ComboFix 08-04-20.5 - Gregg 2008-04-23 21:31:28.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.288 [GMT -4:00]
Running from: C:\Documents and Settings\Gregg\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Gregg\Desktop\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\Documents and Settings\Gregg\lsass.exe
C:\WINDOWS\BMb3599538.xml
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\rjsxcguh.ini
C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\uninstall_nmon.vbs
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Gregg\lsass.exe
C:\temp\berDrv11
C:\temp\berDrv11\fxpNbu.log
C:\temp\pt8q3khslw
C:\WINDOWS\BMb3599538.xml
C:\WINDOWS\R3JlZ2c
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\iTmp
C:\WINDOWS\system32\rjsxcguh.ini
C:\WINDOWS\system32\slNew
C:\WINDOWS\system32\slNew\gpedire1.exe
C:\WINDOWS\system32\trcTMP
C:\WINDOWS\system32\vbzip10.dll
C:\WINDOWS\system32\xcsDd18
C:\WINDOWS\system32\xcsDd18\xcsDd182328.exe
C:\WINDOWS\uninstall_nmon.vbs
.
((((((((((((((((((((((((( Files Created from 2008-03-24 to 2008-04-24 )))))))))))))))))))))))))))))))
.
2008-04-22 18:24 . 2008-04-22 18:23 267,592 --a------ C:\Program Files\Uninstall Ask Toolbar.dll
2008-04-22 18:23 . 2008-04-23 21:30 <DIR> d-a------ C:\Program Files\AskSBar
2008-04-22 12:36 . 2008-04-22 12:36 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-21 18:59 . 2008-04-21 18:59 <DIR> d-------- C:\Program Files\Lavasoft
2008-04-21 18:59 . 2008-04-21 19:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-21 03:22 . 2008-04-21 03:22 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-04-19 13:48 . 2008-04-19 13:50 <DIR> d-------- C:\Program Files\QuickTime
2008-04-19 13:48 . 2008-04-19 13:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-04-18 12:50 . 2008-04-18 12:50 <DIR> d-------- C:\Program Files\Common Files\cdrdao
2008-04-13 17:42 . 2008-04-13 17:42 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-04-13 17:29 . 2008-04-23 21:31 <DIR> d-------- C:\temp
2008-04-13 17:29 . 2008-04-13 17:36 1,609,728 --a------ C:\WINDOWS\MEDB.mdb
2008-04-13 17:29 . 2007-05-01 18:23 528,384 --a------ C:\WINDOWS\system32\VZWDownManager.exe
2008-04-13 17:29 . 2007-05-01 18:23 49,152 --a------ C:\WINDOWS\system32\VZWDLManager.dll
2008-04-13 17:29 . 2007-05-02 04:34 375 --a------ C:\WINDOWS\system32\VZWDLManager.inf
2008-04-13 17:28 . 2008-04-13 17:28 <DIR> d-------- C:\Program Files\Verizon Wireless
2008-04-13 16:27 . 2008-04-13 16:27 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-04-13 16:27 . 2008-04-13 16:27 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motport_01005.Wdf
2008-04-13 16:27 . 2008-04-13 16:27 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-04-13 16:27 . 2008-04-13 16:27 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgpfl_01005.Wdf
2008-04-13 16:27 . 2008-04-13 16:27 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motccgp_01005.Wdf
2008-04-09 14:53 . 2008-04-09 14:53 16,746 --a------ C:\WINDOWS\DeIsL2.isu
2008-04-07 02:32 . 2008-04-07 02:32 <DIR> d-------- C:\Program Files\Hasbro
2008-04-07 02:32 . 1995-11-16 23:52 423,424 --a------ C:\WINDOWS\system32\rwdx6d20.dll
2008-04-07 02:32 . 1995-11-17 00:05 339,968 --a------ C:\WINDOWS\system32\rwdx8d20.dll
2008-04-07 02:32 . 1996-03-04 15:27 331,776 --a------ C:\WINDOWS\system32\rwx20.dll
2008-04-07 02:32 . 2008-04-07 02:32 17,112 --a------ C:\WINDOWS\DeIsL1.isu
2008-04-07 02:32 . 2008-04-23 03:16 1,416 --a------ C:\WINDOWS\yahtzee.ini
2008-04-07 02:31 . 1996-01-09 06:38 283,648 --a------ C:\WINDOWS\uninst.exe
2008-04-06 17:35 . 2008-04-06 17:35 <DIR> d-------- C:\Program Files\DNA
2008-04-06 17:35 . 2008-04-06 17:35 <DIR> d-------- C:\Program Files\BitTorrent
2008-04-06 17:35 . 2008-04-23 21:25 <DIR> d-------- C:\Documents and Settings\Gregg\Application Data\DNA
2008-04-06 17:35 . 2008-04-07 22:30 <DIR> d-------- C:\Documents and Settings\Gregg\Application Data\BitTorrent
2008-04-06 17:11 . 2008-04-06 23:12 <DIR> d-------- C:\Documents and Settings\Gregg\Application Data\Azureus
2008-04-06 17:11 . 2008-04-06 17:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-04-06 17:08 . 2008-04-06 17:08 <DIR> d-------- C:\Program Files\Azureus
2008-04-04 14:31 . 2008-04-04 14:31 <DIR> d-------- C:\Faxes
2008-03-28 23:37 . 2008-03-28 23:37 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-03-28 23:37 . 2008-03-28 23:37 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-03-28 10:00 . 2008-03-29 13:36 <DIR> d-------- C:\Documents and Settings\Gregg\Application Data\Yahoo!
2008-03-28 09:29 . 2008-03-29 13:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo!
2008-03-28 09:28 . 2008-03-29 13:36 <DIR> d-------- C:\Program Files\Yahoo!
2008-03-27 10:26 . 2008-03-27 10:26 30,312 --a------ C:\Documents and Settings\Gregg\Application Data\GDIPFONTCACHEV1.DAT
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-22 22:23 --------- d-----w C:\Program Files\FrostWire
2008-04-21 22:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-21 07:28 --------- d-----w C:\Documents and Settings\Gregg\Application Data\FrostWire
2008-04-18 16:49 --------- d-----w C:\Program Files\Doblon
2008-03-21 16:10 --------- d-----w C:\Program Files\mp3oholic
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 05:50 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-18 05:49 --------- d-----w C:\Documents and Settings\Gregg\Application Data\AT&T
2008-03-18 05:48 --------- d-----w C:\Documents and Settings\NetworkService\Application Data\Bytemobile
2008-03-18 05:13 --------- d-----w C:\Program Files\Avi2Dvd
2008-03-18 02:00 --------- d-----w C:\Documents and Settings\Gregg\Application Data\Bytemobile
2008-03-18 01:34 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-18 01:34 --------- d-----w C:\Documents and Settings\Gregg\Application Data\DBUpdater
2008-03-18 00:52 --------- d-----w C:\Documents and Settings\Gregg\Application Data\Sierra Wireless
2008-03-17 23:42 --------- d-----w C:\Program Files\Sierra Wireless Inc
2008-03-17 23:40 --------- d-----w C:\Program Files\Common Files\Research in Motion
2008-03-17 23:40 --------- d-----w C:\Program Files\AT&T
2008-03-17 23:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\AT&T
2008-03-17 23:24 --------- d-----w C:\Program Files\Option
2008-03-17 23:21 --------- d-----w C:\Program Files\Common Files\Motorola Shared
2008-03-17 20:11 --------- d-----w C:\Program Files\AviSynth 2.5
2008-03-17 20:02 --------- d-----w C:\Program Files\WinAVI Video Converter
2008-03-17 19:57 --------- d-----w C:\Documents and Settings\Gregg\Application Data\NeroVision
2008-03-17 18:23 --------- d-----w C:\Program Files\VstPlugins
2008-03-17 18:23 --------- d-----w C:\Program Files\Image-Line
2008-03-17 18:10 --------- d-----w C:\Program Files\MP3 Remix
2008-03-17 18:09 --------- d-----w C:\Documents and Settings\Gregg\Application Data\DivX
2008-03-17 17:55 --------- d-----w C:\Program Files\Ableton
2008-03-17 17:09 --------- d-----w C:\Documents and Settings\Gregg\Application Data\Apple Computer
2008-03-17 17:01 --------- d-----w C:\Program Files\Apple Software Update
2008-03-17 17:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-12 18:55 --------- d-----w C:\Program Files\DivX
2008-03-11 21:26 --------- d-----w C:\Program Files\MP3+G Toolz .NET
2008-03-11 20:54 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-11 18:02 --------- d-----w C:\Program Files\Alwil Software
2008-03-09 18:41 --------- d-----w C:\Program Files\BigFix
2008-03-09 18:36 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-03-09 18:35 --------- d-----w C:\Program Files\Common Files\L&H
2008-03-08 23:19 --------- d-----w C:\Program Files\Java
2008-03-07 17:02 --------- d-----w C:\Program Files\Common Files\Java
2008-03-07 15:55 --------- d-----w C:\Program Files\Ahead
2008-03-07 15:52 --------- d-----w C:\Program Files\Common Files\Ahead
2008-03-07 15:49 --------- d-----w C:\Program Files\coolpro2
2008-03-07 15:47 --------- d-----w C:\Documents and Settings\Gregg\Application Data\Syntrillium
2008-03-05 18:42 --------- d-----w C:\Program Files\ICQ
2008-03-05 18:41 --------- d-----w C:\Program Files\Symantec
2008-03-05 18:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-05 18:33 --------- d-----w C:\Program Files\Program Shortcuts
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-02-21 02:05 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-02-21 02:05 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 129,784 ----a-w C:\WINDOWS\system32\pxafs.dll
2008-02-21 02:05 120,056 ----a-w C:\WINDOWS\system32\pxcpyi64.exe
2008-02-21 02:05 118,520 ----a-w C:\WINDOWS\system32\pxinsi64.exe
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2008-02-21 02:04 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2008-02-21 02:04 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-02-21 02:04 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2008-02-21 02:04 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2008-02-21 02:04 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2008-02-21 02:04 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2008-02-21 02:04 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2008-02-21 02:04 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2008-02-21 02:04 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2008-02-21 02:04 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2008-02-21 02:03 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-02-21 02:03 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-06 01:40 368,640 ----a-w C:\WINDOWS\system32\ReWire.dll
2008-02-06 01:40 233,472 ----a-w C:\WINDOWS\system32\REX Shared Library.dll
.
((((((((((((((((((((((((((((( snapshot@2008-04-22_16.01.47.10 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-22 19:57:42 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-22 20:41:54 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-22 20:42:16 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_51c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:56 15360]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-04-11 11:23 288576]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2002-10-16 03:18 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2002-10-16 03:05 114688]
"CHotkey"="mHotkey.exe" [2002-07-23 15:09 477184 C:\WINDOWS\mHotkey.exe]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2003-07-13 03:49 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"AT&T Communication Manager"="C:\Program Files\AT&T\Communication Manager\ATTCM.exe" [2008-02-08 14:24 33280]
"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2003-02-11 17:25 26112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BigFix.lnk - C:\Program Files\BigFix\BigFix.exe [2008-03-09 14:40:52 1742384]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Excursion9.5\\mIRC.ExCurSioN.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\WINDOWS\\system32\\fxsclnt.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-03-29 14:31]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-03-29 14:35]
R3 swmsflt;swmsflt;C:\WINDOWS\system32\drivers\swmsflt.sys [2008-01-03 16:21]
S3 ATTRcAppSvc;AT&T RcAppSvc;"C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe" /n "ATTRcAppSvc" []
S3 motccgp;Motorola USB Composite Device Driver;C:\WINDOWS\system32\DRIVERS\motccgp.sys [2007-04-05 15:04]
S3 motccgpfl;MotCcgpFlService;C:\WINDOWS\system32\DRIVERS\motccgpfl.sys [2007-01-23 19:03]
S3 motport;Motorola USB Diagnostic Port;C:\WINDOWS\system32\DRIVERS\motport.sys [2007-05-04 16:54]
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-04-18 21:52:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-04-23 21:33:36
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-04-23 21:35:25
ComboFix-quarantined-files.txt 2008-04-24 01:35:19
ComboFix2.txt 2008-04-22 20:02:18
Pre-Run: 40,456,421,376 bytes free
Post-Run: 40,477,810,688 bytes free
225 --- E O F --- 2008-04-09 07:05:14
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Thursday, April 24, 2008 12:30:28 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 24/04/2008
Kaspersky Anti-Virus database records: 723882
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
Scan Statistics:
Total number of scanned objects: 62255
Number of viruses found: 17
Number of infected objects: 39
Number of suspicious objects: 0
Duration of the scan process: 02:17:54
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\InboxLOG.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows NT\MSFax\ActivityLog\OutboxLOG.txt Object is locked skipped
C:\Documents and Settings\Gregg\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Gregg\Desktop\ExcursionKR31.exe/mIRC.ExCurSioN.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Documents and Settings\Gregg\Desktop\ExcursionKR31.exe ZIP: infected - 1 skipped
C:\Documents and Settings\Gregg\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\Gregg\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Gregg\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Gregg\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Gregg\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\Gregg\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Gregg\My Documents 3\Downloads\MahJong.Suite.2008.v5.0.WinALL.Incl.Keygen-BRD\keygen.exe Infected: Trojan.Win32.Delf.bqj skipped
C:\Documents and Settings\Gregg\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Gregg\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\Gregg\Shared\when you look at me in eye.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Excursion9.5\mIRC.ExCurSioN.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.616 skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\bcmxsyxc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qoy skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\cbXPFUml.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.pxm skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\fplqidax.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qov skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\rwbnxxap.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qgr skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\wkesmkto.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.qpi skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\xcsDd18\xcsDd182328.exe.vir Infected: Trojan-Downloader.Win32.VB.dht skipped
C:\QooBox\Quarantine\catchme2008-04-22_155422.95.zip/efcCVmLb.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qfq skipped
C:\QooBox\Quarantine\catchme2008-04-22_155422.95.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP181\A0015388.exe Infected: Trojan-Downloader.Win32.Homles.bi skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP181\A0015391.exe Infected: not-a-virus:AdWare.Win32.ZenoSearch.am skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP183\A0016537.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qoy skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP183\A0016538.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.pxm skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP183\A0016539.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qov skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP183\A0016540.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qgr skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP183\A0016541.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.qpi skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP185\A0016661.exe Infected: Trojan-Downloader.Win32.VB.dht skipped
C:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP185\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\ModemLog_Standard Modem.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{CB9196E0-03DB-4704-AE62-995621A4C359}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\LogFiles\HTTPERR\httperr1.log Object is locked skipped
C:\WINDOWS\system32\LogFiles\WUDF\WUDFTrace.etl Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\temp\Perflib_Perfdata_51c.dat Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
F:\My Documents\My Downloads\AVIMoviePlayer50.exe/stream/data0052 Infected: not-a-virus:AdWare.Win32.Webdir.b skipped
F:\My Documents\My Downloads\AVIMoviePlayer50.exe/stream Infected: not-a-virus:AdWare.Win32.Webdir.b skipped
F:\My Documents\My Downloads\AVIMoviePlayer50.exe NSIS: infected - 2 skipped
F:\My Documents\My Downloads\Download_apex-avi-converter-new.exe Infected: not-a-virus:Downloader.Win32.WinFixer.fs skipped
F:\My Documents\My Downloads\GDiVXZen1.2.exe/data0005 Infected: not-a-virus:AdTool.Win32.WhenU.a skipped
F:\My Documents\My Downloads\GDiVXZen1.2.exe NSIS: infected - 1 skipped
F:\My Documents\My Downloads\uninstall-smart-browser.exe Infected: Trojan.Win32.BHO.bfp skipped
F:\My Documents\My Music\Microsoft.Office.2007.Keygen.zip/Microsoft.Office.2007.Keygen/Microsoft.Office.2007.Application.Keygen/moa2007kg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\My Documents\My Music\Microsoft.Office.2007.Keygen.zip/Microsoft.Office.2007.Keygen/Microsoft.Office.2007.Enterprise.Keygen/moe2007kg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\My Documents\My Music\Microsoft.Office.2007.Keygen.zip ZIP: infected - 2 skipped
F:\My Documents\My Music\PC Tools AntiVirus 3.1.zip/PC Tools AntiVirus 3.1.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\My Documents\My Music\PC Tools AntiVirus 3.1.zip ZIP: infected - 1 skipped
F:\RECYCLER\S-1-5-21-3750487097-2532040272-4192398965-1005\Dh4\My Music\Microsoft.Office.2007.Keygen.zip/Microsoft.Office.2007.Keygen/Microsoft.Office.2007.Application.Keygen/moa2007kg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\RECYCLER\S-1-5-21-3750487097-2532040272-4192398965-1005\Dh4\My Music\Microsoft.Office.2007.Keygen.zip/Microsoft.Office.2007.Keygen/Microsoft.Office.2007.Enterprise.Keygen/moe2007kg.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\RECYCLER\S-1-5-21-3750487097-2532040272-4192398965-1005\Dh4\My Music\Microsoft.Office.2007.Keygen.zip ZIP: infected - 2 skipped
F:\RECYCLER\S-1-5-21-3750487097-2532040272-4192398965-1005\Dh4\My Music\PC Tools AntiVirus 3.1.zip/PC Tools AntiVirus 3.1.exe Infected: Trojan-Dropper.Win32.Delf.xo skipped
F:\RECYCLER\S-1-5-21-3750487097-2532040272-4192398965-1005\Dh4\My Music\PC Tools AntiVirus 3.1.zip ZIP: infected - 1 skipped
F:\Shared\when you look at me in eye.mp3 Infected: Trojan-Downloader.WMA.Wimad.n skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{35A4A879-B4E1-4F85-811E-93C3722DA63B}\RP185\change.log Object is locked skipped
Scan process completed.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:35:55 AM, on 4/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\bmwebcfg.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [AT&T Communication Manager] "C:\Program Files\AT&T\Communication Manager\ATTCM.exe" -a
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\BigFix.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O10 - Unknown file in Winsock LSP: bmnet.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.emachines.com
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) -
http://www.kaspersky...can_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.mi...b?1204743386109
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://www.update.mi...b?1205167455828
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.m...ash/swflash.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: AT&T RcAppSvc (ATTRcAppSvc) - PCTEL - C:\Program Files\AT&T\Communication Manager\RcAppSvc.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bytemobile Web Configurator (bmwebcfg) - Bytemobile, Inc. - C:\WINDOWS\system32\bmwebcfg.exe
--
End of file - 5650 bytes
Edited by maax, 23 April 2008 - 10:36 PM.