Spyware / Malware / Virus Removal

[Resolved] adwear & Trojan

12 min read

Looking for the outcome? Ask AI

smavid Topic Starter

Post #1May 31, 2008, 3:44 PM UTC last edited June 1, 2008, 8:15 PM UTC

HI all,
im new to WTT!!
and ive got a infection. becuz i torrent, ive done some things to help the prob but i dont know if it trully gone.
I did combofix, ATFcleaner and mbam-setup.exe Heres the logs
much thanks!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:30 AM, on 5/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ASUS\AI Booster\OverClk.exe
C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ASUS\PC Probe II\Probe2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\n00binator\Desktop\F.I.X\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\AI Booster\OverClk.exe"
O4 - HKLM\..\Run: [MaxBlastMonitor.exe] C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [{67-71-16-61-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

–
End of file - 6125 bytes

Malwarebytes' Anti-Malware 1.14
Database version: 807

9:57:26 AM 5/31/2008
mbam-log-5-31-2008 (09-57-26).txt

Scan type: Quick Scan
Objects scanned: 35132
Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\AntiSpywareMaster (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\WINDOWS\system32\ITMP (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\jlwnw64r.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ITMP\dutdtx2.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\svchost32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\internet.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\winpfz33.sys (Malware.Trace) -> Quarantined and deleted successfully.

Symptoms: ads and popups for antivirus scans and background ad

LDTate

Post #2June 7, 2008, 4:03 PM UTC

[external image: Posted Image]

Sorry about the delay in responding

If you still need help, Scan again with HijackThis, and "copy/paste" a new log file into this thread.

Also please describe how your computer behaves at the moment.

smavid

Post #3June 8, 2008, 10:58 AM UTC

NP i know u guys and galls have a lots of people to help,

as for the computer,i get pop ups on toolbar, the background is a antispywear ad that comes as defalt, a page that looks ligit (but is not) win security center that reads trojanDownLoader.xs is on my comp
and the internet and comp is slower than norm
I did just run MALWEARBYTES.exe

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:41:23 AM, on 6/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\WINDOWS\REFSS0NISVA\command.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ASUS\PC Probe II\Probe2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\DOCUME~1\N00BIN~1\APPLIC~1\ASEMBL~1\spool32.exe
C:\Program Files\?dobe\r?ndll32.exe
C:\PROGRA~1\COMMON~1\mqfi\mqfim.exe
C:\PROGRA~1\COMMON~1\mqfi\mqfia.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\n00binator\Desktop\F.I.X\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {AB37BD6A-21FA-4B72-FF3C-70A2E6EC42B2} - C:\WINDOWS\system32\lrfyad.dll
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\AI Booster\OverClk.exe"
O4 - HKLM\..\Run: [MaxBlastMonitor.exe] C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [{67-71-16-61-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKLM\..\Run: [SoundMax] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Rbet] "C:\DOCUME~1\N00BIN~1\APPLIC~1\ASEMBL~1\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [Jcjwu] "C:\Program Files\?dobe\r?ndll32.exe"
O4 - HKCU\..\Run: [mqfi] C:\PROGRA~1\COMMON~1\mqfi\mqfim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\REFSS0NISVA\command.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

–
End of file - 9479 bytes

smavid

Post #4June 8, 2008, 10:59 AM UTC last edited June 8, 2008, 11:05 AM UTC

hit the reply 3 times sry

smavid

Post #5June 8, 2008, 11:01 AM UTC last edited June 8, 2008, 11:03 AM UTC

SRY

LDTate

Post #6June 8, 2008, 11:44 AM UTC

It looks like you have a pretty nasty infection. Can you post the scan results from MALWEARBYTES scan?

smavid

Post #7June 8, 2008, 7:58 PM UTC

Heres the log. thanks for the quick reply. before i replyed the 2nd time i ran it and come up with 135 infected files Malwarebytes' Anti-Malware 1.14 Database version: 807 5:26:43 AM 6/8/2008 mbam-log-6-8-2008 (05-26-43).txt Scan type: Full Scan (C:\|E:\|F:\|) Objects scanned: 91091 Time elapsed: 16 minute(s), 42 second(s) Memory Processes Infected: 5 Memory Modules Infected: 4 Registry Keys Infected: 29 Registry Values Infected: 8 Registry Data Items Infected: 1 Folders Infected: 15 Files Infected: 73 Memory Processes Infected: C:\Program Files\webHancer\Programs\whagent.exe (Adware.WebHancer) -> Unloaded process successfully. C:\Program Files\JavaCore\JavaCore.exe (Trojan.Insider) -> Unloaded process successfully. C:\Program Files\Svconr\Svconr.exe (Adware.Agent) -> Unloaded process successfully. C:\Program Files\QdrModule\QdrModule17.exe (Adware.ISM) -> Unloaded process successfully. C:\Documents and Settings\n00binator\Application Data\speedrunner\SpeedRunner.exe (Adware.SurfAccuracy) -> Unloaded process successfully. Memory Modules Infected: C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Unloaded module successfully. C:\WINDOWS\system32\sockins32.dll (Trojan.BHO) -> Unloaded module successfully. C:\Program Files\webHancer\Programs\webhdll.dll (Adware.WebHancer) -> Unloaded module successfully. C:\Program Files\Spcron\Spc.dll (Adware.Agent) -> Unloaded module successfully. Registry Keys Infected: HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{ffffffff-bbbb-4146-86fd-a722e8ab3489} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffffffff-bbbb-4146-86fd-a722e8ab3489} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ism (Adware.ISM) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\MsSecurity1.209.4 (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\BO1jiZmwnF2zhi (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Spcron (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\Svconr (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\QdrModule (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Outerinfo (Adware.PurityScan) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebProxy (Trojan.BHO) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webHancer Agent (Adware.WebHancer) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\JavaCore (Trojan.Insider) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Svconr (Adware.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\QdrModule17 (Adware.ISM) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runner1 (Trojan.Agent) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Trojan.Agent) -> Data: spc.dll -> Quarantined and deleted successfully. Folders Infected: C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\InetGet2 (Trojan.Downloader) -> Delete on reboot. C:\Program Files\webHancer (Adware.Webhancer) -> Delete on reboot. C:\Program Files\webHancer\Programs (Adware.Webhancer) -> Delete on reboot. C:\Program Files\Temporary (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\JavaCore (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Program Files\ISM (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\QdrModule (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\CPV (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Program Files\Svconr (Trojan.Agent) -> Quarantined and deleted successfully. C:\Program Files\Spcron (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Application Data\speedrunner (Adware.SurfAccuracy) -> Delete on reboot. Files Infected: C:\Program Files\webHancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Delete on reboot. C:\WINDOWS\system32\sockins32.dll (Trojan.BHO) -> Delete on reboot. C:\Program Files\webHancer\Programs\webhdll.dll (Adware.WebHancer) -> Delete on reboot. C:\Program Files\webHancer\Programs\whagent.exe (Adware.WebHancer) -> Quarantined and deleted successfully. C:\Program Files\JavaCore\JavaCore.exe (Trojan.Insider) -> Quarantined and deleted successfully. C:\Program Files\Spcron\Spc.dll (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Local Settings\Temp\syswcc32.exe (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Local Settings\Temp\~tmp143 (Trojan.Clicker) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Local Settings\Temporary Internet Files\Content.IE5\5K8JDD81\3cd898b13299cb4bc0d5dc64745518ed[1].zip (Trojan.DownLoader) -> Quarantined and deleted successfully. C:\Program Files\InetGet2\SRInstaller.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully. C:\Program Files\ISM\ism.exe (Adware.SearchAid) -> Quarantined and deleted successfully. C:\Program Files\JavaCore\UnInstall.exe (Adware.Insider) -> Quarantined and deleted successfully. C:\Program Files\Svconr\Svconr.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{94EB38F5-B37F-493C-A241-703A514AACFF}\RP63\A0020975.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\b116.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\WINDOWS\b152.exe (Trojan.Insider) -> Quarantined and deleted successfully. C:\WINDOWS\b155.exe (Trojan.BHO) -> Quarantined and deleted successfully. C:\WINDOWS\b156.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\b157.exe (Trojan.Dropper) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF\components\FF.dll (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\license.txt (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\readme.txt (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\SET767.tmp (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\SET769.tmp (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\SET76D.tmp (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\SET76F.tmp (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\SET771.tmp (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\sporder.dll (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\whagent.ini (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> Quarantined and deleted successfully. C:\Program Files\ISM\Uninstall.exe (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\QdrModule\dicer.gz (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\QdrModule\kwder.gz (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\QdrModule\pckrer.dat (Adware.ISM) -> Quarantined and deleted successfully. C:\Program Files\QdrModule\QdrModule17.exe (Adware.ISM) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Application Data\speedrunner\config.cfg (Adware.SurfAccuracy) -> Quarantined and deleted successfully. C:\Documents and Settings\n00binator\Application Data\speedrunner\SpeedRunner.exe (Adware.SurfAccuracy) -> Delete on reboot. C:\Documents and Settings\n00binator\Application Data\speedrunner\SRUninstall.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully. C:\WINDOWS\explore.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\iexplorer.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\x.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\y.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\xxxvideo.hta (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\default.htm (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\svchost32.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\loader.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\internet.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\homepage.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo1.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo2.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo3.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo4.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo5.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promo6.html (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promogif1.gif (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promogif2.gif (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\promogif3.gif (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\lfn.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\mrofinu72.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\000050.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\000060.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\000090.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sft.res (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lt.res (Malware.Trace) -> Quarantined and deleted successfully. C:\Program Files\Common Files\Yazzle1552OinAdmin.exe (Adware.PurityScan) -> Quarantined and deleted successfully. C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully. C:\WINDOWS\b148.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

LDTate

Post #8June 8, 2008, 8:02 PM UTC

OK. We need to dig deeper.

Download ComboFix from Here or Here to your Desktop.
**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**
——————————————————————–

Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
WARNING: IF you have not already done so Combofix will disconnect your machine from the Internet when it starts
Please do not re-connect your machine back to the Internet until Combofix has completely finished.

——————————————————————–

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish

smavid

Post #9June 8, 2008, 8:24 PM UTC

ComboFix 08-06-07.3 - n00binator 2008-06-08 15:19:16.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1304 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt
C:\Documents and Settings\n00binator\Application Data\ASEMBL~1
C:\Documents and Settings\n00binator\Application Data\ASEMBL~1\a?sembly\
C:\Documents and Settings\n00binator\Application Data\ASEMBL~1\spool32.exe
C:\Documents and Settings\n00binator\Local Settings\Temporary Internet Files\bestwiner.stt
C:\Documents and Settings\n00binator\Local Settings\Temporary Internet Files\CPV.stt
C:\Program Files\Common Files\mqfi
C:\Program Files\Common Files\mqfi\mqfia.exe
C:\Program Files\Common Files\mqfi\mqfia.lck
C:\Program Files\Common Files\mqfi\mqfid\class-barrel
C:\Program Files\Common Files\mqfi\mqfid\mqfic.dll
C:\Program Files\Common Files\mqfi\mqfid\vocabulary
C:\Program Files\Common Files\mqfi\mqfih
C:\Program Files\Common Files\mqfi\mqfil.exe
C:\Program Files\Common Files\mqfi\mqfil.lck
C:\Program Files\Common Files\mqfi\mqfim.exe
C:\Program Files\Common Files\mqfi\mqfim.lck
C:\Program Files\Common Files\mqfi\mqfip.exe
C:\Program Files\dobe~1
C:\Program Files\dobe~1\r?ndll32.exe
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Temp\vtmp2
C:\Temp\vtmp2\ktnv33.log
C:\WINDOWS\accesss.exe
C:\WINDOWS\astctl32.ocx
C:\WINDOWS\avpcc.dll
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\clrssn.exe
C:\WINDOWS\cpan.dll
C:\WINDOWS\ctfmon32.exe
C:\WINDOWS\ctrlpan.dll
C:\WINDOWS\default.htm
C:\WINDOWS\directx32.exe
C:\WINDOWS\dnsrelay.dll
C:\WINDOWS\editpad.exe
C:\WINDOWS\explore.exe
C:\WINDOWS\explorer32.exe
C:\WINDOWS\funniest.exe
C:\WINDOWS\funny.exe
C:\WINDOWS\gfmnaaa.dll
C:\WINDOWS\helpcvs.exe
C:\WINDOWS\iedll.exe
C:\WINDOWS\iexplorer.exe
C:\WINDOWS\index.html
C:\WINDOWS\inetinf.exe
C:\WINDOWS\internet.exe
C:\WINDOWS\loader.exe
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\mqfi
C:\WINDOWS\mqfi\mqfi.dat
C:\WINDOWS\mqfi\wu
C:\WINDOWS\msconfd.dll
C:\WINDOWS\msspi.dll
C:\WINDOWS\mssys.exe
C:\WINDOWS\msupdate.exe
C:\WINDOWS\mswsc10.dll
C:\WINDOWS\mswsc20.dll
C:\WINDOWS\mtwirl32.dll
C:\WINDOWS\muotr.so
C:\WINDOWS\notepad32.exe
C:\WINDOWS\olehelp.exe
C:\WINDOWS\qttasks.exe
C:\WINDOWS\quicken.exe
C:\WINDOWS\REFSS0NISVA\
C:\WINDOWS\REFSS0NISVA\\asappsrv.dll
C:\WINDOWS\REFSS0NISVA\\command.exe
C:\WINDOWS\REFSS0NISVA\\lHImmXhKmpE.vbs
C:\WINDOWS\REFSS0NISVA\command.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundll32.vbe
C:\WINDOWS\searchword.dll
C:\WINDOWS\sistem.exe
C:\WINDOWS\svchost32.exe
C:\WINDOWS\svcinit.exe
C:\WINDOWS\systeem.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\g11.exe
C:\WINDOWS\system32\hljwugsf.bin
C:\WINDOWS\system32\lrfyad.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\pcntmkdm.exe
C:\WINDOWS\system32\sn.txt
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\system32\vbpdtvdp.exe
C:\WINDOWS\systemcritical.exe
C:\WINDOWS\time.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\users32.exe
C:\WINDOWS\waol.exe
C:\WINDOWS\win32e.exe
C:\WINDOWS\win64.exe
C:\WINDOWS\winajbm.dll
C:\WINDOWS\window.exe
C:\WINDOWS\winmgnt.exe
C:\WINDOWS\x.exe
C:\WINDOWS\xplugin.dll
C:\WINDOWS\xxxvideo.hta
C:\WINDOWS\y.exe

—– BITS: Possible infected sites —–

hxxp://80.93.48.89
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CMDSERVICE
——-\Legacy_MSSECURITY1.209.4
——-\Legacy_NETWORK_MONITOR
——-\Service_cmdService
——-\Service_Network Monitor

((((((((((((((((((((((((( Files Created from 2008-05-08 to 2008-06-08 )))))))))))))))))))))))))))))))
.

2008-06-08 04:49 . 2008-06-08 04:49 87,511 –a—— C:\WINDOWS\system32\iftuyszv.exe
2008-06-08 04:39 . 2008-06-08 04:39 d——– C:\WINDOWS\system32\vntiho06
2008-06-08 04:39 . 2008-06-08 04:39 49,158 –a—— C:\WINDOWS\444.0
2008-06-02 12:44 . 2008-06-02 12:44 d——– C:\Documents and Settings\n00binator\Application Data\Ubisoft
2008-06-01 21:11 . 2008-06-01 21:11 d——– C:\Program Files\KAPITALSIN
2008-06-01 17:03 . 2008-06-01 17:03 d——– C:\WINDOWS\system32\Gears of War - Screensaver dir
2008-06-01 17:03 . 2008-06-01 21:10 d——– C:\Program Files\Gears of War
2008-06-01 17:03 . 2008-06-01 17:03 520,192 –a—— C:\WINDOWS\system32\Gears of War - Screensaver.scr
2008-06-01 17:00 . 2008-06-01 17:08 d——– C:\Documents and Settings\n00binator\Application Data\Microsoft Games
2008-06-01 16:44 . 2008-06-01 16:54 d——– C:\Program Files\AMD
2008-06-01 16:43 . 2008-06-01 16:43 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-06-01 16:43 . 2007-04-05 16:56 33,792 –a—— C:\WINDOWS\system32\drivers\AmdTools.sys
2008-06-01 02:47 . 2008-06-01 02:47 d——– C:\Documents and Settings\n00binator\Application Data\vlc
2008-06-01 02:29 . 2008-06-01 02:29 d——– C:\Program Files\VideoLAN
2008-06-01 02:14 . 2008-06-07 03:35 69 –a—— C:\WINDOWS\NeroDigital.ini
2008-05-31 22:02 . 2008-05-31 22:02 8 -r-hs—- C:\WINDOWS\system32\67C6F433D4.sys
2008-05-31 21:59 . 2008-05-31 21:59 88 -r-hs—- C:\WINDOWS\system32\FB39D8CA88.sys
2008-05-31 21:58 . 2008-05-31 21:59 d——– C:\Documents and Settings\n00binator\Application Data\Corel
2008-05-31 21:58 . 2008-05-31 21:58 d——– C:\Documents and Settings\All Users\Application Data\Corel
2008-05-31 21:57 . 2008-05-31 21:57 d——– C:\Program Files\Common Files\Corel
2008-05-31 21:42 . 2008-05-31 21:57 d——– C:\Program Files\Corel
2008-05-31 21:12 . 2008-06-07 05:06 2,516 –ahs—- C:\WINDOWS\system32\KGyGaAvL.sys
2008-05-31 09:51 . 2008-05-31 09:51 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-05-31 09:51 . 2008-05-31 09:51 d——– C:\Documents and Settings\n00binator\Application Data\Malwarebytes
2008-05-31 09:51 . 2008-05-31 09:51 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-31 09:51 . 2008-05-30 01:06 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-05-31 09:51 . 2008-05-30 01:06 15,864 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-05-31 09:50 . 2008-05-31 09:50 d——– C:\Program Files\Common Files\Download Manager
2008-05-31 07:52 . 2008-06-08 15:21 0 –a—— C:\WINDOWS\system.ini
2008-05-31 00:48 . 2008-06-08 04:50 9,662 –a—— C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-05-31 00:39 . 2008-05-31 10:15 d——– C:\WINDOWS\system32\Ucom1
2008-05-31 00:39 . 2008-05-31 00:39 d——– C:\WINDOWS\system32\sIE6
2008-05-31 00:39 . 2008-05-31 00:39 d——– C:\WINDOWS\system32\evd2
2008-05-31 00:39 . 2008-05-31 10:15 d——– C:\WINDOWS\system32\Dev3
2008-05-31 00:39 . 2008-05-31 10:15 d——– C:\WINDOWS\system32\4026c
2008-05-31 00:38 . 2008-05-31 00:38 d——– C:\WINDOWS\system32\vntiho01
2008-05-31 00:38 . 2008-06-08 15:19 d——– C:\Temp
2008-05-26 16:26 . 2008-05-26 16:27 d——– C:\WINDOWS\NV16322340.TMP
2008-05-26 02:20 . 2008-05-26 02:20 d——– C:\Documents and Settings\n00binator\My Games
2008-05-26 02:13 . 2007-06-21 01:53 32,768 –a—— C:\WINDOWS\system32\mf.dll
2008-05-26 01:45 . 2008-06-06 11:52 d——– C:\Program Files\Microsoft Games
2008-05-26 01:45 . 2008-05-26 01:45 d——– C:\Documents and Settings\All Users\Microsoft
2008-05-26 01:45 . 2008-05-26 01:45 d——– C:\Documents and Settings\All Users\Application Data\Microsoft Games
2008-05-26 01:43 . 2008-05-26 01:43 d——– C:\Documents and Settings\n00binator\Application Data\Microsoft Game Studios
2008-05-25 23:53 . 2008-05-25 23:53 d——– C:\WINDOWS\95F354E1056743D38B37DFDA257324F0.TMP
2008-05-25 23:51 . 2008-05-25 23:51 d——– C:\Documents and Settings\All Users\Application Data\BufferZone
2008-05-25 23:12 . 2008-05-25 23:12 d——– C:\Program Files\7-Zip
2008-05-25 00:34 . 2004-08-04 09:56 616,960 –a—— C:\WINDOWS\advapi32.dll
2008-05-24 22:15 . 2008-03-05 15:56 3,952,144 –a—— C:\WINDOWS\system32\D3DX9d_37.dll
2008-05-24 22:15 . 2008-02-05 23:06 3,799,400 –a—— C:\WINDOWS\system32\d3dx9d_33.dll
2008-05-24 22:15 . 2008-02-05 23:06 3,087,208 –a—— C:\WINDOWS\system32\d3d9d.dll
2008-05-24 22:15 . 2008-02-05 23:06 506,384 –a—— C:\WINDOWS\system32\D3DX10d_37.dll
2008-05-24 22:15 . 2008-02-05 23:06 359,624 –a—— C:\WINDOWS\system32\dinput8d.dll
2008-05-24 22:15 . 2008-02-05 23:06 349,416 –a—— C:\WINDOWS\system32\d3dref9.dll
2008-05-24 22:14 . 2008-05-24 22:15 d——– C:\Program Files\Microsoft DirectX SDK (March 2008)
2008-05-24 19:56 . 2008-03-05 15:56 3,786,760 –a—— C:\WINDOWS\system32\D3DX9_37.dll
2008-05-24 19:56 . 2008-03-05 15:56 1,420,824 –a—— C:\WINDOWS\system32\D3DCompiler_37.dll
2008-05-24 19:56 . 2008-03-05 16:03 479,752 –a—— C:\WINDOWS\system32\XAudio2_0.dll
2008-05-24 19:56 . 2008-02-05 23:07 462,864 –a—— C:\WINDOWS\system32\d3dx10_37.dll
2008-05-24 19:56 . 2008-03-05 16:03 238,088 –a—— C:\WINDOWS\system32\xactengine3_0.dll
2008-05-24 19:56 . 2008-03-05 16:00 25,608 –a—— C:\WINDOWS\system32\X3DAudio1_3.dll
2008-05-24 19:45 . 2008-05-24 19:56 d–h—– C:\WINDOWS\msdownld.tmp
2008-05-24 17:26 . 2008-05-24 17:26 d–h—– C:\WINDOWS\system32\GroupPolicy
2008-05-24 04:47 . 2008-05-24 04:47 d–h—– C:\WINDOWS\PIF
2008-05-24 04:12 . 2008-05-26 02:19 d——– C:\wata
2008-05-22 22:09 . 2008-05-22 22:09 d——– C:\Program Files\Xvid
2008-05-22 22:09 . 2007-06-28 18:52 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll
2008-05-22 22:09 . 2007-06-28 18:54 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll
2008-05-22 22:09 . 2007-06-28 18:55 77,824 –a—— C:\WINDOWS\system32\xvid.ax
2008-05-21 23:41 . 2008-05-21 23:41 d——– C:\Program Files\Google
2008-05-20 22:44 . 2008-05-20 22:44 d——– C:\Documents and Settings\All Users\Application Data\LightScribe
2008-05-20 22:31 . 2008-05-20 22:31 d——– C:\Program Files\NVIDIA nTune Performance Application
2008-05-20 20:08 . 2008-05-20 20:10 d——– C:\WINDOWS\NV37603764.TMP
2008-05-20 19:05 . 2008-05-20 19:05 d——– C:\Program Files\MadOnion.com
2008-05-20 18:37 . 2008-05-20 18:46 d——– C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-05-20 18:30 . 2008-05-20 18:31 d——– C:\WINDOWS\NV32043208.TMP
2008-05-20 18:02 . 2008-05-26 16:26 d——– C:\WINDOWS\nvidia icons
2008-05-20 18:02 . 2008-05-20 18:04 d——– C:\WINDOWS\NV32482924.TMP
2008-05-20 18:02 . 2008-05-03 05:46 182,347 –a—— C:\WINDOWS\system32\nvapps.nvb
2008-05-20 18:01 . 2008-05-20 18:01 d——– C:\NVIDIA
2008-05-20 16:05 . 2008-05-20 16:05 d——– C:\Documents and Settings\Owner
2008-05-20 16:05 . 2008-05-20 16:05 32,768 –a—— C:\WINDOWS\system32\vntiho06\vntiho061083.exe
2008-05-20 16:02 . 2008-05-20 16:02 32,768 –a—— C:\WINDOWS\system32\vntiho01\vntiho011065.exe
2008-05-20 15:20 . 2008-06-02 17:31 d——– C:\Program Files\Wolfenstein - Enemy Territory
2008-05-20 15:12 . 2008-06-02 12:10 d——– C:\Documents and Settings\All Users\Application Data\Ubisoft
2008-05-20 15:11 . 2008-05-20 15:11 22,328 –a—— C:\Documents and Settings\n00binator\Application Data\PnkBstrK.sys
2008-05-20 15:02 . 2008-06-02 12:02 d——– C:\Program Files\Ubisoft
2008-05-20 14:58 . 2008-05-20 14:58 d——– C:\Program Files\Alcohol Soft
2008-05-20 14:56 . 2008-05-20 14:56 685,816 ——— C:\WINDOWS\system32\drivers\sptd.sys
2008-05-20 14:55 . 2008-06-07 09:40 d——– C:\Documents and Settings\n00binator\Application Data\U3
2008-05-20 14:55 . 2004-08-03 23:08 26,496 —–c— C:\WINDOWS\system32\dllcache\usbstor.sys
2008-05-20 02:17 . 2008-05-20 02:18 d——– C:\Program Files\Winamp
2008-05-20 02:17 . 2008-05-20 02:23 d——– C:\Documents and Settings\n00binator\Application Data\Winamp
2008-05-20 01:15 . 2008-05-20 01:15 d——– C:\Documents and Settings\LocalService\Application Data\Xfire
2008-05-20 01:00 . 2008-05-20 01:00 d——– C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-05-20 00:58 . 2008-05-29 04:00 d——– C:\Program Files\Xfire
2008-05-20 00:58 . 2008-06-04 11:54 d——– C:\Documents and Settings\n00binator\Application Data\Xfire
2008-05-19 23:46 . 2008-05-19 23:46 d——– C:\Program Files\Common Files\LightScribe
2008-05-19 23:45 . 2008-05-24 03:22 d——– C:\Documents and Settings\n00binator\Application Data\Ahead
2008-05-19 23:45 . 2008-05-19 23:45 d——– C:\Documents and Settings\All Users\Application Data\Ahead
2008-05-19 23:43 . 2008-05-19 23:43 d——– C:\Program Files\Nero
2008-05-19 23:43 . 2008-05-19 23:45 d——– C:\Program Files\Common Files\Ahead
2008-05-19 23:43 . 2008-05-19 23:43 d——– C:\Documents and Settings\All Users\Application Data\Nero
2008-05-19 23:36 . 2008-05-19 23:36 d——– C:\Program Files\Free RAR Extract Frog
2008-05-19 22:08 . 2008-05-19 22:08 d——– C:\WINDOWS\Downloaded Installations
2008-05-19 22:08 . 2008-05-19 22:08 d——– C:\Program Files\Multimedia Keyboard Application
2008-05-19 21:46 . 2008-05-19 21:46 d—s—- C:\Documents and Settings\n00binator\UserData
2008-05-19 21:13 . 2008-06-08 06:19 d——– C:\Documents and Settings\n00binator\Application Data\BitTorrent
2008-05-19 21:12 . 2008-05-19 21:12 d——– C:\Program Files\DNA
2008-05-19 21:12 . 2008-05-19 21:12 d——– C:\Program Files\BitTorrent
2008-05-19 21:12 . 2008-06-08 15:11 d——– C:\Documents and Settings\n00binator\Application Data\DNA
2008-05-19 19:59 . 2005-03-03 21:47 31,104 ——— C:\WINDOWS\system32\drivers\CYUSB.sys
2008-05-19 19:59 . 2007-04-12 08:46 10,880 ——— C:\WINDOWS\system32\drivers\dadder.sys
2008-05-19 19:15 . 2008-05-19 19:15 d——– C:\WINDOWS\Profiles
2008-05-19 19:15 . 2008-05-19 19:15 d——– C:\Program Files\Common Files\Adobe
2008-05-19 19:15 . 2008-05-19 19:15 d——– C:\Documents and Settings\n00binator\Application Data\InterTrust
2008-05-19 19:15 . 1998-10-29 17:45 306,688 –a—— C:\WINDOWS\IsUninst.exe
2008-05-19 19:10 . 2004-08-04 07:00 811,064 –a—— C:\WINDOWS\system32\imjp81k.dll
2008-05-19 19:09 . 2001-08-18 00:36 8,704 –a—— C:\WINDOWS\system32\kbdjpn.dll
2008-05-19 19:07 . 2007-03-12 18:42 3,495,784 –a—— C:\WINDOWS\system32\d3dx9_33.dll
2008-05-19 19:06 . 2008-05-26 16:27 d——– C:\WINDOWS\nview
2008-05-19 19:06 . 2008-05-02 22:46 442,368 –a—— C:\WINDOWS\system32\nvudisp.exe
2008-05-19 19:06 . 2008-06-08 15:21 175,419 –a—— C:\WINDOWS\system32\nvapps.xml
2008-05-19 19:06 . 2008-05-03 05:46 18,070 –a—— C:\WINDOWS\system32\nvdisp.nvu
2008-05-19 18:59 . 2008-05-19 18:59 d——– C:\Documents and Settings\n00binator\Application Data\MSNInstaller

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-07 07:58 23,352 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-07 07:58 107,832 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-06-07 00:01 70,144 —-a-w C:\WINDOWS\system32\userinit.exe
2008-06-06 17:18 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-05-27 10:45 104 —-a-w C:\Program Files\My Computer.lnk
2008-05-25 22:12 ——— d—–w C:\Program Files\DIFX
2008-05-21 03:31 ——— d—–w C:\Program Files\NVIDIA Corporation
2008-05-21 01:26 ——— d—–w C:\Program Files\ASUS
2008-05-20 20:11 66,872 —-a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-05-20 20:11 2,337,865 —-a-w C:\WINDOWS\system32\pbsvc.exe
2008-05-20 01:55 ——— d—–w C:\Documents and Settings\All Users\Application Data\Maxtor
2008-05-20 01:54 392,320 ——w C:\WINDOWS\system32\drivers\timntr.sys
2008-05-20 01:54 32,768 ——w C:\WINDOWS\system32\drivers\tifsfilt.sys
2008-05-20 01:54 120,992 ——w C:\WINDOWS\system32\drivers\snapman.sys
2008-05-20 01:54 ——— d—–w C:\Program Files\Maxtor
2008-05-20 01:54 ——— d—–w C:\Program Files\Common Files\Maxtor
2008-05-20 01:53 ——— d—–w C:\Program Files\Razer
2008-05-20 01:53 ——— d—–w C:\Documents and Settings\n00binator\Application Data\InstallShield
2008-05-20 01:47 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-05-20 01:43 ——— d—–w C:\Program Files\Analog Devices
2008-05-20 01:10 ——— d—–w C:\Program Files\microsoft frontpage
2008-05-03 03:46 86,016 —-a-w C:\WINDOWS\system32\nvmctray.dll
2008-05-03 03:46 6,108,160 —-a-w C:\WINDOWS\system32\nv4_disp.dll
2008-05-03 03:46 425,984 —-a-w C:\WINDOWS\system32\nvapi.dll
2008-05-03 03:46 41,984 —-a-w C:\WINDOWS\system32\nvcod.dll
2008-05-03 03:46 13,529,088 —-a-w C:\WINDOWS\system32\nvcpl.dll
2008-04-30 22:27 442,368 —-a-w C:\WINDOWS\system32\NVUNINST.EXE
.

((((((((((((((((((((((((((((( snapshot@2008-05-31_ 7.39.08.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-03-22 20:13:26 77,824 —-a-w C:\WINDOWS\Downloaded Program Files\asusTek_sys_ctrl.dll
+ 2008-06-06 17:03:37 454,656 —-a-r C:\WINDOWS\Installer\{1170D24F-42B7-40CF-AA1B-6395CE562354}\ARPPRODUCTICON.exe
+ 2008-06-01 02:57:57 394,534 —-a-r C:\WINDOWS\Installer\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}\ARPPRODUCTICON.exe
+ 2008-06-01 02:57:57 22,486 —-a-r C:\WINDOWS\Installer\{64E72FB1-2343-4977-B4A8-262CD53D0BD3}\NewShortcut1.73D5A293_D496_4B44_B535_AA8F98088895.exe
+ 2006-07-02 03:39:40 36,864 -c–a-w C:\WINDOWS\system32\DRVSTORE\amdk8_C074F64CC74B03BC354BB5DC973CCF768D5A7194\AmdK8.sys
+ 2007-04-16 21:46:34 33,792 -c–a-w C:\WINDOWS\system32\DRVSTORE\amdppm_C66586B319F61C772BA2DAB141D0FE08F299F411\AmdPPM.sys
+ 2007-04-16 21:46:38 44,544 -c–a-w C:\WINDOWS\system32\DRVSTORE\amdppm_C66586B319F61C772BA2DAB141D0FE08F299F411\AmdPPM64.sys
+ 2004-08-04 12:00:00 24,576 —-a-w C:\WINDOWS\system32\dsf2ffa.exe
+ 2008-06-01 22:03:46 34,304 —-a-w C:\WINDOWS\system32\Gears of War - Screensaver dir\saver1.dll
+ 2008-06-01 22:03:46 18,192 —-a-w C:\WINDOWS\system32\Gears of War - Screensaver dir\saver2.dll
+ 2007-08-28 17:00:00 1,101,824 —-a-w C:\WINDOWS\system32\mfc80.dll
- 2006-10-05 19:26:24 809,808 —-a-w C:\WINDOWS\system32\msidcrl40.dll
+ 2007-04-30 21:50:50 903,072 —-a-w C:\WINDOWS\system32\msidcrl40.dll
+ 2007-08-28 17:00:00 548,864 —-a-w C:\WINDOWS\system32\msvcp80.dll
+ 2007-08-28 17:00:00 626,688 —-a-w C:\WINDOWS\system32\msvcr80.dll
- 2003-04-18 23:46:22 1,233,920 —-a-w C:\WINDOWS\system32\msxml4.dll
+ 2003-04-18 21:46:22 1,233,920 —-a-w C:\WINDOWS\system32\msxml4.dll
+ 2007-06-05 18:20:30 1,459,752 —-a-w C:\WINDOWS\system32\PSIKey.dll
+ 2007-06-05 18:20:32 177,704 —-a-w C:\WINDOWS\system32\PSIService.exe
- 2004-01-07 18:21:24 237,936 —-a-w C:\WINDOWS\system32\unicows.dll
+ 2004-01-07 16:21:24 237,936 —-a-w C:\WINDOWS\system32\unicows.dll
- 2007-04-17 20:34:58 7,677,744 —-a-w C:\WINDOWS\system32\xlive.dll
+ 2007-08-08 00:22:14 8,607,552 —-a-w C:\WINDOWS\system32\xlive.dll
- 2007-04-17 20:35:32 13,653,808 —-a-w C:\WINDOWS\system32\xlivefnt.dll
+ 2007-08-08 00:22:16 13,653,824 —-a-w C:\WINDOWS\system32\xlivefnt.dll
+ 2008-06-08 20:21:43 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_69c.dat
+ 2008-06-08 20:21:56 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_f34.dat
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-19 21:12 289088]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 19:25 81920]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-05-21 23:41 171448]
"Rbet"="C:\DOCUME~1\N00BIN~1\APPLIC~1\ASEMBL~1\spool32.exe" [ ]
"Jcjwu"="C:\Program Files\?dobe\r?ndll32.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch Ai Booster"="C:\Program Files\ASUS\AI Booster\OverClk.exe" [2006-11-28 19:20 3714048]
"MaxBlastMonitor.exe"="C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe" [2007-04-20 09:59 1169720]
"AcronisTimounterMonitor"="C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe" [2007-04-20 10:09 1945712]
"Acronis Scheduler2 Service"="C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe" [2007-04-20 10:03 149024]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"nwiz"="nwiz.exe" [2008-05-03 05:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 13:49 36352]
"AsusStartupHelp"="C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe" [2006-11-14 01:25 363008]
"Launch PC Probe II"="C:\Program Files\ASUS\PC Probe II\Probe2.exe" [2006-10-30 22:53 2128896]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 21:34 868352]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"DeathAdder"="C:\Program Files\Razer\DeathAdder\razerhid.exe" [2007-05-07 19:40 159744]
"{67-71-16-61-DW}"="c:\windows\system32\rwwnw64d.exe" [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders schannel.dll, digest.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
–a—— 2007-06-01 12:21 153136 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
–a—— 2007-06-01 12:05 1057328 C:\Program Files\Nero\Nero 7\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a—— 2007-07-18 19:55 451872 C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a—— 2007-03-01 17:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc]
–a—— 2007-06-01 12:06 1629744 C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WireLessKeyboard]
–a—— 2005-11-30 14:48 94208 C:\Program Files\Multimedia Keyboard Application\StartAutorun.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"=
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"=
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\RainbowSixVegas2_SADS.exe"=
"C:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"=

R3 AmdTools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\AmdTools.sys [2007-04-05 16:56]
R3 DAdderFltr;DeathAdder Mouse;C:\WINDOWS\system32\drivers\dadder.sys [2007-04-12 08:46]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - AEC

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 15:21:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\Apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
.
**************************************************************************
.
Completion time: 2008-06-08 15:23:24 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-08 20:23:21
ComboFix2.txt 2008-06-02 11:37:01
ComboFix3.txt 2008-05-31 12:39:17

Pre-Run: 378,325,499,904 bytes free
Post-Run: 378,328,035,328 bytes free

424

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:24:42 PM, on 6/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ASUS\AI Booster\OverClk.exe
C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ASUS\PC Probe II\Probe2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\n00binator\Desktop\F.I.X\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\AI Booster\OverClk.exe"
O4 - HKLM\..\Run: [MaxBlastMonitor.exe] C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKLM\..\Run: [{67-71-16-61-DW}] c:\windows\system32\rwwnw64d.exe DWram
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Rbet] "C:\DOCUME~1\N00BIN~1\APPLIC~1\ASEMBL~1\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [Jcjwu] "C:\Program Files\?dobe\r?ndll32.exe"
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

–
End of file - 6610 bytes

LDTate

Post #10June 8, 2008, 8:37 PM UTC

I'm not sure if your pc will ever be the same.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

smavid

Post #11June 8, 2008, 10:24 PM UTC

SDFix: Version 1.189
Run by [removed] on Sun 06/08/2008 at 05:12 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\DOCUME~1\N00BIN~1\Desktop\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\vntiho01\vntiho011065.exe - Deleted
C:\WINDOWS\system32\vntiho06\vntiho061083.exe - Deleted

Folder C:\WINDOWS\system32\vntiho01 - Removed
Folder C:\WINDOWS\system32\vntiho06 - Removed

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-08 17:16:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:38,07,1a,3b,1e,b7,0e,3b,f0,14,52,b8,9e,2f,a9,97,7e,82,f9,83,2c,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"p0"="C:\Program Files\Alcohol Soft\Alcohol 120\"
"h0"=dword:00000000
"ujdew"=hex:38,07,1a,3b,1e,b7,0e,3b,f0,14,52,b8,9e,2f,a9,97,7e,82,f9,83,2c,..

scanning hidden registry entries …

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire"
"C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe"="C:\\Program Files\\Wolfenstein - Enemy Territory\\ET.exe:*:Enabled:ET"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Game.exe:*:Enabled:Tom Clancy's Rainbow Six Vegas 2"
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\R6Vegas2_Launcher.exe:*:Enabled:Tom Clancy's Rainbow Six Vegas 2 Update"
"C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\RainbowSixVegas2_SADS.exe"="C:\\Program Files\\Ubisoft\\Tom Clancy's Rainbow Six Vegas 2\\Binaries\\RainbowSixVegas2_SADS.exe:*:Enabled:RainbowSixVegas2_SADS"
"C:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe"="C:\\Program Files\\Microsoft Games\\Halo 2\\halo2.exe:*:Enabled:Halo 2"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe"="C:\\Program Files\\Microsoft Games\\Gears of War\\Binaries\\WarGame-G4WLive.exe:*:Enabled:Gears of War"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :

File Backups: - C:\DOCUME~1\N00BIN~1\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 31 May 2008 8 ..SHR — "C:\WINDOWS\system32\67C6F433D4.sys"
Sat 31 May 2008 88 ..SHR — "C:\WINDOWS\system32\FB39D8CA88.sys"
Sat 7 Jun 2008 2,516 A.SH. — "C:\WINDOWS\system32\KGyGaAvL.sys"
Mon 12 Feb 2007 3,096,576 A..H. — "C:\Documents and Settings\n00binator\Application Data\U3\temp\Launchpad Removal.exe"
Tue 13 Sep 2005 4,348 A..H. — "C:\Documents and Settings\n00binator\My Documents\My Music\License Backup\drmv1key.bak"
Mon 24 Jul 2006 20 A..H. — "C:\Documents and Settings\n00binator\My Documents\My Music\License Backup\drmv1lic.bak"
Tue 13 Sep 2005 400 A.SH. — "C:\Documents and Settings\n00binator\My Documents\My Music\License Backup\drmv2key.bak"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:21:43 PM, on 6/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\ASUS\AI Booster\OverClk.exe
C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\ASUS\PC Probe II\Probe2.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Razer\DeathAdder\razerhid.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Razer\DeathAdder\razertra.exe
C:\Program Files\ASUS\AASP\1.00.15\aaCenter.exe
C:\Program Files\Razer\DeathAdder\razerofa.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\n00binator\Desktop\F.I.X\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [Launch Ai Booster] "C:\Program Files\ASUS\AI Booster\OverClk.exe"
O4 - HKLM\..\Run: [MaxBlastMonitor.exe] C:\Program Files\Maxtor\MaxBlast\MaxBlastMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Maxtor\MaxBlast\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Maxtor\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AsusStartupHelp] C:\Program Files\ASUS\AASP\1.00.15\AsRunHelp.exe
O4 - HKLM\..\Run: [Launch PC Probe II] "C:\Program Files\ASUS\PC Probe II\Probe2.exe" 1
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [DeathAdder] C:\Program Files\Razer\DeathAdder\razerhid.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Rbet] "C:\DOCUME~1\N00BIN~1\APPLIC~1\ASEMBL~1\spool32.exe" -vt yazb
O4 - HKCU\..\Run: [Jcjwu] "C:\Program Files\?dobe\r?ndll32.exe"
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Maxtor\Schedule2\schedul2.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

–
End of file - 6693 bytes

LDTate

Post #12June 8, 2008, 10:29 PM UTC

Do you know what all these are that were installed on May 31? 2008-05-31 10:15 d——– C:\WINDOWS\system32\Ucom1 2008-05-31 00:39 . 2008-05-31 00:39 d——– C:\WINDOWS\system32\sIE6 2008-05-31 00:39 . 2008-05-31 00:39 d——– C:\WINDOWS\system32\evd2 2008-05-31 00:39 . 2008-05-31 10:15 d——– C:\WINDOWS\system32\Dev3 2008-05-31 00:39 . 2008-05-31 10:15 d——– C:\WINDOWS\system32\4026c 2008-05-31 22:02 8 -r-hs—- C:\WINDOWS\system32\67C6F433D4.sys 2008-05-31 21:59 . 2008-05-31 21:59 88 -r-hs—- C:\WINDOWS\system32\FB39D8CA88.sys 2008-05-31 21:58 . 2008-05-31 21:59 d——– C:\Documents and Settings\n00binator\Application Data\Corel 2008-05-31 21:58 . 2008-05-31 21:58 d——– C:\Documents and Settings\All Users\Application Data\Corel 2008-05-31 21:57 . 2008-05-31 21:57 d——– C:\Program Files\Common Files\Corel 2008-05-31 21:42 . 2008-05-31 21:57 d——– C:\Program Files\Corel

LDTate

Post #13June 8, 2008, 10:41 PM UTC

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review

****Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze ****

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Give it atleast 20-30 minutes to finish

smavid

Post #14June 8, 2008, 10:44 PM UTC

i dont know the system32/ but the corel is a print shop i DL'ed

LDTate

Post #15June 8, 2008, 10:45 PM UTC

i dont know the system32/
but the corel is a print shop i DL'ed

OK. Run a new combofix scan.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] adwear & Trojan

✨ Ask AI

Ask AI