00a0cc7b40f5}]
\Shell\AutoRun\command - D:\copetttt.com
\Shell\explore\Command - D:\copetttt.com
\Shell\open\Command - D:\copetttt.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{375d6d3a-9d20-11dc-9d96-00a0cc7b40f5}]
\Shell\AutoRun\command - D:\ntdelect.com
\Shell\explore\Command - D:\ntdelect.com
\Shell\open\Command - D:\ntdelect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{952692d0-bcc3-11dc-9dfb-00a0cc7b40f5}]
\Shell\AutoRun\command - D:\ay8p6v3.cmd
\Shell\explore\Command - D:\ay8p6v3.cmd
\Shell\open\Command - D:\ay8p6v3.cmd

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8d124d8-6f9a-11dc-9cfd-00a0cc7b40f5}]
\Shell\AutoRun\command - E:\SETUP.EXE

*Newly Created Service* - DERTYHJUISHWKY
.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 15:15:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 05:44:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 00:51:58
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Completion time: 2008-03-02 0:59:18 - machine was rebooted [Administrator]
ComboFix-quarantined-files.txt 2008-03-02 05:59:14
.
2008-03-02 04:06:07 — E O F —


HijackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 01:01, on 2008-03-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - HKCU\..\Run: [tava] C:\WINDOWS\system32\tavo.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://n4.peel.edu.on.ca/qp2.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://s.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab50997.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O20 - AppInit_DLLs:
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
Post #6
Your system is infected with a file infector. This trojan replaces legitimate executables with infected copies. The good news is that we can reverse the process. First we must cleanup your system of as much bad stuff as Possible.


A. There is a file in your log of which I am unsure. For that reason, I need you to submit it to Jotti's for analysis.

1. Click HERE to get to Jotti's site.

2. At the top of the Jotti window, use the Browse button to locate the following file on your system:

C:\drmHeader.bin

3. Once you have located the file, click SUBMIT and the content of the file will be uploaded by the site and analysed.

4. Please provide me with the results of the analysis.


B. Now using the Add/Remove feature in your Control Panel, I need you to uninstall the following programs that often come bundled with malware:

PartyGaming.Net
PokerStars

C. Make sure that your security program is disabled once more.


D. 1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::

File::
C:\cfv90h.com
C:\CF20248.exe
C:\WINDOWS\system32\tavo0.dll
C:\WINDOWS\mhrebook.ini
C:\WINDOWS\system32\kavo2.dll
C:\WINDOWS\DUMPbac4.tmp
D:\copetttt.com
D:\ntdelect.com
D:\ay8p6v3.cmd
E:\SETUP.EXE

Folder::
C:\Program Files\PartyGaming.Net
C:\Program Files\PokerStars

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"tava"=-
"kava"=-
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{276e65e2-08aa-11dc-9bc5-00a0cc7b40f5}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f8d124d8-6f9a-11dc-9cfd-00a0cc7b40f5}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{952692d0-bcc3-11dc-9dfb-00a0cc7b40f5}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{375d6d3a-9d20-11dc-9d96-00a0cc7b40f5}]
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. All your monitoring programs (Antivirus/Antispyware, Guards and Shields) will be stopped.

[external image: Posted Image]

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

6. ComboFix will automatically REBOOT your machine when the KillAll:: switch is used..

7. Post the following logs/Reports:
  • ComboFix.txt
  • Fresh HijackThis log run after all the other tools have performed their cleanup.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #7
Thank you for helping me again! Here are the results.

Scanner Results:

Scanner results
Scan taken on 02 Mar 2008 12:47:02 (GMT) A-Squared
Found nothing
AntiVir
Found nothing
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found nothing
Fortinet
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found nothing
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found nothing
VirusBuster
Found nothing
VBA32
Found nothing

combofix.txt log:
ComboFix 08-03-01.3 - Administrator 2008-03-02 7:52:06.2 - NTFSx86

Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\CF20248.exe
C:\cfv90h.com
C:\WINDOWS\DUMPbac4.tmp
C:\WINDOWS\mhrebook.ini
C:\WINDOWS\system32\kavo2.dll
C:\WINDOWS\system32\tavo0.dll
D:\ay8p6v3.cmd
D:\copetttt.com
D:\ntdelect.com
E:\SETUP.EXE
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Autorun.inf
C:\CF20248.exe
C:\cfv90h.com
C:\Program Files\PartyGaming.Net
C:\Program Files\PartyGaming.Net\announce.txt
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\16993.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\67246.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\67248.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\67250.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\69627.atc
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\69629.atc
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\7.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Language\en_US\articles\9.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Notes.txt
C:\Program Files\PartyGaming.Net\PartyPokerNet\pf_freedomgw_c-o-i.txt
C:\Program Files\PartyGaming.Net\PartyPokerNet\TourneyDescription.html
C:\Program Files\PartyGaming.Net\PartyPokerNet\Uninstall.exe
C:\Program Files\PartyGaming.Net\PartyPokerNet\usertab.txt
C:\Program Files\PokerStars
C:\Program Files\PokerStars\notes.txt
C:\Program Files\PokerStars\user.ini
C:\WINDOWS\DUMPbac4.tmp
C:\WINDOWS\mhrebook.ini
C:\WINDOWS\system32\kavo.exe
C:\WINDOWS\system32\kavo0.dll
C:\WINDOWS\system32\kavo2.dll
C:\WINDOWS\system32\tavo0.dll

.
((((((((((((((((((((((((( Files Created from 2008-02-02 to 2008-03-02 )))))))))))))))))))))))))))))))
.

2008-03-02 07:35 . 2007-07-30 19:19 271,224 –a—— C:\WINDOWS\system32\mucltui.dll
2008-03-02 07:35 . 2007-07-30 19:19 207,736 –a—— C:\WINDOWS\system32\muweb.dll
2008-03-02 07:35 . 2007-07-30 19:19 30,072 –a—— C:\WINDOWS\system32\mucltui.dll.mui
2008-03-01 23:05 . 2008-03-01 23:05 d——– C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-03-01 08:11 . 2006-11-29 13:06 3,426,072 –a—— C:\WINDOWS\system32\d3dx9_32.dll
2008-03-01 08:09 . 2008-03-01 08:09 d——– C:\Program Files\Microsoft SQL Server Compact Edition
2008-03-01 08:06 . 2008-03-01 08:07 d——– C:\Program Files\Windows Live Toolbar
2008-03-01 08:06 . 2008-03-01 08:06 d——– C:\Program Files\Windows Live Favorites
2008-03-01 07:41 . 2008-03-01 07:52 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-02-21 21:47 . 2008-02-21 21:47 d——– C:\WINDOWS\Profiles
2008-02-09 18:49 . 2008-02-09 18:55 94,208 –a—— C:\WINDOWS\ScUnin.exe
2008-02-09 18:49 . 2008-02-09 18:55 35,382 –a—— C:\WINDOWS\scunin.dat
2008-02-09 18:49 . 2008-02-09 18:55 967 –a—— C:\WINDOWS\ScUnin.pif
2008-02-03 15:55 . 2008-02-03 15:55 d——– C:\Program Files\Common Files\INCA Shared

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-02 04:25 ——— d—–w C:\Program Files\Starcraft
2008-03-02 04:04 ——— d—–w C:\Program Files\Windows Live
2008-03-02 03:50 ——— d—–w C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-02 02:27 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-03-01 12:43 ——— d—–w C:\Program Files\MSN Messenger
2008-03-01 12:41 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-02-22 05:11 ——— d—–w C:\Program Files\iTunes
2008-02-22 05:10 ——— d—–w C:\Program Files\iPod
2008-02-22 05:08 ——— d—–w C:\Program Files\QuickTime
2008-02-22 02:47 ——— d—–w C:\Program Files\Common Files\Adobe
2008-02-09 23:59 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Hamachi
2008-02-01 16:11 586,240 —-a-w C:\WINDOWS\WLXPGSS.SCR
2008-01-20 03:29 ——— d—–w C:\Program Files\Messenger Plus! Live
2008-01-19 15:35 3,532 —-a-w C:\drmHeader.bin
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
—-a-w 185,784 2006-10-07 14:43:36 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

—-a-w 163,576 2006-10-17 03:55:41 C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\bak\GoogleToolbarNotifier.exe

—-a-w 6,266,880 2006-10-07 12:20:00 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe

—-a-w 406,016 2006-11-25 15:24:45 C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe

—-a-w 278,528 2006-02-23 19:45:20 C:\Program Files\iTunes\bak\iTunesHelper.exe
—-a-w 267,048 2008-02-19 18:10:32 C:\Program Files\iTunes\iTunesHelper.exe

—-a-w 49,263 2006-10-12 08:10:54 C:\Program Files\Java\jre1.5.0_09\bin\bak\jusched.exe
—-a-w 69,632 2006-12-13 01:43:55 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

—-a-w 155,648 2006-10-06 01:40:45 C:\Program Files\QuickTime\bak\qttask.exe
—-a-w 385,024 2008-02-01 04:13:08 C:\Program Files\QuickTime\QTTask.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"Update Manager"="C:\Program Files\Rogers\Update Manager\UpdateManager.exe" [2004-06-29 14:01 131072]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-01 21:28 579072]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50 155648]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 15:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 15:37 2178832]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-01 21:26 219136]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\mIRC\\mirc.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\ijji\\ENGLISH\\Gunbound Revolution\\GunBound.gme"=
"C:\\ijji\\ENGLISH\\u_gbound.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
"9707:TCP"= 9707:TCP:BitComet 9707 TCP
"9707:UDP"= 9707:UDP:BitComet 9707 UDP

R3 FA312;NETGEAR FA330/FA312/FA311 Fast Ethernet Adapter Driver;C:\WINDOWS\system32\DRIVERS\FA312nd5.sys [2001-08-17 11:12]
S3 sejt1;sejt1;C:\Documents and Settings\Administrator\Desktop\AkumaEngine33\sejt.sys []
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]
S3 TTDec;ATI WDM Teletext Decoder;C:\WINDOWS\system32\DRIVERS\ATINTTXX.sys [2005-02-01 13:36]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 15:15:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-02 12:44:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-02 07:57:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
.
**************************************************************************
.
Completion time: 2008-03-02 8:02:06 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-02 13:01:56
ComboFix2.txt 2008-03-02 05:59:19
.
2008-03-02 04:06:07 — E O F —

HijackThis Log:
Logfile of HijackThis v1.99.1
Scan saved at 08:05, on 2008-03-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVG7\avgw.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\HJT\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Update Manager] "C:\Program Files\Rogers\Update Manager\UpdateManager.exe" /background
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D96F71-87C6-11D3-9BE4-00902742D6E0} (QuickPlace Class) - http://n4.peel.edu.on.ca/qp2.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab31267.cab
O16 - DPF: {2931566C-B8A6-46C5-BF4D-E6AB9251E953} (Nexon Package Manager Control) - http://s.nx.com/activex/public_new/nxpm.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownlo…Plugin11USA.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab50997.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownlo…GPlugin9USA.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS…er.cab56986.cab
O16 - DPF: {F6BF0D00-0B2A-4A75-BF7B-F385591623AF} (Solitaire Showdown Class) - http://messenger.zone.msn.com/binary/Solit…wn.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WINDOW~4\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
Post #8
Excellent work, my friend :thumbup: Now let us tackle the file infector part:

Please download FindAWF to your Desktop.
  • Double-click FindAWF.exe to start the tool.
  • Select option #1 - Scan for bak folders by typing 1 and press 'Enter'
  • When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.
**Do not run any other option unless directed to do so.**
Post #9
:)! Here is the report requested Find AWF report by noahdfear ©2006 Version 1.40 The current date is: 2008-03-02 The current time is: 13:17:18.35 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 2006-02-23 14:45 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 2006-10-05 20:40 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\GRISOFT\AVGFRE~1\BAK 2006-11-25 10:24 406,016 avgcc.exe 1 File(s) 406,016 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 2006-10-07 07:20 6,266,880 avgas.exe 1 File(s) 6,266,880 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 2006-10-07 09:43 185,784 realsched.exe 1 File(s) 185,784 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\12908~1.500\BAK 2006-10-16 22:55 163,576 GoogleToolbarNotifier.exe 1 File(s) 163,576 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 2006-10-12 03:10 49,263 jusched.exe 1 File(s) 49,263 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 267048 Feb 19 2008 "C:\Program Files\iTunes\iTunesHelper.exe" 54330664 Dec 8 2007 "C:\Documents and Settings\Administrator\My Documents\iTunes75Setup.exe" 278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Feb 22 2008 "C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe" 75048 Feb 22 2008 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.1.9\iTunesSetupAdmin.exe" 385024 Jan 31 2008 "C:\Program Files\QuickTime\QTTask.exe" 155648 Oct 5 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 579072 Mar 1 2008 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 406016 Nov 25 2006 "C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe" 6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 185784 Oct 7 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 583696 Oct 7 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 163576 Oct 16 2006 "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\bak\GoogleToolbarNotifier.exe" 69632 Dec 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\bak\jusched.exe" end of report
Post #10
Don't hurry, I will be offline for a couple of hours.

Double-click FindAWF.exe to start the tool.
  • Select option #2 - Restore files from bak folders by typing 2 and press 'Enter'
  • A text file will open up. Please copy/paste the content of the following codebox into the text file:

    C:\PROGRA~1\ITUNES\BAK\iTunesHelper.exe
C:\PROGRA~1\QUICKT~1\BAK\qttask.exe
C:\PROGRA~1\GRISOFT\AVGFRE~1\BAK\avgcc.exe
C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK\avgas.exe
C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK\realsched.exe
C:\PROGRA~1\GOOGLE\GOOGLE~1\12908~1.500\BAK\GoogleToolbarNotifier.exe
C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK\jusched.exe
  • Close the .txt file and click 'Yes' to save the changes.
  • When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.
Post #11
thank you for helping again ^_^. here is the report requested. Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: 2008-03-02 The current time is: 14:53:54.07 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 2006-02-23 14:45 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 2006-10-05 20:40 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\GRISOFT\AVGFRE~1\BAK 2006-11-25 10:24 406,016 avgcc.exe 1 File(s) 406,016 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 2006-10-07 07:20 6,266,880 avgas.exe 1 File(s) 6,266,880 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 2006-10-07 09:43 185,784 realsched.exe 1 File(s) 185,784 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\12908~1.500\BAK 2006-10-16 22:55 163,576 GoogleToolbarNotifier.exe 1 File(s) 163,576 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 2006-10-12 03:10 49,263 jusched.exe 1 File(s) 49,263 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 278528 Feb 23 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 54330664 Dec 8 2007 "C:\Documents and Settings\Administrator\My Documents\iTunes75Setup.exe" 278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Feb 22 2008 "C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe" 75048 Feb 22 2008 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.1.9\iTunesSetupAdmin.exe" 155648 Oct 5 2006 "C:\Program Files\QuickTime\qttask.exe" 155648 Oct 5 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 406016 Nov 25 2006 "C:\Program Files\Grisoft\AVG Free\avgcc.exe" 579072 Mar 1 2008 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 406016 Nov 25 2006 "C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe" 6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" 6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 185784 Oct 7 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 185784 Oct 7 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 583696 Oct 7 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 163576 Oct 16 2006 "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" 163576 Oct 16 2006 "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\bak\GoogleToolbarNotifier.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\bak\jusched.exe" end of report
Post #12
I made a slight mistake in the code that I gave you to use in the previous operation. Nothing serious. Pleae repeat the operation following directions and amended code:

Double-click FindAWF.exe to start the tool.
  • Select option #2 - Restore files from bak folders by typing 2 and press 'Enter'
  • A text file will open up. Please copy/paste the content of the following codebox into the text file:

    "C:\PROGRAM FILES\ITUNES\BAK\iTunesHelper.exe"
"C:\PROGRAM FILES\QUICKTIME\BAK\qttask.exe"
"C:\PROGRAM FILES\GRISOFT\AVG FREE\BAK\avgcc.exe"
"C:\PROGRAM FILES\GRISOFT\AVG Anti-Spyware 7.5\BAK\avgas.exe"
"C:\PROGRAM FILES\COMMON~1\REAL\UPDATE~1\BAK\realsched.exe"
"C:\PROGRAM FILES\GOOGLE\GoogleToolbarNotifier\1.2.908.5008\BAK\GoogleToolbarNotifier.exe"
"C:\PROGRAM FILES\JAVA\jre1.5.0_09\BIN\BAK\jusched.exe"
  • Close the .txt file and click 'Yes' to save the changes.
  • When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.
Post #13
Find AWF report by noahdfear ©2006 Version 1.40 Option 2 run successfully The current date is: 2008-03-02 The current time is: 20:08:05.31 bak folders found ~~~~~~~~~~~ Directory of C:\PROGRA~1\ITUNES\BAK 2006-02-23 14:45 278,528 iTunesHelper.exe 1 File(s) 278,528 bytes Directory of C:\PROGRA~1\MSNMES~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 2006-10-05 20:40 155,648 qttask.exe 1 File(s) 155,648 bytes Directory of C:\PROGRA~1\GRISOFT\AVGFRE~1\BAK 2006-11-25 10:24 406,016 avgcc.exe 1 File(s) 406,016 bytes Directory of C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK 2006-10-07 07:20 6,266,880 avgas.exe 1 File(s) 6,266,880 bytes Directory of C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK 2006-10-07 09:43 185,784 realsched.exe 1 File(s) 185,784 bytes Directory of C:\PROGRA~1\GOOGLE\GOOGLE~1\12908~1.500\BAK 2006-10-16 22:55 163,576 GoogleToolbarNotifier.exe 1 File(s) 163,576 bytes Directory of C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK 2006-10-12 03:10 49,263 jusched.exe 1 File(s) 49,263 bytes Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ 278528 Feb 23 2006 "C:\Program Files\iTunes\iTunesHelper.exe" 54330664 Dec 8 2007 "C:\Documents and Settings\Administrator\My Documents\iTunes75Setup.exe" 278528 Feb 23 2006 "C:\Program Files\iTunes\bak\iTunesHelper.exe" 102400 Feb 22 2008 "C:\WINDOWS\Installer\{80FD852F-5AAC-4129-B931-06AAFFA43138}\iTunesIco.exe" 75048 Feb 22 2008 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.6.1.9\iTunesSetupAdmin.exe" 155648 Oct 5 2006 "C:\Program Files\QuickTime\qttask.exe" 155648 Oct 5 2006 "C:\Program Files\QuickTime\bak\qttask.exe" 406016 Nov 25 2006 "C:\Program Files\Grisoft\AVG Free\avgcc.exe" 579072 Mar 1 2008 "C:\Program Files\Grisoft\AVG7\avgcc.exe" 406016 Nov 25 2006 "C:\Program Files\Grisoft\AVG Free\bak\avgcc.exe" 6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" 6266880 Oct 7 2006 "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe" 185784 Oct 7 2006 "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" 185784 Oct 7 2006 "C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe" 583696 Oct 7 2006 "C:\Program Files\Common Files\Real\GToolbar\GoogleToolbarInstaller.exe" 163576 Oct 16 2006 "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe" 163576 Oct 16 2006 "C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\bak\GoogleToolbarNotifier.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" 49263 Oct 12 2006 "C:\Program Files\Java\jre1.5.0_09\bin\bak\jusched.exe" end of report
Post #14
Double-click FindAWF.exe to start the tool.
  • Select option #3 - Remove bak folders by typing e and press 'Enter'
  • A text file will open up. Please copy/paste the content of the following codebox into the text file:

    C:\PROGRA~1\ITUNES\BAK
C:\PROGRA~1\MSNMES~1\BAK
C:\PROGRA~1\QUICKT~1\BAK
C:\PROGRA~1\GRISOFT\AVGFRE~1\BAK
C:\PROGRA~1\GRISOFT\AVGANT~1.5\BAK
C:\PROGRA~1\COMMON~1\REAL\UPDATE~1\BAK
C:\PROGRA~1\GOOGLE\GOOGLE~1\12908~1.500\BAK
C:\PROGRA~1\JAVA\JRE15~1.0_0\BIN\BAK
  • Close the .txt file and click 'Yes' to save the changes.
  • When the tool has completed, a report will open up in notepad. Please post the results of the awf.txt here.
Post #15
Find AWF report by noahdfear ©2006 Version 1.40 Option 3 run successfully The current date is: 2008-03-02 The current time is: 21:33:33.54 bak folders found ~~~~~~~~~~~ Duplicate files of bak directory contents ~~~~~~~~~~~~~~~~~~~~~~~ end of report

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI