Spyware / Malware / Virus Removal

[Resolved] Critical Spyware invasion...Help!

12 min read

Looking for the outcome? Ask AI

Heng Topic Starter

Post #1June 7, 2008, 11:20 AM UTC last edited June 7, 2008, 5:37 PM UTC

Hi

I have some spyware invaded my PC. I'm using Windows XP. I have pop up bubble dialogue from system tray warning of spyware infection. The symptom is the same as http://forums.whatthetech.com/Two_Anti_Spy…ray_t91034.html.

Sorry…Before I saw the rules at http://forums.whatthetech.com/Before_Posti…elp_t57813.html, I have did the followings.
I have did the SDFix.exe stated in http://forums.whatthetech.com/Two_Anti_Spy…ray_t91034.html (except for HijackThis portion to do a system scan and Fix checked). I have attached the report.txt.

I have also tried to use Spyware hunter and Ad-Aware SE Personal to remove any spyware found, but it doesn't help at all. They seems to spawn again after the removal.

After reading the instruction at http://forums.whatthetech.com/Before_Posti…elp_t57813.html,
I have just did the ATF cleaner and ran mbam-setup.exe and follow all the instruction given. Attached is the HiJackThis.log and Malwarebytes' Anti-Malware scan log.
I have also attach report.txt from SDFix.exe and some screenshots of the spyware effect.

Now this is the symptom I see

1)The system tray will have some spyware warning poping up every 5 mins or so.
2)The default wallpaper will be changed, even I change it, it will restore back again. (The link will go to a page "about:security", which show the TOP RATED SPYWARE REMOVERS - AntispyStorm 2008 and SpyMaxx). I have attached the picture.
3)Sometime a pop up window will be shown and warning me of some spyware detected in my PC. The picture is also attach.
4)Before I ran ATF cleaner and ran mbam-setup.exe, sometime many windows will pop up to ask for PIN verification. It require me to key in the alphabet that is shown in the pop up window. I can't access anything after this window is popped up as the control is limited to that pop up window only.

Let me if you need anything else. I need your help to get rid of this spyware. Hope you can help. Thanks..

Attachments:

Scotty

Post #2June 7, 2008, 7:49 PM UTC last edited June 7, 2008, 7:54 PM UTC

Hi

before I read your logs, could you do the following

Download Deckard's System Scanner (DSS) to your Desktop. Note: You must be logged onto an account with administrator privileges.

Close all applications and windows.
Double-click on dss.exe to run it, and follow the prompts.
For Vista users, right-click DSS and select Run As Administrator
If asked to install HijackThis click on Yes
When the scan is complete, two text files will open - main.txt <- this one will be maximized and extra.txt<-this one will be minimized
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of main.txt and the extra.txt in your next reply

And please just use "copy and pasting" to put logs and reports in your replies.

Heng

Post #3June 8, 2008, 1:41 PM UTC last edited June 8, 2008, 2:40 PM UTC

Hi Scotty

Thanks for replying. Below is the main.txt and extrat.txt. Some more behaviours I notice are the task manager cannot be activated when I press alt-ctrl delete. Sometime when I reboot PC, there is no icon in the desktop and I can't launch certain program like IE and window explorer. Hear from you again…thanks in advance.

Main.txt :

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-06-08 21:35:57
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.

– Last 5 Restore Point(s) –
49: 2008-06-08 13:36:04 UTC - RP373 - Deckard's System Scanner Restore Point
48: 2008-06-08 13:22:52 UTC - RP372 - System Checkpoint
47: 2008-06-07 09:02:01 UTC - RP371 - Windows Defender Checkpoint
46: 2008-06-07 08:49:32 UTC - RP370 - Windows Defender Checkpoint
45: 2008-06-06 13:42:42 UTC - RP369 - Software Distribution Service 3.0

– First Restore Point –
1: 2008-03-12 15:32:12 UTC - RP325 - Software Distribution Service 3.0

Backed up registry hives.
Performed disk cleanup.

– HijackThis (run as User.exe) ————————————————

Logfile of HijackThis v1.99.1
Scan saved at 9:36:31 PM, on 6/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\User\Application Data\U3\0000060512034867\LaunchPad.exe
C:\Documents and Settings\User\Desktop\dss.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\HIJACK~1\User.exe
C:\WINDOWS\system32\NOTEPAD.EXE

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\iftuyszv.exe,
O2 - BHO: (no name) - {00110011-4b0b-44d5-9718-90c88817369b} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {086ae192-23a6-48d6-96ec-715f53797e85} - (no file)
O2 - BHO: (no name) - {150fa160-130d-451f-b863-b655061432ba} - (no file)
O2 - BHO: (no name) - {17da0c9e-4a27-4ac5-bb75-5d24b8cdb972} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb1} - (no file)
O2 - BHO: (no name) - {1f48aa48-c53a-4e21-85e7-ac7cc6b5ffb2} - (no file)
O2 - BHO: (no name) - {2d38a51a-23c9-48a1-a33c-48675aa2b494} - (no file)
O2 - BHO: (no name) - {2e9caff6-30c7-4208-8807-e79d4ec6f806} - (no file)
O2 - BHO: (no name) - {467faeb2-5f5b-4c81-bae0-2a4752ca7f4e} - (no file)
O2 - BHO: (no name) - {5321e378-ffad-4999-8c62-03ca8155f0b3} - (no file)
O2 - BHO: (no name) - {587dbf2d-9145-4c9e-92c2-1f953da73773} - (no file)
O2 - BHO: (no name) - {6cc1c91a-ae8b-4373-a5b4-28ba1851e39a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {79369d5c-2903-4b7a-ade2-d5e0dee14d24} - (no file)
O2 - BHO: (no name) - {799a370d-5993-4887-9df7-0a4756a77d00} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: as_ie_monitor.ie_monitor - {89AD69EF-A3CD-4A2F-9D65-7D04247B72E3} - C:\Program Files\AntispyStorm\as_ie_monitor.dll (file missing)
O2 - BHO: (no name) - {98dbbf16-ca43-4c33-be80-99e6694468a4} - (no file)
O2 - BHO: (no name) - {a55581dc-2cdb-4089-8878-71a080b22342} - (no file)
O2 - BHO: (no name) - {b847676d-72ac-4393-bfff-43a1eb979352} - (no file)
O2 - BHO: (no name) - {bc97b254-b2b9-4d40-971d-78e0978f5f26} - (no file)
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765721306} - (no file)
O2 - BHO: (no name) - {e2ddf680-9905-4dee-8c64-0a5de7fe133c} - (no file)
O2 - BHO: (no name) - {e3eebbe8-9cab-4c76-b26a-747e25ebb4c6} - (no file)
O2 - BHO: (no name) - {e7afff2a-1b57-49c7-bf6b-e5123394c970} - (no file)
O2 - BHO: (no name) - {fcaddc14-bd46-408a-9842-cdbe1c6d37eb} - (no file)
O2 - BHO: (no name) - {fd9bc004-8331-4457-b830-4759ff704c22} - (no file)
O2 - BHO: (no name) - {ff1bf4c7-4e08-4a28-a43f-9d60a9f7a880} - (no file)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C65 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE /P23 "EPSON Stylus C65 Series" /O6 "USB001" /M "Stylus C65"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - http://www.ilkr.com/update/ansim/ilkactx.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: qomklij - qomklij.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe

– File Associations ———————————————————–

.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*

– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R1 NPPTNT2 - c:\windows\system32\npptnt2.sys

Scotty

Post #4June 8, 2008, 3:03 PM UTC

Hi

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.

Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt back in your next reply.

If you already have Combofix, please delete that copy and download it again as it's being updated regularly.

There is a tutorial on the basic use of Combofix here:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please download Combofix from Bleeping Computer.

If you can't download it from there, please try these 2 alternative sites:

Forospyware
Geeks to Go

Save it to your Desktop.
Disconnect from the Internet.
Click on this LINK to disable AVG & Windows Defender
Click Start>Run copy/paste or type "%userprofile%\desktop\combofix.exe" /killall into the Run box and click OK.
When finished, it shall produce a log for you. Post that log in your next reply with a new HijackThis log.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply post:
Report.txt
ComboFix.txt
New HijackThis log taken after the above scan has run

Heng

Post #5June 9, 2008, 2:27 PM UTC

Hi Scotty

Below are the logs.

report.txt

SDFix: Version 1.189
Run by [removed] on Mon 06/09/2008 at 09:54 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default Desktop Wallpaper

Rebooting

Checking Files :

Trojan Files Found:

C:\WINDOWS\x.exe - Deleted
C:\WINDOWS\y.exe - Deleted
C:\WINDOWS\accesss.exe - Deleted
C:\WINDOWS\astctl32.ocx - Deleted
C:\WINDOWS\avpcc.dll - Deleted
C:\WINDOWS\clrssn.exe - Deleted
C:\WINDOWS\cpan.dll - Deleted
C:\WINDOWS\ctfmon32.exe - Deleted
C:\WINDOWS\ctrlpan.dll - Deleted
C:\WINDOWS\default.htm - Deleted
C:\WINDOWS\directx32.exe - Deleted
C:\WINDOWS\dnsrelay.dll - Deleted
C:\WINDOWS\editpad.exe - Deleted
C:\WINDOWS\explore.exe - Deleted
C:\WINDOWS\explorer32.exe - Deleted
C:\WINDOWS\funniest.exe - Deleted
C:\WINDOWS\funny.exe - Deleted
C:\WINDOWS\gfmnaaa.dll - Deleted
C:\WINDOWS\helpcvs.exe - Deleted
C:\WINDOWS\iedll.exe - Deleted
C:\WINDOWS\iexplorer.exe - Deleted
C:\WINDOWS\inetinf.exe - Deleted
C:\WINDOWS\internet.exe - Deleted
C:\WINDOWS\loader.exe - Deleted
C:\WINDOWS\msconfd.dll - Deleted
C:\WINDOWS\msspi.dll - Deleted
C:\WINDOWS\mssys.exe - Deleted
C:\WINDOWS\msupdate.exe - Deleted
C:\WINDOWS\mswsc10.dll - Deleted
C:\WINDOWS\mswsc20.dll - Deleted
C:\WINDOWS\mtwirl32.dll - Deleted
C:\WINDOWS\notepad32.exe - Deleted
C:\WINDOWS\olehelp.exe - Deleted
C:\WINDOWS\qttasks.exe - Deleted
C:\WINDOWS\quicken.exe - Deleted
C:\WINDOWS\rundll16.exe - Deleted
C:\WINDOWS\rundll32.vbe - Deleted
C:\WINDOWS\searchword.dll - Deleted
C:\WINDOWS\sistem.exe - Deleted
C:\WINDOWS\svchost32.exe - Deleted
C:\WINDOWS\svcinit.exe - Deleted
C:\WINDOWS\systeem.exe - Deleted
C:\WINDOWS\systemcritical.exe - Deleted
C:\WINDOWS\time.exe - Deleted
C:\WINDOWS\users32.exe - Deleted
C:\WINDOWS\waol.exe - Deleted
C:\WINDOWS\win32e.exe - Deleted
C:\WINDOWS\win64.exe - Deleted
C:\WINDOWS\winajbm.dll - Deleted
C:\WINDOWS\window.exe - Deleted
C:\WINDOWS\winmgnt.exe - Deleted
C:\WINDOWS\xplugin.dll - Deleted
C:\WINDOWS\xxxvideo.hta - Deleted

Removing Temp Files

ADS Check :

Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 21:58:00
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden services & system hive …

scanning hidden registry entries …

scanning hidden files …

C:\WINDOWS\default.htm 2017 bytes
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Warcraft 3 : The Frozen Throne by FFF.zip 3814 bytes hidden from API

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 2

Remaining Services :

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Baidu\\BaiduX\\BaiduX.exe"="C:\\Program Files\\Baidu\\BaiduX\\BaiduX.exe:*:Enabled:BaiduX"
"C:\\Program Files\\Silkroad\\SRO_Client.exe"="C:\\Program Files\\Silkroad\\SRO_Client.exe:*:Enabled:SRO_Client"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Silkroad\\SilkErrSender.exe"="C:\\Program Files\\Silkroad\\SilkErrSender.exe:*:Enabled:FTPSender MFC ?? ????"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\nss4.tmp\\utorrent.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\nss4.tmp\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:BitTorrent DNA"
"C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"C:\\DOCUME~1\\User\\LOCALS~1\\Temp\\win23C.exe"="C:\\DOCUME~1\\User\\LOCALS~1\\Temp\\win23C.exe:*:Enabled:win23C"
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"="C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Documents and Settings\\User\\Local Settings\\Temp\\nsi3.tmp\\utorrent.exe"="C:\\Documents and Settings\\User\\Local Settings\\Temp\\nsi3.tmp\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe:*:Enabled:DNA"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

Remaining Files :

C:\WINDOWS\x.exe Found
C:\WINDOWS\y.exe Found
C:\WINDOWS\accesss.exe Found
C:\WINDOWS\astctl32.ocx Found
C:\WINDOWS\avpcc.dll Found
C:\WINDOWS\clrssn.exe Found
C:\WINDOWS\cpan.dll Found
C:\WINDOWS\ctfmon32.exe Found
C:\WINDOWS\ctrlpan.dll Found
C:\WINDOWS\default.htm Found
C:\WINDOWS\directx32.exe Found
C:\WINDOWS\dnsrelay.dll Found
C:\WINDOWS\editpad.exe Found
C:\WINDOWS\explore.exe Found
C:\WINDOWS\explorer32.exe Found
C:\WINDOWS\funniest.exe Found
C:\WINDOWS\funny.exe Found
C:\WINDOWS\gfmnaaa.dll Found
C:\WINDOWS\helpcvs.exe Found
C:\WINDOWS\iedll.exe Found
C:\WINDOWS\iexplorer.exe Found
C:\WINDOWS\inetinf.exe Found
C:\WINDOWS\internet.exe Found
C:\WINDOWS\loader.exe Found
C:\WINDOWS\msconfd.dll Found
C:\WINDOWS\msspi.dll Found
C:\WINDOWS\mssys.exe Found
C:\WINDOWS\msupdate.exe Found
C:\WINDOWS\mswsc10.dll Found
C:\WINDOWS\mswsc20.dll Found
C:\WINDOWS\mtwirl32.dll Found
C:\WINDOWS\notepad32.exe Found
C:\WINDOWS\olehelp.exe Found
C:\WINDOWS\qttasks.exe Found
C:\WINDOWS\quicken.exe Found
C:\WINDOWS\rundll16.exe Found
C:\WINDOWS\rundll32.vbe Found
C:\WINDOWS\searchword.dll Found
C:\WINDOWS\sistem.exe Found
C:\WINDOWS\svchost32.exe Found
C:\WINDOWS\svcinit.exe Found
C:\WINDOWS\systeem.exe Found
C:\WINDOWS\systemcritical.exe Found
C:\WINDOWS\time.exe Found
C:\WINDOWS\users32.exe Found
C:\WINDOWS\waol.exe Found
C:\WINDOWS\win32e.exe Found
C:\WINDOWS\win64.exe Found
C:\WINDOWS\winajbm.dll Found
C:\WINDOWS\window.exe Found
C:\WINDOWS\winmgnt.exe Found
C:\WINDOWS\xplugin.dll Found
C:\WINDOWS\xxxvideo.hta Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Sat 8 Dec 2007 6,565 ..SH. — "C:\WINDOWS\system32\mpqss.tmp"
Sat 8 Dec 2007 6,495 ..SH. — "C:\WINDOWS\system32\mpqss.bak1"
Wed 11 Apr 2007 4,348 A.SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 13 Apr 2007 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sun 28 Oct 2007 20,222,992 A..H. — "C:\Documents and Settings\User\Local Settings\Temp\BIT2.tmp"
Mon 13 Nov 2006 319,456 A..H. — "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Thu 8 May 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\385cb67dda0ffd4dea8c0d990dc65796\BIT2.tmp"

Finished!

ComboFix.txt

ComboFix 08-06-08.5 - User 2008-06-09 22:15:12.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.743 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\desktop\ComboFix.exe
Command switches used :: /killall
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\User\Application Data\Microsoft\dtsc
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\!Tankz Battle in the City v1.1 for PalmOS.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\007 Stealth Activity Recorder and Reporter (STARR) 2.21 Keygen.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\1click.dvd.copy.4.1.0.6.cracked-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\1st.Go.Warkanoid.II.Total v2.7.7.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\2005.exe
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\21 Solitaire V1.0.0.0.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\21 Solitaire V1.0.0.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\3D Stroke v1.0.1 for Adobe After Effects by TrapCode.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\3D Stroke v1.0.1 for Adobe After Effects by TrapCode.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\3DMobiles ScreenSaver v1.0.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\3DMobiles ScreenSaver v1.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\4Team for Microsoft Outlook 2002 v1.50.0202 Retail.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\5 Min Scrabble v1.3 keygen by CORE.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ABBYY FineReader 6 Time Reset.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Able2Extract v2.00.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Able2Extract v2.00.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Accent Access Password Recovery 1.01.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ACDSee32.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Adobe Premiere Interface Improver v1.5.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Adobe.Photoshop.9.Acrobat.7.0.Pro.Illustrator.InDesign.GoLive.CS2.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Adobe.Photoshop.CS3.Extended.Keymaker.Only-ZWT.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Adobe.Photoshop.CS3.Standard.Keymaker.Only.Plus.DIRFIX-ZWT.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Adobe.Photoshop.v7.0.ME by SSG.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Advanced WordPerfect Office Password Recovery v1.12.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Age of Empires - der Aufstieg Roms expansion by DBC.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\alawar burger shop by jonezcracker.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\alawar burger shop by jonezcracker.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\alcohol.120.1.9.5.3105.trial.patch-tsrh.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\alcohol.120.1.9.5.3105.trial.patch-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Allok.AVI.MPEG.Converter.1.2.8 CRK-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Babylon-Pro 5.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Bejeweled Deluxe v1.86 (23.07.03).zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Big.Fish.Games.-.Ancient.Tripeaks.II CRKEXE-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\BitDefender Plus 10 (Build 108) - By KoSVoCoRE.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\BitDefender Total Security 2008 crack by afshin alami.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Building Dynamic Web Sites with Macromedia Studio MX 2004 - eBook.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CakeWalk Sonar 1.0 Demo.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Camnetics GearTrax AI for AutoDesk Inventor 7 v2003.70.420.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CD Data Rescue1.0 b0626 by DBC.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CD Space Virtual CD-ROM Drive v1.95.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CD Space Virtual CD-ROM Drive v1.95.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CFATest by DBC.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Clone-Cd V3.2.1.1 Reg-Maker by DBC.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CodeWarrior for Symbian Personal v2.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Coding Workshop Ringtone Converter v3.3.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Command.And.Conquer.The.First.Decade.GENERIC KEYGEN-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Cooking.Academy.Patch.By.Amin Fear.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Corel WordPerfect Office X3 13.0.0.565 - Bidjan.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\CounterSpy Version 1.5x.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Cyberlink Powerdvd 8 Beta Patch By team Black_X.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Cyberlink Powerdvd 8 Beta Patch By team Black_X.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Diner.Dash.Flo.On.The.Go.From.Reflexive.TFT.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Download Accelerator Plus (DAP) All Versions.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\dream.aquarium.1.0170.read.nfo.full-tsrh.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\dream.aquarium.1.0170.read.nfo.full-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\DreamWeaver V1.28.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Easy Award TuneUp 98.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Easy CD-DA Extractor v4.3.3.10.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Easy CD-DA Extractor v4.3.3.10.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Elite.Keylogger.v3.5.build.087_CRKEXE-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Eset NOD32 Antivirus v2.000.6.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\FavGo v1.0 for PalmOS.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Feeding Frenzy v2.4.2.1.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Folder Lock 5.9.0 Loader Installer By Under SEH Team.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\FolderLock v1.1.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Fraps v2.0.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\GameHouse Westward Serial by BalCrNepal.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\GameHouse Westward Serial by BalCrNepal.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Handy Recovery v2.0.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Hitman - Codename 47 v1.2.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\HollywoodFX 4.5.2.25 Gold.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ImTOO.iPod.movie.Converter.2.1.55 KEYGEN-FFF.torrent
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ImTOO.iPod.movie.Converter.2.1.55 KEYGEN-FFF.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ImTOO.iPod.movie.Converter.2.1.55 KEYGEN-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Insaniquarium Deluxe.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Insaniquarium Deluxe.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\instant LOCK 2.5 - 3.x All Versions.by.FOFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Internet Download Manager 5.12 crack.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\InterVideo WinDVD Platinum v5.0.26.007 by UnderPl.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Intervideo WinDVD v4.0.11.187 Plus by CORE.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Anti-Virus Personal Pro v4.0.6.0 by LASH.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Anti-Virus Personal Pro v4.0.6.0 by LASH.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Antivirus Personal Pro 4.0.9 2007 year.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Internet Security 7.0.0.125 reg file.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Internet Security 7.0.1.321 Key By Mohammad Kavussi.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kaspersky Internet Security 7.0.1.325 Key By Mohammad Kavussi.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kudos Rock Legend From Reflexive Arcades by TFT-TEAM.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Kudos Rock Legend From Reflexive Arcades by TFT-TEAM.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Macromedia.Flash.Professionnal.Trial.8.0.0.478 CRK-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\MagixMP3Maker Light Platinium v3.04 - v3.05 all languages by MP2K.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\MATLAB 5.1+.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\MATLAB 5.1+.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Muvee Autoproducer 2.1.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Nero-Burning Rom v5.5.7.8.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Nikon.Capture.4.2 CRK-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\NJStar Chinese WP 4.33 by DBC.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Norton Antivirus 2001 v.7.00.32-v.7.00.43(Fixed).zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Outpost Firewall Pro 2.0.225.2919.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\pc.pitstop.optimize.1.0.0.12.crack-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Pinnacle 52 Professional Development System.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Pinnacle 52 Professional Development System.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Pinnacle Studio Plus 10.5.2785. - Bidjan.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\PowerDVD5 Deluxe AllLangage by LiQuiD.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\PQ PSP Movie Creator 2.0 Build 04 - Bidjan.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\ProEQ Plugin for Cool Edit 2000 v1.1 by Crack Demon.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\RegCure.1.x.x.x-Patch_CiM.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Registry.Booster.1.3 CRKEXE-FFF.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Registry.Booster.1.3 CRKEXE-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\s
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Sothink SWF Decompiler MX 2002 30212 Trial by Bidjan.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\SpeedUpMyPC 1.16 by TSRh.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\SpeedUpMyPC 1.16 by TSRh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Spyware Doctor v4.0.0.2613.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Spyware Doctor v4.0.0.2613.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Stellar Phoenix FAT and NTFS v2.1.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\swish.2.01.esp.2003.05.20.cracked-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Tally ees v6.3 Release 1.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\The.Lord.Of.The.Rings.The.Battle.For.Middle-Earth.II.BETA KEYGEN-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\TOTAL VIDEO CONVERTER 3.12 SERIAL NUMBER BY PARAG.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Trojan.Remover.v3.4.4.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\tuneup.utilities.2007.keygen-tsrh.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\TweakNow.RegCleaner.Pro.2.51 CRK-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Ulead VideoStudio 11 Japanese - Bidjan.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Ulead VideoStudio v8.00.100.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\UltraEdit-32 - v8.00.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Virtual DJ v5.0 - Remove Time Trial - by LovePascal.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Visual.CertExam.Suite.1.9.815 CRK-FFF.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Warcraft 3
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\window vista ultimate carck.zip~
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\WINDOWS VISTA proper activation crack. (ACTIVATES windows vista no timer stop carp**!) 100% legit.torrent
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\WINDOWS VISTA proper activation crack. (ACTIVATES windows vista no timer stop carp**!) 100% legit.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Xilisoft.3GP.Video.Converter.2.x-KeyGen-CiM.zip
C:\Documents and Settings\User\Application Data\Microsoft\dtsc\Xilisoft.3GP.Video.Converter.2.x-KeyGen-CiM.zip~
C:\Program Files\baidu
C:\Program Files\baidu\BaiduX\Download\òÔÁúÌÚÔÆÊ½.wmv
C:\Program Files\baidu\BaiduX\Download\Äæ¹â-ËïÑà×Ë.wmv
C:\Program Files\baidu\BaiduX\Download\Éä¾«µÄ¼¼ÇÉ(Ö§³ÖÏÂ°É).wmv
C:\Program Files\baidu\BaiduX\Download\ÔõÑùÑÓ³¤ÐÔ½»µÄÊ±¼ä£¿.wmv
C:\Program Files\baidu\BaiduX\Download\Æ¯Á÷ÓûÊÒ.wmv
C:\Program Files\baidu\BaiduX\Download\Å®ÐÔ×ÔÎ¿¼¼ÇÉ.wmv
C:\Program Files\baidu\BaiduX\Download\Î÷ºþÊ¤¾° Ë«·å²åÔÆ.wmv
C:\Program Files\baidu\BaiduX\Download\°®µÄÉ«·Å.wmv
C:\Program Files\baidu\BaiduX\Download\¡¶Ä§¹íÌìÊ¹¡·Ãâ·Ñ°æ1.wmv
C:\Program Files\baidu\BaiduX\Download\¡¶Ä§¹íÌìÊ¹¡·Ãâ·Ñ°æ2.wmv
C:\WINDOWS\accesss.exe
C:\WINDOWS\astctl32.ocx
C:\WINDOWS\avpcc.dll
C:\WINDOWS\BM2f811de9.xml
C:\WINDOWS\clrssn.exe
C:\WINDOWS\cpan.dll
C:\WINDOWS\ctfmon32.exe
C:\WINDOWS\ctrlpan.dll
C:\WINDOWS\default.htm
C:\WINDOWS\directx32.exe
C:\WINDOWS\dnsrelay.dll
C:\WINDOWS\editpad.exe
C:\WINDOWS\explore.exe
C:\WINDOWS\explorer32.exe
C:\WINDOWS\funniest.exe
C:\WINDOWS\funny.exe
C:\WINDOWS\gfmnaaa.dll
C:\WINDOWS\helpcvs.exe
C:\WINDOWS\iedll.exe
C:\WINDOWS\iexplorer.exe
C:\WINDOWS\inetinf.exe
C:\WINDOWS\internet.exe
C:\WINDOWS\loader.exe
C:\WINDOWS\mainms.vpi
C:\WINDOWS\msconfd.dll
C:\WINDOWS\msspi.dll
C:\WINDOWS\mssys.exe
C:\WINDOWS\msupdate.exe
C:\WINDOWS\mswsc10.dll
C:\WINDOWS\mswsc20.dll
C:\WINDOWS\mtwirl32.dll
C:\WINDOWS\notepad32.exe
C:\WINDOWS\olehelp.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\qttasks.exe
C:\WINDOWS\quicken.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundll32.vbe
C:\WINDOWS\searchword.dll
C:\WINDOWS\sistem.exe
C:\WINDOWS\svchost32.exe
C:\WINDOWS\svcinit.exe
C:\WINDOWS\systeem.exe
C:\WINDOWS\system32\ckgqkyqa.dll
C:\WINDOWS\system32\jkkIYppn.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mpqss.bak1
C:\WINDOWS\system32\mpqss.ini
C:\WINDOWS\system32\mpqss.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\nppYIkkj.ini
C:\WINDOWS\system32\nppYIkkj.ini2
C:\WINDOWS\system32\ubakrnqg.dll
C:\WINDOWS\systemcritical.exe
C:\WINDOWS\time.exe
C:\WINDOWS\users32.exe
C:\WINDOWS\waol.exe
C:\WINDOWS\win32e.exe
C:\WINDOWS\win64.exe
C:\WINDOWS\winajbm.dll
C:\WINDOWS\window.exe
C:\WINDOWS\winmgnt.exe
C:\WINDOWS\x.exe
C:\WINDOWS\xplugin.dll
C:\WINDOWS\xxxvideo.hta
C:\WINDOWS\y.exe

.
((((((((((((((((((((((((( Files Created from 2008-05-09 to 2008-06-09 )))))))))))))))))))))))))))))))
.

2008-06-09 22:17 . 2008-06-09 22:17 d——– C:\WINDOWS\system32\8877
2008-06-08 21:35 . 2008-06-08 21:35 d——– C:\Deckard
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\User\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-05 16:04 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 01:04 . 2008-06-05 16:04 15,864 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 01:03 . 2008-06-08 01:03 d——– C:\Program Files\Common Files\Download Manager
2008-06-07 18:29 . 2008-06-07 18:29 d——– C:\WINDOWS\ERUNT
2008-06-07 18:23 . 2008-06-09 21:59 d——– C:\SDFix
2008-06-07 18:00 . 2008-06-08 00:42 d——– C:\Documents and Settings\User\Application Data\uTorrent
2008-06-07 17:48 . 2008-06-09 21:57 d——– C:\WINDOWS\system32\6575
2008-06-07 17:48 . 2008-06-07 17:48 55,808 –a—— C:\WINDOWS\portsv.exe
2008-06-07 17:41 . 2008-06-07 17:41 d——– C:\Documents and Settings\User\Application Data\Lavasoft
2008-06-07 17:40 . 2008-06-07 17:40 d——– C:\Program Files\Lavasoft
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\urlbase.bin
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\ignoredomainsbase.bin
2008-06-07 16:49 . 2008-06-07 16:49 d——– C:\WINDOWS\system32\zabD
2008-06-07 16:49 . 2008-06-07 16:49 d——– C:\WINDOWS\system32\izo
2008-06-07 16:48 . 2008-06-07 16:48 87,511 –a—— C:\WINDOWS\system32\iftuyszv.exe
2008-06-07 16:48 . 2008-06-07 16:48 49,158 –a—— C:\WINDOWS\444.0
2008-05-25 22:00 . 2008-06-09 22:17 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-05-25 22:00 . 2008-05-25 22:00 1,409 –a—— C:\WINDOWS\QTFont.for
2008-05-19 18:36 . 2008-05-19 18:36 268 –ah—– C:\sqmdata19.sqm
2008-05-19 18:36 . 2008-05-19 18:36 244 –ah—– C:\sqmnoopt19.sqm
2008-05-16 16:24 . 2008-05-16 16:24 d——– C:\Program Files\IKEA Home Planner
2008-05-16 16:24 . 1999-12-17 10:13 86,016 –a—— C:\WINDOWS\unvise32.exe
2008-05-10 00:14 . 2008-05-10 00:15 d——– C:\Documents and Settings\All Users\Application Data\WinZip

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-09 14:09 ——— d—–w C:\Documents and Settings\User\Application Data\DNA
2008-06-09 14:04 ——— d—–w C:\Documents and Settings\User\Application Data\U3
2008-06-07 09:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-06-07 08:52 ——— d—–w C:\Documents and Settings\User\Application Data\BitTorrent
2008-06-04 11:01 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-04-13 14:36 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2007-11-19 04:31 3,686,400 —-a-w C:\Program Files\Shortcut to IKEA Home Planner.lnk
2006-10-02 15:15 39,064 —-a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 07:00 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD69EF-A3CD-4A2F-9D65-7D04247B72E3}]
C:\Program Files\AntispyStorm\as_ie_monitor.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 20:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-10 16:01 289088]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 20:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-08 14:54 7630848]
"nwiz"="nwiz.exe" [2006-08-08 14:54 1519616 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-06-01 17:22 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-06-01 17:22 69632]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"EPSON Stylus C65 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.exe" [2003-11-27 02:00 99840]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-08 14:54 86016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-03 00:37 579072]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 17:37 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomklij]
qomklij.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Silkroad\\SRO_Client.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Silkroad\\SilkErrSender.exe"=
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=

R2 PlugPlayRPC;Plug and Play (RPC);C:\WINDOWS\portsv.exe service []
S3 BTCFilterService;USB Networking Driver Filter Service;C:\WINDOWS\system32\DRIVERS\motfilt.sys [2007-01-23 22:36]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\WINDOWS\system32\DRIVERS\Motousbnet.sys [2007-01-23 22:36]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 03:49:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-09 22:17:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\portsv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-06-09 22:19:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-09 14:19:11

Pre-Run: 66,955,743,232 bytes free
Post-Run: 67,534,970,880 bytes free

351 — E O F — 2008-06-06 13:42:50

hijackthis.log

Logfile of HijackThis v1.99.1
Scan saved at 22:21, on 2008-06-09
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: as_ie_monitor.ie_monitor - {89AD69EF-A3CD-4A2F-9D65-7D04247B72E3} - C:\Program Files\AntispyStorm\as_ie_monitor.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C65 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE /P23 "EPSON Stylus C65 Series" /O6 "USB001" /M "Stylus C65"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - http://www.ilkr.com/update/ansim/ilkactx.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: qomklij - qomklij.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Plug and Play (RPC) (PlugPlayRPC) - Unknown owner - C:\WINDOWS\portsv.exe

Thanks again.

Scotty

Post #6June 9, 2008, 4:01 PM UTC

Please download this tool from Microsoft.
Double click on MGADiag.exe to run it.
Click Continue.
The program will run. It takes a while to finish the diagnosis, please be patient.
Once done, click on Copy.
Open Notepad and paste the contents in. Save this file and post it in your next reply.

Heng

Post #7June 10, 2008, 1:13 PM UTC

MGADiag.txt Diagnostic Report (1.7.0095.0): —————————————– WGA Data–> Validation Status: Genuine Validation Code: 0 Online Validation Code: N/A Cached Validation Code: N/A Windows Product Key: *****-*****-69QX4-GQVTB-968KB Windows Product Key Hash: wrfxkWEBKzbtU8Y2jeae+GPjdxY= Windows Product ID: 76477-OEM-2171334-21748 Windows Product ID Type: 3 Windows License Type: OEM System Builder Windows OS version: 5.1.2600.2.00010300.2.0.hom CSVLK Server: N/A CSVLK PID: N/A ID: {C257C768-F2CE-46EF-AC80-A4F824AF8BAF}(3) Is Admin: Yes TestCab: 0x0 WGA Version: Registered, 1.7.59.1 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-171-1 Resolution Status: N/A WgaER Data–> ThreatID(s): N/A Version: N/A WGA Notifications Data–> Cached Result: 0 File Exists: Yes Version: 1.7.18.5 WgaTray.exe Signed By: Microsoft WgaLogon.dll Signed By: Microsoft OGA Notifications Data–> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 WGATray.exe Signed By: Microsoft OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data–> Office Status: 114 Blocked VLK 2 Microsoft Office XP Professional with FrontPage - 114 Blocked VLK 2 OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-171-1 Browser Data–> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 7.0; Win32) Default Browser: C:\Program Files\Internet Explorer\IEXPLORE.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data–> Other data–> Office Details: {C257C768-F2CE-46EF-AC80-A4F824AF8BAF}1.7.0095.05.1.2600.2.00010300.2.0.homx32*****-*****-*****-*****-968KB76477-OEM-2171334-217483S-1-5-21-1220945662-1801674531-839522115System manufacturerSystem Product NamePhoenix Technologies, LTDASUS P5NSLI ACPI BIOS Revision 060120060713000000.000000+000450935A70184C06A04090409Malay Peninsula Standard Time(GMT+08:00)03 114

Scotty

Post #8June 10, 2008, 3:17 PM UTC

Hi

I think it is obvious where the infection came from. Take a look here
Click Here
I strongly advise removing anymore you have.

Go to http://virusscan.jotti.org
Copy the following line into the white textbox:
C:\WINDOWS\444.0
Click Submit.
Please post the results of this scan to this thread.

Remember to disconnect from the Internet before carrying out the next instruction, and to save the following script before you do.You must
also manually disable your anti-virus and anti-spyware programs. See the link below for instructions on doing this.
http://www.bleepingcomputer.com/forums/topic114351.html

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

KillAll::

File::
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\WINDOWS\unvise32.exe
 
Folder::
C:\Program Files\AntispyStorm
C:\WINDOWS\system32\zabD
C:\WINDOWS\system32\izo
C:\SDFix

DirLook::
C:\WINDOWS\system32\8877
C:\WINDOWS\system32\6575

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89AD69EF-A3CD-4A2F-9D65-7D04247B72E3}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\qomklij]

Driver::
Plug and Play (RPC)

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

In your next reply post:
Jotti results
ComboFix.txt
New HijackThis log taken after the above scan has run

Heng

Post #9June 11, 2008, 12:06 AM UTC last edited June 11, 2008, 12:08 AM UTC

Hi

I have already try to remove some suspicious software which might be Pirated/Warez/Cracked. Please let me know if there are more. Thanks for the advice. The origin of this spyware invasion was because I was downloading some video clip using bittorrent. After completion, I unzip and click on a .exe file thinking it is a .avi file or something. By the time I realise it and kill the process, it was too late. I guess that's why I have all this problem. I was prompt to download Antispystorm after the invasion too. Now I know is a spyware itself. Anyway below are the logs :

Jotti.txt

Scanner results
Scan taken on 10 Jun 2008 23:40:29 (GMT)
A-Squared Found nothing
AntiVir Found TR/Crypt.EA
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found SHeur.BOXB
BitDefender Found Trojan.Crypt.EA
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found Possibly a new variant of W32/NewMalware-Rootkit-I-based!Maximus
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found Trojan.Crypt.EA
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Sophos Antivirus Found Mal/Heuri-D
VirusBuster Found nothing
VBA32 Found nothing

ComboFix.txt

ComboFix 08-06-08.5 - User 2008-06-11 7:50:34.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.744 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\unvise32.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\SDFix
C:\SDFix\apps\assosfix.reg
C:\SDFix\apps\cliptext.exe
C:\SDFix\apps\download.exe
C:\SDFix\apps\dummy.sys
C:\SDFix\apps\Enable_Command_Prompt.reg
C:\SDFix\apps\ERDNT.E_E
C:\SDFix\apps\ERDNTDOS.LOC
C:\SDFix\apps\ERDNTWIN.LOC
C:\SDFix\apps\ERUNT.EXE
C:\SDFix\apps\ERUNT.LOC
C:\SDFix\apps\fix.reg
C:\SDFix\apps\FixBH.reg
C:\SDFix\apps\FixComponents.reg
C:\SDFix\apps\FIXCU.reg
C:\SDFix\apps\FIXLM.reg
C:\SDFix\apps\FixPath.exe
C:\SDFix\apps\FixRedir.reg
C:\SDFix\apps\FixSchedule.reg
C:\SDFix\apps\FixWebCheck.reg
C:\SDFix\apps\fixXP.reg
C:\SDFix\apps\FixXPsp2.reg
C:\SDFix\apps\grep.exe
C:\SDFix\apps\HPFix.reg
C:\SDFix\apps\HPFix2.reg
C:\SDFix\apps\HPFix3.reg
C:\SDFix\apps\HPFix4.reg
C:\SDFix\apps\HPFix5.reg
C:\SDFix\apps\HPFix6.reg
C:\SDFix\apps\HPFix7.reg
C:\SDFix\apps\HPFix8.reg
C:\SDFix\apps\HPFix9.reg
C:\SDFix\apps\isadmin.exe
C:\SDFix\apps\leg2.txt
C:\SDFix\apps\legacy.txt
C:\SDFix\apps\legacybk.txt
C:\SDFix\apps\locate.com
C:\SDFix\apps\LS.exe
C:\SDFix\apps\MD5File.exe
C:\SDFix\apps\MyGcpvFix.reg
C:\SDFix\apps\MyGkFix2.reg
C:\SDFix\apps\Process.exe
C:\SDFix\apps\procs.exe
C:\SDFix\apps\psservice.exe
C:\SDFix\apps\Rem.txt
C:\SDFix\apps\Rem2.txt
C:\SDFix\apps\Replace\regedit.exe
C:\SDFix\apps\Replace\W2K.exe
C:\SDFix\apps\Replace\w2k\beep.sys
C:\SDFix\apps\Replace\w2k\null.sys
C:\SDFix\apps\Replace\XP.exe
C:\SDFix\apps\Replace\xp\beep.sys
C:\SDFix\apps\Replace\xp\null.sys
C:\SDFix\apps\Reset_AppInit_DLLs.reg
C:\SDFix\apps\RestartIt!.exe
C:\SDFix\apps\Restore_SecurityCenter.reg
C:\SDFix\apps\Restore_SharedAccess.reg
C:\SDFix\apps\sc.exe
C:\SDFix\apps\sed.exe
C:\SDFix\apps\SF.exe
C:\SDFix\apps\shutdown.exe
C:\SDFix\apps\srv2.txt
C:\SDFix\apps\srv2bk.txt
C:\SDFix\apps\svc.txt
C:\SDFix\apps\svcbk.txt
C:\SDFix\apps\swreg.exe
C:\SDFix\apps\swsc.exe
C:\SDFix\apps\unzip.exe
C:\SDFix\apps\vfind.exe
C:\SDFix\apps\WINMSG.EXE
C:\SDFix\apps\winsec.reg
C:\SDFix\apps\zip.exe
C:\SDFix\backups\backupreg.zip
C:\SDFix\backups\backups.zip
C:\SDFix\backups\catchme.log
C:\SDFix\backups\HOSTS
C:\SDFix\backups_old\backupreg.zip
C:\SDFix\backups_old\backups.zip
C:\SDFix\backups_old\catchme.log
C:\SDFix\backups_old\HOSTS
C:\SDFix\catchme.exe
C:\SDFix\dummy.sys
C:\SDFix\Report.txt
C:\SDFix\Report_old_1.txt
C:\SDFix\RunThis.bat
C:\SDFix\SDFIX_ReadMe_Online.url
C:\SDFix\W2K_CodecRepair.inf
C:\SDFix\XP_CodecRepair.inf
C:\sqmdata19.sqm
C:\sqmnoopt19.sqm
C:\WINDOWS\portsv.exe
C:\WINDOWS\system32\iftuyszv.exe
C:\WINDOWS\system32\izo
C:\WINDOWS\system32\zabD
C:\WINDOWS\system32\zabD\antilutx.exe
C:\WINDOWS\unvise32.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_PlugPlayRPC
——-\Service_PlugPlayRPC

((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.

2008-06-10 21:09 . 2008-06-10 21:09 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-06-10 00:06 . 2008-06-11 07:38 d——– C:\WINDOWS\system32\5606
2008-06-09 23:05 . 2008-06-09 23:05 d——– C:\Program Files\Avira
2008-06-09 23:05 . 2008-06-09 23:05 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-06-09 22:17 . 2008-06-09 22:25 d——– C:\WINDOWS\system32\8877
2008-06-08 21:35 . 2008-06-08 21:35 d——– C:\Deckard
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\User\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-05 16:04 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 01:04 . 2008-06-05 16:04 15,864 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 01:03 . 2008-06-08 01:03 d——– C:\Program Files\Common Files\Download Manager
2008-06-07 18:29 . 2008-06-07 18:29 d——– C:\WINDOWS\ERUNT
2008-06-07 18:00 . 2008-06-08 00:42 d——– C:\Documents and Settings\User\Application Data\uTorrent
2008-06-07 17:48 . 2008-06-09 21:57 d——– C:\WINDOWS\system32\6575
2008-06-07 17:41 . 2008-06-07 17:41 d——– C:\Documents and Settings\User\Application Data\Lavasoft
2008-06-07 17:40 . 2008-06-07 17:40 d——– C:\Program Files\Lavasoft
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\urlbase.bin
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\ignoredomainsbase.bin
2008-06-07 16:48 . 2008-06-07 16:48 49,158 –a—— C:\WINDOWS\444.0
2008-05-25 22:00 . 2008-06-11 07:54 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-05-25 22:00 . 2008-05-25 22:00 1,409 –a—— C:\WINDOWS\QTFont.for
2008-05-16 16:24 . 2008-05-16 16:24 d——– C:\Program Files\IKEA Home Planner
2008-05-10 00:14 . 2008-05-10 00:15 d——– C:\Documents and Settings\All Users\Application Data\WinZip

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 23:47 ——— d—–w C:\Documents and Settings\User\Application Data\DNA
2008-06-10 16:01 ——— d—–w C:\Program Files\LimeWire
2008-06-09 14:04 ——— d—–w C:\Documents and Settings\User\Application Data\U3
2008-06-07 09:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-06-07 08:52 ——— d—–w C:\Documents and Settings\User\Application Data\BitTorrent
2008-06-04 11:01 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-04-13 14:36 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-03-27 08:12 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 —-a-w C:\WINDOWS\system32\win32k.sys
2007-11-19 04:31 3,686,400 —-a-w C:\Program Files\Shortcut to IKEA Home Planner.lnk
2006-10-02 15:15 39,064 —-a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 07:00 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

—- Directory of C:\WINDOWS\system32\6575 —-

2008-06-09 21:57 476 -r-hs—- C:\WINDOWS\system32\6575\~!19987p.spt

—- Directory of C:\WINDOWS\system32\8877 —-

((((((((((((((((((((((((((((( snapshot@2008-06-09_22.19.02.26 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-09 14:17:05 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 23:53:06 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-01-21 10:12:56 41,792 —-a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 10:11:28 22,336 —-a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 05:28:53 79,424 —-a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 02:34:22 28,352 —-a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 20:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-10 16:01 289088]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 20:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-08 14:54 7630848]
"nwiz"="nwiz.exe" [2006-08-08 14:54 1519616 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-06-01 17:22 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-06-01 17:22 69632]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"EPSON Stylus C65 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.exe" [2003-11-27 02:00 99840]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-08 14:54 86016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-03 00:37 579072]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 17:37 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Silkroad\\SRO_Client.exe"=
"C:\\Program Files\\Silkroad\\SilkErrSender.exe"=
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=

S3 BTCFilterService;USB Networking Driver Filter Service;C:\WINDOWS\system32\DRIVERS\motfilt.sys [2007-01-23 22:36]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\WINDOWS\system32\DRIVERS\Motousbnet.sys [2007-01-23 22:36]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 03:49:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 07:53:25
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2008-06-11 7:55:36 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-10 23:55:33
ComboFix2.txt 2008-06-09 14:19:14

Pre-Run: 67,423,879,168 bytes free
Post-Run: 67,428,241,408 bytes free

255 — E O F — 2008-06-06 13:42:50

hijackthis.log

Logfile of HijackThis v1.99.1
Scan saved at 07:58, on 2008-06-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\DNA\btdna.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C65 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE /P23 "EPSON Stylus C65 Series" /O6 "USB001" /M "Stylus C65"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - http://www.ilkr.com/update/ansim/ilkactx.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty

Post #10June 11, 2008, 8:23 AM UTC

Hi

This time you need to remain connected to the Internet. When a window opens for file submission, please follow the instructions.

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

http://forums.whatthetech.com/Critical_Spyware_invasion_Help_t92515.html
 
Collect::
C:\WINDOWS\444.0

Folder::
C:\WINDOWS\system32\5606
C:\WINDOWS\system32\8877
C:\WINDOWS\system32\6575

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

Please do an online scan with Kaspersky Online Scanner.
You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then start to download the latest definition files.
Once the scanner is installed and the definitions downloaded, click Next.
Now click on Scan Settings
In the scan settings make sure that the following are selected:
- Scan using the following Anti-Virus database:
  
  + Extended(If available otherwise Standard)
- Scan Options:
  
  + Scan Archives
  + Scan Mail Bases
Click OK
Now under select a target to scan select My Computer
The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button
Save the file to your desktop.
Copy and paste that information in your next post.

With the exception of Internet Explorer, which is needed for the Kaspersky Scan, keep ALL programs closed
until the scan is complete. This includes your anti-virus. Once you have
installed the Scanner, and the updated definitions, you can disconnect from the Internet.Re-enable the anti-virus before reconnecting to the Internet.
Instructions on disabling a variety of security programs can be found at the link below.
http://www.bleepingcomputer.com/forums/topic114351.html

In your next reply post:
ComboFix.txt
Kaspersky report
New HijackThis log taken after the above scan has run

Heng

Post #11June 11, 2008, 12:56 PM UTC last edited June 11, 2008, 3:18 PM UTC

Hi

I do not quite understand your instruction on the part for ComboFix. I submitted the ComboFix.txt instead. Then I found a zip file created in my desktop. I have attached it to his thread in case you need it. Below are the logs :

ComboFix.txt

ComboFix 08-06-08.5 - User 2008-06-11 18:58:22.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.668 [GMT 8:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\User\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\444.0
C:\WINDOWS\system32\5606
C:\WINDOWS\system32\5606\~!22684p.spt
C:\WINDOWS\system32\6575
C:\WINDOWS\system32\6575\~!19987p.spt
C:\WINDOWS\system32\8877

.
((((((((((((((((((((((((( Files Created from 2008-05-11 to 2008-06-11 )))))))))))))))))))))))))))))))
.

2008-06-11 18:56 . 2008-06-11 18:56 d——– C:\WINDOWS\LastGood
2008-06-10 21:09 . 2008-06-10 21:09 d——– C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-06-09 23:05 . 2008-06-09 23:05 d——– C:\Program Files\Avira
2008-06-09 23:05 . 2008-06-09 23:05 d——– C:\Documents and Settings\All Users\Application Data\Avira
2008-06-08 21:35 . 2008-06-08 21:35 d——– C:\Deckard
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\User\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-08 01:04 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-08 01:04 . 2008-06-05 16:04 34,296 –a—— C:\WINDOWS\system32\drivers\mbamcatchme.sys
2008-06-08 01:04 . 2008-06-05 16:04 15,864 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-06-08 01:03 . 2008-06-08 01:03 d——– C:\Program Files\Common Files\Download Manager
2008-06-07 18:29 . 2008-06-07 18:29 d——– C:\WINDOWS\ERUNT
2008-06-07 18:00 . 2008-06-08 00:42 d——– C:\Documents and Settings\User\Application Data\uTorrent
2008-06-07 17:41 . 2008-06-07 17:41 d——– C:\Documents and Settings\User\Application Data\Lavasoft
2008-06-07 17:40 . 2008-06-07 17:40 d——– C:\Program Files\Lavasoft
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\urlbase.bin
2008-06-07 17:06 . 2008-06-07 17:06 0 –a—— C:\Documents and Settings\User\ignoredomainsbase.bin
2008-05-25 22:00 . 2008-06-11 18:54 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-05-25 22:00 . 2008-05-25 22:00 1,409 –a—— C:\WINDOWS\QTFont.for
2008-05-16 16:24 . 2008-05-16 16:24 d——– C:\Program Files\IKEA Home Planner

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-11 00:34 ——— d—–w C:\Documents and Settings\User\Application Data\DNA
2008-06-10 16:01 ——— d—–w C:\Program Files\LimeWire
2008-06-09 14:04 ——— d—–w C:\Documents and Settings\User\Application Data\U3
2008-06-07 09:01 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg7
2008-06-07 08:52 ——— d—–w C:\Documents and Settings\User\Application Data\BitTorrent
2008-06-04 11:01 ——— d—–w C:\Documents and Settings\User\Application Data\LimeWire
2008-05-09 16:15 ——— d—–w C:\Documents and Settings\All Users\Application Data\WinZip
2008-04-13 14:36 ——— d—–w C:\Documents and Settings\User\Application Data\AVG7
2008-03-27 08:12 151,583 —-a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 —-a-w C:\WINDOWS\system32\win32k.sys
2007-11-19 04:31 3,686,400 —-a-w C:\Program Files\Shortcut to IKEA Home Planner.lnk
2006-10-02 15:15 39,064 —-a-w C:\Documents and Settings\User\Application Data\GDIPFONTCACHEV1.DAT
2004-10-01 07:00 40,960 —-a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((( snapshot@2008-06-09_22.19.02.26 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-09 14:17:05 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-11 10:54:14 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-01-21 10:12:56 41,792 —-a-w C:\WINDOWS\system32\drivers\avgntdd.sys
+ 2008-01-21 10:11:28 22,336 —-a-w C:\WINDOWS\system32\drivers\avgntmgr.sys
+ 2008-03-04 05:28:53 79,424 —-a-w C:\WINDOWS\system32\drivers\avipbb.sys
+ 2007-03-01 02:34:22 28,352 —-a-w C:\WINDOWS\system32\drivers\ssmdrv.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 20:00 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 00:24 1694208]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-05-10 16:01 289088]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2006-02-28 20:00 208952]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2006-02-28 20:00 455168]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-08 14:54 7630848]
"nwiz"="nwiz.exe" [2006-08-08 14:54 1519616 C:\WINDOWS\system32\nwiz.exe]
"SW20"="C:\WINDOWS\system32\sw20.exe" [2006-06-01 17:22 208896]
"SW24"="C:\WINDOWS\system32\sw24.exe" [2006-06-01 17:22 69632]
"RemoteControl"="C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"EPSON Stylus C65 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.exe" [2003-11-27 02:00 99840]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-08-08 14:54 86016]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-02-03 00:37 579072]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [ ]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2006-01-12 16:40 155648]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-02-12 10:06 262401]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-12-08 17:37 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.divxa32"= msaud32_divx.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Silkroad\\SRO_Client.exe"=
"C:\\Program Files\\Silkroad\\SilkErrSender.exe"=
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=

S3 BTCFilterService;USB Networking Driver Filter Service;C:\WINDOWS\system32\DRIVERS\motfilt.sys [2007-01-23 22:36]
S3 Motousbnet;Motorola USB Networking Driver Service;C:\WINDOWS\system32\DRIVERS\Motousbnet.sys [2007-01-23 22:36]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-13 03:49:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-11 18:59:34
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-11 19:00:16
ComboFix-quarantined-files.txt 2008-06-11 11:00:03
ComboFix2.txt 2008-06-10 23:55:37
ComboFix3.txt 2008-06-09 14:19:14

Pre-Run: 67,348,541,440 bytes free
Post-Run: 67,342,733,312 bytes free

138 — E O F — 2008-06-06 13:42:50

Kaspersky.txt

——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, June 11, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, June 11, 2008 09:22:20
Records in database: 851314
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 54041
Threat name: 7
Infected objects: 9
Suspicious objects: 0
Duration of the scan: 00:54:16

File name / Threat name / Threats count
C:\Documents and Settings\User\Desktop\[4]-[removed] Infected: Trojan.Win32.DNSChanger.ejb 1
C:\QooBox\Quarantine\C\SDFix\backups_old\backups.zip.vir Infected: Trojan.Win32.Monder.mm 1
C:\QooBox\Quarantine\C\SDFix\backups_old\backups.zip.vir Infected: Trojan-Downloader.Win32.Homles.br 2
C:\QooBox\Quarantine\C\WINDOWS\system32\iftuyszv.exe.vir Infected: not-virus:Hoax.Win32.Renos.cvz 1
C:\QooBox\Quarantine\C\WINDOWS\system32\zabD\antilutx.exe.vir Infected: Trojan-Downloader.Win32.Small.wfv 1
D:\Documents and Settings\User\My Documents\My Software\Application\Nero-6.6.1.15d_wch.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm 1
D:\Documents and Settings\User\My Documents\My Software\Application\Nero-8.1.1.4_all_update.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm 1
D:\Documents and Settings\User\My Documents\My Software\Internet\SpyWare remover\SmitfraudFix.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1

The selected area was scanned.

hijackthis.log

Logfile of HijackThis v1.99.1
Scan saved at 20:50, on 2008-06-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.facebook.com/home.php?
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SW20] C:\WINDOWS\system32\sw20.exe
O4 - HKLM\..\Run: [SW24] C:\WINDOWS\system32\sw24.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [EPSON Stylus C65 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3S2.EXE /P23 "EPSON Stylus C65 Series" /O6 "USB001" /M "Stylus C65"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - http://www.ilkr.com/update/ansim/ilkactx.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Avira AntiVir Personal – Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal – Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Scotty

Post #12June 11, 2008, 3:08 PM UTC

Hi My fault. I didnt post the correct instructions. Just leave things as they are for the moment, while I await further instruction. The zip file was what needed to be uploaded. That isnt a complete Kaspersky report.

Heng

Post #13June 11, 2008, 3:42 PM UTC

Hi No problem at all. Let me know what else I need to do next, will await for your instruction. Thanks alot!

Scotty

Post #14June 11, 2008, 4:52 PM UTC

Do you still have the full Kaspersky report so i can see it?

Heng

Post #15June 12, 2008, 5:41 AM UTC

Hi The only Kaspersky report I have is the Kaspersky.txt I cut and paste and the one I attached in the last reply. If those are not, how can I get the full report?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Critical Spyware invasion...Help!

✨ Ask AI

Ask AI