Spyware / Malware / Virus Removal

[Closed] Getting some IE popups.

11 min read

Looking for the outcome? Ask AI

kaser Topic Starter

Post #1July 19, 2008, 6:53 AM UTC

Hi, been getting a couple IE popups (I don't use IE) lately and thought I'd check in here for some help clearing out some of the mess on my computer.
Spybot S&D just removed SpyHunter by Enigma Software Group from my computer, and I'm thinking that was responsible for at least some of the popups, but if you could look over my HJT log and see if there are any other stuff that needs to be cleansed that'd be nice

Logfile of HijackThis v1.99.1
Scan saved at 8:30:34 AM, on 7/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\Rfvd2g6f.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Scotty

Post #2July 19, 2008, 10:55 AM UTC

Hi! Welcome to the forums.
My name is Scotty. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research.
Please be patient.

Please make a uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.
5. Click on the Save list… button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here in a reply.

kaser

Post #3July 19, 2008, 12:25 PM UTC

Here's the HJT uninstall list: µTorrent Ad-Aware SE Personal Adobe Bridge 1.0 Adobe Common File Installer Adobe Flash Player 9 ActiveX Adobe Flash Player Plugin Adobe Help Center 1.0 Adobe Photoshop CS2 Adobe Reader 7.0.5 Adobe Stock Photos 1.0 Apple Software Update AsusUpdate ATI - Software Uninstall Utility ATI Catalyst Control Center ATI Display Driver Attribute Changer 5.23 AudibleManager Azureus Vuze ConvertXtoDVD 2.2.3.258h Creative MediaSource Creative MediaSource 5 Creative MuVo V100 Creative System Information DAEMON Tools DC++ 0.698 easyIO, ver.2 Enhancement Browser Tools Gooochi EQ Companion 0.796 for Windows XP FLV Player 1.3.3 FLV Player 2.0, build 24 FoxyTunes for Firefox Google Earth Google Gmail Notifier Haali Media Splitter Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows XP (KB926239) J2SE Development Kit 5.0 Update 7 J2SE Runtime Environment 5.0 Update 10 J2SE Runtime Environment 5.0 Update 11 J2SE Runtime Environment 5.0 Update 5 J2SE Runtime Environment 5.0 Update 7 J2SE Runtime Environment 5.0 Update 9 Java™ 6 Update 2 Java™ 6 Update 3 Java™ 6 Update 5 Java™ 6 Update 6 Java™ SE Runtime Environment 6 Java™ SE Runtime Environment 6 Update 1 Kaspersky Online Scanner Lexmark 730 Series LG GSM PC Components Macromedia Dreamweaver 8 Macromedia Extension Manager Malwarebytes' Anti-Malware Matroska Pack Maxtor Manager Maxtor Manager Microsoft .NET Framework 1.1 Microsoft .NET Framework 2.0 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Professional Edition 2003 Microsoft Silverlight Microsoft User-Mode Driver Framework Feature Pack 1.0 mIRC MozBackup 1.4.3 Mozilla Firefox (3.0.1) Mozilla Thunderbird (1.5) MSN Toolbar MSXML 6.0 Parser MySQL Server 5.0 Nero 7 Premium Nokia Connectivity Cable Driver Nokia PC Connectivity Solution Nokia PC Suite OpenOffice.org 2.0 Opera 9.27 PeerGuardian 2.0 PlayNC Launcher PolyView 4.331 Ports Of Call - classic - Windows QuickTime Real Alternative 1.45 RegShot 1.7 Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 10 (KB911565) Security Update for Windows Media Player 10 (KB917734) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB908531) Security Update for Windows XP (KB911280) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911567) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912812) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913446) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB916281) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918439) SigmaTel MSCN Audio Player SmartFTP Client Sony Ericsson PC Suite 1.20.224 SoundMAX Spybot - Search & Destroy Spybot - Search & Destroy 1.5.2.20 SQLTools 1.5 (remove only) Station Launcher SWI-Prolog (remove only) TaskSwitchXP Update for Windows XP (KB900485) Update for Windows XP (KB910437) USB Super Link Vanguard: Saga of Heroes VIA Platform Device Manager VIA Rhine-Family Fast Ethernet Adapter VideoLAN VLC media player 0.8.2 Visual Prolog 7.1 Personal Edition Windows Driver Package - Nokia Modem (04/06/2006 6.8.0.17) Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows Media Player Firefox Plugin WinPcap 4.0.2 WinRAR archiver Zeus for Windows, Version 3.96p

Scotty

Post #4July 19, 2008, 2:20 PM UTC last edited July 19, 2008, 2:21 PM UTC

Hi

Remove programs from Add/Remove Programs List
Please go to:

Start
Control Panel
Add/Remove Programs

Find and remove these programs (if they are present)

Spybot - Search & Destroy <–old version. Leave the other installed.
WinPcap 4.0.2

Delete the older versions of Java and download the newest.
Please follow these steps to remove older version Java components.

Close any programmes you may have running, ESPECIALLY your web browser
Click Start > Control Panel.
Click Add/Remove Programs.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove all versions of Java.
Reboot your computer once all Java components are removed.

Then download the latest version of Java Runtime Environment (JRE) (5th one down the list), which is JRE6u7, and click Yes at the page warning. Under "Platform" select Windows, then check the box to accept the Licence Agreement. Click Yes at the second page warning before downloading the Offline file.
There is no need to download the Sun Download manager but it is optional.

Go to http://virusscan.jotti.org
Type the following line into the white textbox:
C:\WINDOWS\system32\Rfvd2g6f.exe
Click Submit.
Please post the results of this scan to this thread.

If Jotti is busy or unavailable, please try
Virustotal

kaser

Post #5July 19, 2008, 5:38 PM UTC

File: Rfvd2g6f.exe Status: INFECTED/MALWARE (Note: this file has been scanned before. Therefore, this file's scan results will not be stored in the database) MD5: 864f0d4577cd999eaba97ecdb9eaf10e Packers detected: - Scan taken on 19 Jul 2008 17:31:33 (GMT) A-Squared Found nothing AntiVir Found TR/Crypt.ULPM.Gen ArcaVir Found nothing Avast Found Win32:Trojan-gen {Other} AVG Antivirus Found Generic10.BBXO BitDefender Found GenPack:Trojan.Agent.AJEQ ClamAV Found nothing CPsecure Found Troj.Downloader.W32.Agent.vyy Dr.Web Found Trojan.Click.19619 F-Prot Antivirus Found W32/Trojan2.ATAM F-Secure Anti-Virus Found Trojan-Downloader.Win32.Agent.vyy Fortinet Found W32/Agent.VYY!tr.dldr Ikarus Found Trojan.Crypt.ULPM Kaspersky Anti-Virus Found Trojan-Downloader.Win32.Agent.vyy NOD32 Found probably unknown NewHeur_PE (probable variant) Norman Virus Control Found W32/Smalltroj.FJKA Panda Antivirus Found Generic Sophos Antivirus Found Mal/HckPk-A VirusBuster Found nothing VBA32 Found Trojan-Downloader.Win32.Agent.vyy Last file scanned at least one scanner reported something about: server.exe (MD5: 3abc2e73b6c3e8c1d793c0eec509a67d, size: 72259 bytes), detected by: Scanner Malware name A-Squared X AntiVir TR/PSW.LdPinch.TKO ArcaVir X Avast Win32:Ldpinch-CWA AVG Antivirus X BitDefender Backdoor.Bifrost.LZ ClamAV X CPsecure X Dr.Web BackDoor.Bifrost.750 F-Prot Antivirus X F-Secure Anti-Virus X Fortinet X Ikarus Trojan-Dropper.Delf.Crypt.C Kaspersky Anti-Virus X NOD32 X Norman Virus Control W32/LdPinch.dam Panda Antivirus X Sophos Antivirus X VirusBuster Backdoor.Bifrose.EZC VBA32 Trojan-PSW.Win32.LdPinch.vnr You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives We are not affiliated with any third parties that conduct tests using this service.

Scotty

Post #6July 20, 2008, 11:39 AM UTC

Hi

If you already have Combofix, please delete this copy and download it again as it's being updated regularly.

Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once Recovery Console is installed, you should see a blue screen prompt like the one below:

[external image: Posted Image]

Click Yes to allow Combofix to continue scanning for malware.

When done, a log will be produced. Please post that log and a new HijackThis log in your next reply.

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

kaser

Post #7July 20, 2008, 3:43 PM UTC

ComboFix log:

ComboFix 08-07-19.1 - Administrator 2008-07-20 17:32:01.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.623 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\Microsoft\dtsc
C:\Documents and Settings\Administrator\Application Data\Microsoft\dtsc\7867.exe
C:\Documents and Settings\Administrator\Application Data\Microsoft\dtsc\id
C:\WINDOWS\astctl32.ocx
C:\WINDOWS\ctfmon32.exe
C:\WINDOWS\ctrlpan.dll
C:\WINDOWS\directx32.exe
C:\WINDOWS\dnsrelay.dll
C:\WINDOWS\editpad.exe
C:\WINDOWS\explorer32.exe
C:\WINDOWS\funniest.exe
C:\WINDOWS\funny.exe
C:\WINDOWS\gfmnaaa.dll
C:\WINDOWS\helpcvs.exe
C:\WINDOWS\inetinf.exe
C:\WINDOWS\internet.exe
C:\WINDOWS\msconfd.dll
C:\WINDOWS\msspi.dll
C:\WINDOWS\mswsc10.dll
C:\WINDOWS\mswsc20.dll
C:\WINDOWS\qttasks.exe
C:\WINDOWS\quicken.exe
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundll32.vbe
C:\WINDOWS\searchword.dll
C:\WINDOWS\sistem.exe
C:\WINDOWS\svchost32.exe
C:\WINDOWS\svcinit.exe
C:\WINDOWS\time.exe
G:\Autorun.inf
I:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-06-20 to 2008-07-20 )))))))))))))))))))))))))))))))
.

2008-07-19 19:27 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-07-19 19:26 . 2008-07-19 19:26 d——– C:\Program Files\Common Files\Java
2008-07-19 01:52 . 2008-07-19 01:52 0 –a—— C:\WINDOWS\system32\Rfvd2g6f.exe.a_a
2008-07-18 23:52 . 2008-07-20 01:22 35,842 –a—— C:\WINDOWS\system32\Rfvd2g6f.exe
2008-07-18 23:39 . 2008-07-18 23:38 29,760 –a—— C:\WINDOWS\system32\0DONNgUH.exe
2008-07-18 23:39 . 2008-07-18 23:39 0 –a—— C:\WINDOWS\system32\0DONNgUH.exe.a_a
2008-07-07 17:52 . 2006-03-13 17:50 87,824 -ra—— C:\WINDOWS\system32\drivers\w300mgmt.sys
2008-07-07 17:45 . 2006-03-13 17:50 85,696 -ra—— C:\WINDOWS\system32\drivers\w300obex.sys
2008-07-07 17:44 . 2006-03-13 17:50 96,352 -ra—— C:\WINDOWS\system32\drivers\w300mdm.sys
2008-07-07 17:44 . 2006-03-13 17:50 9,264 -ra—— C:\WINDOWS\system32\drivers\w300mdfl.sys
2008-07-07 17:44 . 2006-03-13 17:49 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cmnt.sys
2008-07-07 17:44 . 2006-03-13 17:49 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cm.sys
2008-06-22 03:42 . 2008-06-22 03:42 d——– C:\YouPlayer lister
2008-06-22 03:09 . 2008-06-22 03:09 d——– C:\Documents and Settings\Administrator\dwhelper
2008-06-22 00:51 . 2008-06-22 00:53 d——– C:\Program Files\Zeus
2008-06-22 00:50 . 2008-06-22 00:51 d——– C:\Program Files\HTML IDE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-20 15:16 ——— d—–w C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2008-07-20 14:24 ——— d—–w C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-07-20 13:23 ——— d—–w C:\Program Files\mIRC
2008-07-19 17:27 ——— d—–w C:\Program Files\Java
2008-07-19 15:04 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-07-19 14:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-19 07:08 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-07-19 06:30 ——— d—–w C:\Program Files\Enigma Software Group
2008-07-18 22:22 ——— d—–w C:\Program Files\divprog
2008-07-10 16:07 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Vso
2008-07-05 07:47 ——— d—–w C:\Program Files\Lx_cats
2008-07-01 17:23 ——— d—–w C:\Program Files\uTorrent
2008-06-01 09:27 ——— d—–w C:\Program Files\FLV Player
2008-05-28 20:14 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 20:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 20:14 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-05-27 01:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-17 23:21 795,278,976 —-a-w C:\Program Files\ADBEILSTCS3_WWE.exe
2007-12-25 16:59 67,196,968 —-a-w C:\Program Files\directx_nov2007_redist.exe
2007-12-13 07:54 47,360 —-a-w C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2007-10-21 15:33 80,689,382 —-a-w C:\Program Files\sqldeveloper-1.2.1.3213.zip
2006-10-25 23:28 7,168 —-a-w C:\Documents and Settings\Administrator\queue.dat
2006-10-25 23:28 1,683,456 —-a-w C:\Documents and Settings\Administrator\FahCore_82.exe
.

((((((((((((((((((((((((((((( snapshot@2008-05-27_ 3.28.46.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 06:00:00 28,160 —-a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,672 —-a-w C:\WINDOWS\Nircmd.exe
+ 2008-05-05 18:46:32 15,864 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
+ 2008-05-05 18:46:36 27,048 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
- 2008-02-22 00:23:35 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-06-09 23:21:01 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2008-02-22 00:23:39 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-09 23:21:04 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-22 01:33:32 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 00:32:34 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 10:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 13:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 13:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-01-02 14:05:27 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-06-24 15:54:26 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
- 2007-03-02 02:12:50 37,412 —ha-w C:\WINDOWS\system32\mlfcache.dat
+ 2008-06-08 20:05:20 37,412 —ha-w C:\WINDOWS\system32\mlfcache.dat
- 2008-05-27 00:21:39 61,860 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-13 16:21:24 61,860 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-27 00:21:40 401,018 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-13 16:21:24 401,018 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-10-05 09:52 98304]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48 479232]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 08:57 143360]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 19:47 73728]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 15:53 169264]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17 159744]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"P17Helper"="P17.dll" [2005-05-03 19:38 64512 C:\WINDOWS\system32\P17.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-06-27 23:58:04 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\ABC\\abc.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18772:TCP"= 18772:TCP:BitComet 18772 TCP
"18772:UDP"= 18772:UDP:BitComet 18772 UDP
"51123:TCP"= 51123:TCP:*:Disabled:abc
"51124:TCP"= 51124:TCP:*:Disabled:ab124
"51125:TCP"= 51125:TCP:*:Disabled:ab125
"51126:TCP"= 51126:TCP:*:Disabled:ab126

R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-10-31 12:22]
R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 13:24]
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys [2003-06-02 22:28]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 17:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 17:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 17:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 17:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 17:50]
.
Contents of the 'Scheduled Tasks' folder
"2008-07-19 22:36:01 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 07:00:01 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 08:00:02 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 09:00:01 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 10:00:08 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 11:00:02 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 12:00:02 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 13:00:13 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 14:00:18 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 15:00:09 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 16:00:01 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 23:00:01 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 17:00:01 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 18:00:01 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 19:00:09 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 20:00:06 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 21:00:02 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 22:29:10 C:\WINDOWS\Tasks\At25.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 23:00:10 C:\WINDOWS\Tasks\At26.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 00:00:10 C:\WINDOWS\Tasks\At27.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 01:00:10 C:\WINDOWS\Tasks\At28.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 02:00:15 C:\WINDOWS\Tasks\At29.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 00:00:02 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 03:00:14 C:\WINDOWS\Tasks\At30.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 04:00:10 C:\WINDOWS\Tasks\At31.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 05:00:11 C:\WINDOWS\Tasks\At32.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 15:11:46 C:\WINDOWS\Tasks\At33.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 07:00:10 C:\WINDOWS\Tasks\At34.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 08:00:10 C:\WINDOWS\Tasks\At35.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 09:00:10 C:\WINDOWS\Tasks\At36.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 10:00:13 C:\WINDOWS\Tasks\At37.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 11:00:10 C:\WINDOWS\Tasks\At38.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 12:00:10 C:\WINDOWS\Tasks\At39.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 01:00:02 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 13:00:16 C:\WINDOWS\Tasks\At40.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 14:00:19 C:\WINDOWS\Tasks\At41.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 15:00:13 C:\WINDOWS\Tasks\At42.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-20 05:04:42 C:\WINDOWS\Tasks\At43.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 17:00:10 C:\WINDOWS\Tasks\At44.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 18:00:10 C:\WINDOWS\Tasks\At45.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 19:00:14 C:\WINDOWS\Tasks\At46.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 20:00:12 C:\WINDOWS\Tasks\At47.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 21:00:10 C:\WINDOWS\Tasks\At48.job"
- C:\WINDOWS\system32\Rfvd2g6f.exe
"2008-07-19 02:00:09 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 03:00:10 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 04:00:03 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-19 05:00:03 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\0DONNgUH.exe
"2008-07-20 06:00:05 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\0DONNgUH.exe
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-Free Download Manager - C:\Program Files\Free Download Manager\fdm.exe

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-20 17:35:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" –defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
Completion time: 2008-07-20 17:38:17
ComboFix-quarantined-files.txt 2008-07-20 15:38:06
ComboFix2.txt 2008-05-28 16:48:52
ComboFix3.txt 2008-05-28 16:25:33
ComboFix4.txt 2008-05-28 13:18:21
ComboFix5.txt 2008-07-20 15:31:24

Pre-Run: 5,415,370,752 bytes free
Post-Run: 5,472,063,488 bytes free

291

*************NEW HJT LOG:

Logfile of HijackThis v1.99.1
Scan saved at 5:41:36 PM, on 7/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Scotty

Post #8July 20, 2008, 6:19 PM UTC last edited July 20, 2008, 6:20 PM UTC

Hi

Open Notepad - it must be Notepad, not Wordpad.
Copy the text below in the code box by highlighting all the text with your mouse and pressing Ctrl+C

http://forums.whatthetech.com/Getting_some_IE_popups_t93794.html

Collect::
C:\WINDOWS\system32\Rfvd2g6f.exe.a_a
C:\WINDOWS\system32\Rfvd2g6f.exe
C:\WINDOWS\system32\0DONNgUH.exe
C:\WINDOWS\system32\0DONNgUH.exe.a_a

File::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job


Folder::
C:\Program Files\Enigma Software Group

Go to the Notepad window and click Edit > Paste
Then click File > Save
Name the file "CFScript.txt" (including the quotes)
Save the file to your Desktop

[external image: Posted Image]

Refering to the picture above, drag CFScript into ComboFix.exe

ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.
A window will open asking you to ensure you are connected to the internet, this is so a file can be submitted for analysis.
Click OK and follow the instructions to submit the file.

In your next reply post:
ComboFix.txt
New HijackThis log taken after the above scan has run

kaser

Post #9July 20, 2008, 7:11 PM UTC

Hi, by ComboFix.txt I assume you mean the log.txt that Combofix created after the new scan.

***********ComboFix log:

ComboFix 08-07-19.1 - Administrator 2008-07-20 20:50:44.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.581 [GMT 2:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Administrator\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Enigma Software Group
C:\WINDOWS\system32\0DONNgUH.exe
C:\WINDOWS\system32\0DONNgUH.exe.a_a
C:\WINDOWS\system32\Rfvd2g6f.exe
C:\WINDOWS\system32\Rfvd2g6f.exe.a_a
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At25.job
C:\WINDOWS\Tasks\At26.job
C:\WINDOWS\Tasks\At27.job
C:\WINDOWS\Tasks\At28.job
C:\WINDOWS\Tasks\At29.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At30.job
C:\WINDOWS\Tasks\At31.job
C:\WINDOWS\Tasks\At32.job
C:\WINDOWS\Tasks\At33.job
C:\WINDOWS\Tasks\At34.job
C:\WINDOWS\Tasks\At35.job
C:\WINDOWS\Tasks\At36.job
C:\WINDOWS\Tasks\At37.job
C:\WINDOWS\Tasks\At38.job
C:\WINDOWS\Tasks\At39.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At40.job
C:\WINDOWS\Tasks\At41.job
C:\WINDOWS\Tasks\At42.job
C:\WINDOWS\Tasks\At43.job
C:\WINDOWS\Tasks\At44.job
C:\WINDOWS\Tasks\At45.job
C:\WINDOWS\Tasks\At46.job
C:\WINDOWS\Tasks\At47.job
C:\WINDOWS\Tasks\At48.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job

.
((((((((((((((((((((((((( Files Created from 2008-06-20 to 2008-07-20 )))))))))))))))))))))))))))))))
.

2008-07-19 19:27 . 2008-06-10 02:32 73,728 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-07-19 19:26 . 2008-07-19 19:26 d——– C:\Program Files\Common Files\Java
2008-07-07 17:52 . 2006-03-13 17:50 87,824 -ra—— C:\WINDOWS\system32\drivers\w300mgmt.sys
2008-07-07 17:45 . 2006-03-13 17:50 85,696 -ra—— C:\WINDOWS\system32\drivers\w300obex.sys
2008-07-07 17:44 . 2006-03-13 17:50 96,352 -ra—— C:\WINDOWS\system32\drivers\w300mdm.sys
2008-07-07 17:44 . 2006-03-13 17:50 9,264 -ra—— C:\WINDOWS\system32\drivers\w300mdfl.sys
2008-07-07 17:44 . 2006-03-13 17:49 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cmnt.sys
2008-07-07 17:44 . 2006-03-13 17:49 6,208 -ra—— C:\WINDOWS\system32\drivers\w300cm.sys
2008-06-22 03:42 . 2008-06-22 03:42 d——– C:\YouPlayer lister
2008-06-22 03:09 . 2008-06-22 03:09 d——– C:\Documents and Settings\Administrator\dwhelper
2008-06-22 00:51 . 2008-06-22 00:53 d——– C:\Program Files\Zeus
2008-06-22 00:50 . 2008-06-22 00:51 d——– C:\Program Files\HTML IDE

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-20 18:44 ——— d—–w C:\Documents and Settings\Administrator\Application Data\uTorrent
2008-07-20 15:16 ——— d—–w C:\Documents and Settings\Administrator\Application Data\OpenOffice.org2
2008-07-20 13:23 ——— d—–w C:\Program Files\mIRC
2008-07-19 17:27 ——— d—–w C:\Program Files\Java
2008-07-19 15:04 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-07-19 14:49 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-19 07:08 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-07-18 22:22 ——— d—–w C:\Program Files\divprog
2008-07-10 16:07 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Vso
2008-07-05 07:47 ——— d—–w C:\Program Files\Lx_cats
2008-07-01 17:23 ——— d—–w C:\Program Files\uTorrent
2008-06-01 09:27 ——— d—–w C:\Program Files\FLV Player
2008-05-28 20:14 ——— d—–w C:\Program Files\Malwarebytes' Anti-Malware
2008-05-28 20:14 ——— d—–w C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-28 20:14 ——— d—–w C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-05-27 01:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-17 23:21 795,278,976 —-a-w C:\Program Files\ADBEILSTCS3_WWE.exe
2007-12-25 16:59 67,196,968 —-a-w C:\Program Files\directx_nov2007_redist.exe
2007-12-13 07:54 47,360 —-a-w C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2007-10-21 15:33 80,689,382 —-a-w C:\Program Files\sqldeveloper-1.2.1.3213.zip
2006-10-25 23:28 7,168 —-a-w C:\Documents and Settings\Administrator\queue.dat
2006-10-25 23:28 1,683,456 —-a-w C:\Documents and Settings\Administrator\FahCore_82.exe
.

((((((((((((((((((((((((((((( snapshot@2008-05-27_ 3.28.46.62 )))))))))))))))))))))))))))))))))))))))))
.
- 2000-08-31 06:00:00 28,160 —-a-w C:\WINDOWS\Nircmd.exe
+ 2000-08-31 06:00:00 28,672 —-a-w C:\WINDOWS\Nircmd.exe
+ 2008-05-05 18:46:32 15,864 —-a-w C:\WINDOWS\system32\drivers\mbam.sys
+ 2008-05-05 18:46:36 27,048 —-a-w C:\WINDOWS\system32\drivers\mbamcatchme.sys
- 2008-02-22 00:23:35 135,168 —-a-w C:\WINDOWS\system32\java.exe
+ 2008-06-09 23:21:01 135,168 —-a-w C:\WINDOWS\system32\java.exe
- 2008-02-22 00:23:39 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
+ 2008-06-09 23:21:04 135,168 —-a-w C:\WINDOWS\system32\javaw.exe
- 2008-02-22 01:33:32 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2008-06-10 00:32:34 139,264 —-a-w C:\WINDOWS\system32\javaws.exe
+ 2005-05-24 10:27:16 213,048 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 13:47:20 94,208 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 13:49:54 950,272 —-a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-01-02 14:05:27 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 2008-06-24 15:54:26 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
- 2007-03-02 02:12:50 37,412 —ha-w C:\WINDOWS\system32\mlfcache.dat
+ 2008-06-08 20:05:20 37,412 —ha-w C:\WINDOWS\system32\mlfcache.dat
- 2008-05-27 00:21:39 61,860 —-a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-13 16:21:24 61,860 —-a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-27 00:21:40 401,018 —-a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-13 16:21:24 401,018 —-a-w C:\WINDOWS\system32\perfh009.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe" [2005-09-03 15:18 94208]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-10-05 09:52 98304]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 23:48 479232]
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" [2004-08-22 17:05 81920]
"Smapp"="C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 08:57 143360]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2006-01-02 17:41 45056]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"LXCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll" [2005-07-20 19:47 73728]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24 286720]
"PCSuiteTrayApplication"="C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" [2006-04-26 08:29 237568]
"mxomssmenu"="C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe" [2007-09-06 15:53 169264]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17 159744]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"P17Helper"="P17.dll" [2005-05-03 19:38 64512 C:\WINDOWS\system32\P17.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"TaskSwitchXP"="C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe" [2005-08-24 15:11 61952]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
OpenOffice.org 2.0.lnk - C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe [2006-06-27 23:58:04 393216]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoInstrumentation"= 1 (0x1)
"NoSMHelp"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\ABC\\abc.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18772:TCP"= 18772:TCP:BitComet 18772 TCP
"18772:UDP"= 18772:UDP:BitComet 18772 UDP
"51123:TCP"= 51123:TCP:*:Disabled:abc
"51124:TCP"= 51124:TCP:*:Disabled:ab124
"51125:TCP"= 51125:TCP:*:Disabled:ab125
"51126:TCP"= 51126:TCP:*:Disabled:ab126

R0 viasraid;viasraid;C:\WINDOWS\system32\DRIVERS\viasraid.sys [2003-10-31 12:22]
R2 Maxtor Sync Service;Maxtor Service;C:\Program Files\Maxtor\Sync\SyncServices.exe [2007-09-28 13:24]
S3 Usblink;Usblink Driver;C:\WINDOWS\system32\Drivers\ulink.sys [2003-06-02 22:28]
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys [2006-03-13 17:49]
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys [2006-03-13 17:50]
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys [2006-03-13 17:50]
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys [2006-03-13 17:50]
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys [2006-03-13 17:50]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-20 20:53:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MySQL]
"ImagePath"="\"C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" –defaults-file=\"C:\Program Files\MySQL\MySQL Server 5.0\my.ini\" MySQL"
.
Completion time: 2008-07-20 20:56:43
ComboFix-quarantined-files.txt 2008-07-20 18:56:25
ComboFix2.txt 2008-07-20 15:38:18
ComboFix3.txt 2008-05-28 16:48:52
ComboFix4.txt 2008-05-28 16:25:33
ComboFix5.txt 2008-07-20 18:49:52

Pre-Run: 5,439,705,088 bytes free
Post-Run: 5,442,359,296 bytes free

258

******New HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 9:07:59 PM, on 7/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Scotty

Post #10July 21, 2008, 3:16 AM UTC

Hi Could you make sure Malwarebytes Antimalware is up to date then run a full scan. Post the log it generates with a new HijackThis log, and tell me how the computer is behaving now.

kaser

Post #11July 21, 2008, 9:22 AM UTC

*****MalwareByte's log:

Malwarebytes' Anti-Malware 1.22
Database version: 972
Windows 5.1.2600 Service Pack 2

11:19:52 AM 7/21/2008
mbam-log-7-21-2008 (11-19-52).txt

Scan type: Full Scan (C:\|D:\|E:\|G:\|I:\|)
Objects scanned: 175275
Time elapsed: 1 hour(s), 28 minute(s), 47 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 38

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\QooBox\Quarantine\C\Documents and Settings\Administrator\Application Data\Microsoft\dtsc\7867.exe.vir (Trojan.FakeAler) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Documents and Settings\All Users\Application Data\bqtsncra\tkhqzsde.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\akqlajbm.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\arwryhal.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe.vir (Adware.BHO) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\nivapmzq.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\odarazwz.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\oiylsdsx.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\rwwnw64d.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\g11.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\g40.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ggpffioe.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\glgoqovx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\ydmhkpkr.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\_{cbd11d9a-51c3-075a-39f8-9327b79f9109}.dll.vir (Adware.Vapsup) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\{a34614c9-d6fb-8c5f-0e8b-217b7de8f6ae}.dll.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cbnwvvgs.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cpewhiaf.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cqhmgwpp.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\cxcqcgma.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\glqubhcp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jpwnw64r.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jrwnw64j.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\jrwnw64s.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kcntskdm.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kpwgdsbu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\kvgtwpaf.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lcntqkdm.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lcntskdm.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\lgwmvksm.exe.vir (Trojan.LowZones) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\uryhahwd.exe.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vcbakkvp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vuoiccpe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\3056v\tgvram102.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\WINDOWS\system32\vntiho06\vntiho061083.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{C06EA7A8-3A52-484E-A477-5ABA78ECADE8}\RP690\A0183204.exe (Trojan.FakeAler) -> Quarantined and deleted successfully.
C:\WINDOWS\BM4f7e84f2.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.

**********New HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 11:20:52 AM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\QuickTime\QTTask.exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe
C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.exe
C:\Program Files\OpenOffice.org 2.0\program\soffice.BIN
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Program Files\Maxtor\Sync\SyncServices.exe
C:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\Rfvd2g6f.exe
C:\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\en-us\msntb.dll
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe
O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d…can_unicode.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Indexing Service (CiSvc) - Unknown owner - C:\WINDOWS\system32\cisvc.exe (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: lxcf_device - - C:\WINDOWS\system32\lxcfcoms.exe
O23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exe
O23 - Service: MySQL - Unknown owner - C:\Program.exe (file missing)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

kaser

Post #12July 21, 2008, 10:08 AM UTC

I'm still getting popups after the MalwareBytes scan / deletion.
All the popups I've been getting opens in a new browser window that covers about 3/4 of my screen. Mainly ads about games or ringtones.
(No clue if this matters but last popup was from *** http://no.celldorado.com/NO/ADS/1230838522…j5YZ2ul8Idtvd3f ***)

Another thing I just thought about is that whenever I delete files from my C drive there's a pause before anything happens, and I can hear my G: drive start up (external 500G Maxtor OneTouch drive). Guessing it's unrelated and just an annoying "feature" of the external disk (backup prosess of sorts?) but I thought I'd mention it in case it's related to the malware issues.

Scotty

Post #13July 21, 2008, 11:23 AM UTC last edited July 21, 2008, 11:23 AM UTC

Hi

This file has been recreated somehow
C:\WINDOWS\system32\Rfvd2g6f.exe

Firstly, do you know what this is?
C:\YouPlayer lister

Go to http://virusscan.jotti.org
Copy the following line into the white textbox:
C:\Program Files\ADBEILSTCS3_WWE.exe
Click Submit.
Please post the results of this scan to this thread.

Do the same for these:
C:\Program Files\directx_nov2007_redist.exe
C:\Documents and Settings\Administrator\FahCore_82.exe

If Jotti is busy or unavailable, please try
Virustotal

Also
P2P Warning!
Please note that as long as you are using any form of Peer-to-Peer networking and downloading files from non-documented sources, you can expect infestations of malware to occur
Once upon a time, P2P file sharing was fairly safe. That is no longer true. You may continue to use P2P sharing at your own risk; however, please keep in mind that this practice may be the source of your current malware infestation
Additional information on the safety of Peer to Peer programs themselves is here :
Clean/Infected P2P Programs
Please refrain from using Azureus & uTorrent during the course of your fix, so you dont risk inviting more malware onto your computer.

kaser

Post #14July 24, 2008, 11:49 AM UTC

Hi, sorry for slow reply but I have been having some issues scanning two of those files you listed. The C:\Program Files\ADBEILSTCS3_WWE.exe file is a 758 MB file and takes a while to upload on my rather weak connection. I've had 2 power failures here while trying to upload it so it's been cancelled. Will try again today. C:\YouPlayer lister is a folder I created witch holds playlists used for the YouPlayer plugin for FireFox 3. The folder is only containing one file (.m3u). Here's the report on one of the files you mentioned, will try to post the other 2 tonight. File FahCore_82.exe received on 07.21.2008 00:49:04 (CET) Current status: finished Result: 1/33 (3.03%) Compact Print results Antivirus Version Last Update Result AhnLab-V3 2008.7.17.0 2008.07.18 - AntiVir 7.8.1.11 2008.07.20 - Authentium 5.1.0.4 2008.07.20 - Avast 4.8.1195.0 2008.07.20 - AVG 8.0.0.130 2008.07.20 - BitDefender 7.2 2008.07.21 - CAT-QuickHeal 9.50 2008.07.18 - ClamAV 0.93.1 2008.07.20 - DrWeb 4.44.0.09170 2008.07.20 - eSafe 7.0.17.0 2008.07.20 - eTrust-Vet 31.6.5966 2008.07.18 - Ewido 4.0 2008.07.20 - F-Prot 4.4.4.56 2008.07.20 - F-Secure 7.60.13501.0 2008.07.21 - Fortinet 3.14.0.0 2008.07.20 - GData 2.0.7306.1023 2008.07.20 - Ikarus T3.1.1.34.0 2008.07.20 - Kaspersky 7.0.0.125 2008.07.21 - McAfee 5342 2008.07.18 - Microsoft 1.3704 2008.07.21 - NOD32v2 3282 2008.07.19 - Norman 5.80.02 2008.07.18 - Panda 9.0.0.4 2008.07.20 Suspicious file Prevx1 V2 2008.07.21 - Rising 20.53.62.00 2008.07.20 - Sophos 4.31.0 2008.07.20 - Sunbelt 3.1.1536.1 2008.07.18 - Symantec 10 2008.07.21 - TheHacker 6.2.96.385 2008.07.20 - TrendMicro 8.700.0.1004 2008.07.18 - VBA32 3.12.8.1 2008.07.20 - VirusBuster 4.5.11.0 2008.07.20 - Webwasher-Gateway 6.6.2 2008.07.20 - Additional information File size: 1683456 bytes MD5…: 266eeb7a4c0035688e21adf638c74ba3 SHA1..: 4221737bf06a833e457a1fb4f859ba5a0a64c0ed SHA256: 37d91f5c98a075d8488239c5f13eea06e7c92fd8a959ce80e5b9e723281fcd72 SHA512: 8901a38304350e5b00796c47434f3450211194f0fe94100ba1886df3e9f2853b a2b02f4aae8adcb3716117369ac6d10e24e19dc5105479a902aed255cde921a4 PEiD..: Armadillo v1.71 PEInfo: PE Structure information ( base data ) entrypointaddress.: 0x4e0723 timedatestamp…..: 0x43274e32 (Tue Sep 13 22:09:54 2005) machinetype…….: 0x14c (I386) ( 5 sections ) name viradd virsiz rawdsiz ntrpy md5 .text 0x1000 0x147bac 0x148000 6.54 9dfed99a6ec33a62d7edd5b301082ab6 .rdata 0x149000 0x1559e 0x16000 4.83 0085e30a222a4b2e7d78f6589eac2747 .data 0x15f000 0x6c7640 0x20000 4.00 4aab4c3dd82bde91ba502acdc429783a .data1 0x827000 0x1ad00 0x1b000 4.65 1e314d7288a295735d9040d2f43d1cbb .tls 0x842000 0x34 0x1000 0.00 620f0b67a91f7f74151bc5be745b7110 ( 3 imports ) > KERNEL32.dll: CreateThread, SetPriorityClass, OpenProcess, SetConsoleCtrlHandler, CreateMutexA, GetExitCodeProcess, CloseHandle, ResumeThread, SuspendThread, WaitForSingleObject, GetCurrentProcess, ReleaseMutex, GetCurrentProcessId, CreateProcessA, ReleaseSemaphore, OpenSemaphoreA, TerminateProcess, GetCurrentThreadId, GetThreadPriority, GetPriorityClass, SetThreadPriority, GetCurrentThread, CreateSemaphoreA, Sleep, GetSystemTime, WaitForMultipleObjects, FindClose, GetLastError, FindFirstFileA, ExitProcess, HeapAlloc, EnterCriticalSection, LeaveCriticalSection, HeapFree, RtlUnwind, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, TlsSetValue, ExitThread, GetTimeZoneInformation, GetLocalTime, DeleteFileA, FileTimeToSystemTime, FileTimeToLocalFileTime, GetDriveTypeA, HeapReAlloc, InitializeCriticalSection, DeleteCriticalSection, HeapDestroy, HeapCreate, VirtualFree, VirtualAlloc, GetProcAddress, SetHandleCount, GetStdHandle, GetFileType, WriteFile, ReadFile, FlushFileBuffers, SetFilePointer, UnhandledExceptionFilter, GetModuleFileNameA, FreeEnvironmentStringsA, FreeEnvironmentStringsW, WideCharToMultiByte, GetEnvironmentStrings, GetEnvironmentStringsW, TlsAlloc, SetLastError, TlsGetValue, GetFullPathNameA, GetCurrentDirectoryA, RaiseException, SetStdHandle, CreateFileA, InterlockedDecrement, InterlockedIncrement, MultiByteToWideChar, GetStringTypeA, GetStringTypeW, GetCPInfo, GetACP, GetOEMCP, LoadLibraryA, LCMapStringA, LCMapStringW, SetEndOfFile, GetVersionExA, CompareStringA, CompareStringW, SetEnvironmentVariableA, SystemTimeToFileTime, GetFileAttributesA, FormatMessageA, DebugBreak, OpenFileMappingA, CreateFileMappingA, MapViewOfFile, IsBadReadPtr, UnmapViewOfFile, GetHandleInformation, GetTempFileNameA, GetTempPathA, GetFileInformationByHandle, InterlockedExchange, SetErrorMode, VirtualQuery, PeekNamedPipe > ADVAPI32.dll: RegOpenKeyA, RegSetValueExA > IMAGEHLP.dll: StackWalk, SymCleanup, SymInitialize ( 0 exports )

Scotty

Post #15July 24, 2008, 11:52 AM UTC last edited July 24, 2008, 11:54 AM UTC

Hi I wouldnt try uploading that big file. Do you know what it is? Edit- It's okay, it's part of Adobe Illustrator though Ive no idea why it isnt in an Adobe folder.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Closed] Getting some IE popups.

✨ Ask AI

Ask AI