What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] stsycod.sys? HijackThis log

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
I get fairly regular announcements saying stsycod.sys has encountered probs and has to shut down.It doesn't really seem to affect performance but I do notice that my comp dials the internet at 8.30am for no reason or setting that I have made.
Google gives varying results as to its 'danger'. I tried using 'Startup inspector for windows' (software) but it doesn't show up.
Here's the log

Logfile of HijackThis v1.99.1
Scan saved at 8:03:29 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\afinding.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\perfs.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\WINDOWS\system32\wserving.exe
C:\Program Files\TechSmith\Jing\Jing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Autodesk\3ds Max 2008\3dsmax.exe
C:\DOCUME~1\mark\LOCALS~1\Temp\AdskCleanup.0001
C:\Program Files\Common Files\Autodesk Shared\WSCommCntr1.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\mark\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Jing] C:\Program Files\TechSmith\Jing\Jing.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AFinding Service (AFinding) - Unknown owner - C:\WINDOWS\system32\afinding.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NOBICYT - Unknown owner - C:\WINDOWS\system32\Nobicyt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: perfmons - Unknown owner - C:\WINDOWS\system32\perfs.exe
O23 - Service: Routing Service (Routing) - Unknown owner - C:\WINDOWS\system32\routing.exe
O23 - Service: WServing Service (WServing) - Unknown owner - C:\WINDOWS\system32\wserving.exe
Post #3

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed.


Hi markoid

I'm Gary R, I'll be glad to help you with your computer problems.

Please observe these rules while we work:
  • Perform all actions in the order given.
  • If you don't know, stop and ask! Don't keep going on.
  • Please reply to this thread. Do not start a new topic.
  • Stick with it till you're given the all clear.
  • Remember, absence of symptoms does not mean the infection is all gone.
  • Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process.
If you can do these things, everything should go smoothly.
  • If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default)
  • If you're using Vista, it will be necessary to right click all tools we use and select —-> Run as Admistrator

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.


There are some new infections that damage your ability to boot if they are removed. So before we go any further, I need you to install Recovery Console to your computer. This is purely a precautionary measure, I don't see signs of them on your computer, but it's better to be a little cautious now than regretful later.

Recovery Console gives us the ability to recover your computer if things go wrong.

  • Download combofix.exe by sUBs to your Desktop (it must be in this location).
  • Alternate Download
  • If you already have a previous version, delete it and download a new version.
  • Go to Microsoft's website
  • Select the download that's appropriate for your Operating System (if you have XP Media Centre, use download for XP Pro. If you have SP3, then use the download for SP2)

[external image: Posted Image]

  • Download the file & save it as it's originally named, to your Desktop.
  • Next
  • Disconnect from the Internet.
  • Important! Temporarily disable your anti-virus, and anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its files which may cause unpredictable results.
  • Click here to see a list of programs that should be disabled (ignore the firewalls). The list is not all inclusive. If yours are not listed and you don't know how to disable them, please ask.

[external image: Posted Image]

  • Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it.
  • Follow the prompts to start ComboFix.
  • When prompted, agree to the End-User License Agreement to install Microsoft Recovery Console.
  • When complete a mesage will pop up asking if you want to continue scanning for Malware.
    • Click Yes
    • Combofix will now run a scan. (Usually takes 15-20 mins, but could be slightly longer)
    • When finished, it will
    • Produce a log for you. (it can also be found at C:\Combofix.txt)
  • Post the log in your next reply please.
  • Now run a new HJT scan and send me the log from that as well please.
[*]Don't forget to re-enable your anti-virus and anti-malware protection before re-connecting to the Internet.


IMPORTANT
  • Do not use your computer while Combofix is running.
  • Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  • If you've lost your Internet connection when Combofix has completely finished, re-start your computer to restore it.
If you have any problems with these instructions, a detailed Tutorial for how to use Combofix is available here.
Post #4
Wow, fast reply, thanks mate. Here's the new logs from HJT and Combofix.

Logfile of HijackThis v1.99.1
Scan saved at 9:31:35 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\Nobicyt.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\TechSmith\Jing\Jing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Documents and Settings\mark\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Jing] C:\Program Files\TechSmith\Jing\Jing.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NOBICYT - Unknown owner - C:\WINDOWS\system32\Nobicyt.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

————————————————————–

ComboFix 08-07-21.2 - mark 2008-07-22 21:20:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1507 [GMT 10:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\mark\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\mark\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\afinding.exe
C:\WINDOWS\system32\andt.sys
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\Indt2.sys
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\tmp0_591579101410.bk
C:\WINDOWS\system32\WServing.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_AFINDING
——-\Legacy_PERFMONS
——-\Legacy_ROUTING
——-\Legacy_WSERVING
——-\Service_AFinding
——-\Service_perfmons
——-\Service_Routing
——-\Service_WServing


((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.

2008-07-22 14:00 . 2008-07-22 14:00 d——– C:\Documents and Settings\mark\Application Data\wsInspector
2008-07-22 13:50 . 2008-07-22 13:50 d——– C:\Program Files\Startup Inspector for Windows
2008-07-20 15:02 . 2008-07-20 15:02 d——– C:\Program Files\CCleaner
2008-07-20 14:57 . 2008-07-20 15:18 d——– C:\Program Files\Spybot - Search & Destroy
2008-07-20 14:57 . 2008-07-20 15:18 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-20 14:47 . 2008-07-20 14:47 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-07-20 14:47 . 2008-07-20 14:47 d——– C:\Documents and Settings\All Users\Application Data\Macrovision
2008-07-11 10:07 . 2008-07-11 10:08 d——– C:\WINDOWS\MetaCreations
2008-07-11 10:07 . 2008-07-11 10:07 d——– C:\Program Files\MetaCreations
2008-07-11 10:07 . 2008-07-11 10:07 0 –a—— C:\WINDOWS\PowerReg.dat
2008-07-10 23:28 . 2008-07-10 23:28 d——– C:\Program Files\Wondershare
2008-07-10 21:07 . 2008-07-10 21:07 d——– C:\Program Files\Cucusoft
2008-07-10 21:07 . 2008-07-10 21:07 d——– C:\ConverterOutput
2008-07-10 21:07 . 2003-03-18 22:20 1,060,864 –a—— C:\WINDOWS\system32\MFC71.DLL
2008-07-10 21:07 . 2003-03-30 20:08 372,736 –a—— C:\WINDOWS\system32\xvid.ax
2008-07-10 20:25 . 2008-07-10 20:25 d——– C:\Program Files\Common Files\Download Manager
2008-07-10 19:26 . 2008-07-10 19:27 d——– C:\videooutput
2008-07-10 19:26 . 2008-07-10 19:26 d——– C:\Program Files\Free FLV to AVI Converter
2008-07-10 19:26 . 2007-03-07 00:45 3,086,336 –a—— C:\WINDOWS\system32\NCMedia.dll
2008-07-10 19:26 . 2007-03-07 00:45 3,086,336 –a—— C:\WINDOWS\system32\flvvideo.dll
2008-07-10 19:26 . 2006-11-01 14:52 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll
2008-07-10 19:26 . 2007-02-25 15:36 383,238 –a—— C:\WINDOWS\system32\libmp3lame-0.dll
2008-07-10 16:07 . 2008-07-19 00:01 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-10 16:07 . 2008-07-10 16:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-06-30 18:58 . 2008-06-30 18:58 d——– C:\WINDOWS\Applian FLV Player
2008-06-30 18:58 . 2008-06-30 18:58 d——– C:\Program Files\FLV Player
2008-06-24 08:38 . 2008-06-24 08:38 d——– C:\WINDOWS\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 11:23 16,608 —-a-w C:\WINDOWS\gdrv.sys
2008-07-22 03:41 ——— d—–w C:\Documents and Settings\mark\Application Data\uTorrent
2008-07-20 04:46 ——— d—–w C:\Program Files\Common Files\Adobe
2008-07-09 12:24 ——— d—–w C:\Program Files\Singular Inversions
2008-07-03 22:57 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-03 22:57 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-03 22:57 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-24 08:01 ——— d—–w C:\Program Files\RoadKill 1_1
2008-06-22 23:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-22 22:58 ——— d—–w C:\Program Files\Winamp
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 12:57 ——— d—–w C:\Program Files\VideoLAN
2008-06-14 12:58 ——— d—–w C:\Program Files\ffdshow
2008-06-14 09:58 ——— d—–w C:\Program Files\Apple Software Update
2008-06-14 09:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 12:31 ——— d—–w C:\Program Files\Ligos
2008-06-08 23:23 ——— d—–w C:\Program Files\FMP141
2008-06-07 23:47 ——— d—–w C:\Program Files\MSXML 4.0
2008-06-06 09:33 ——— d—–w C:\Documents and Settings\mark\Application Data\Talkback
2008-06-06 06:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-06 06:20 ——— d—–w C:\Documents and Settings\mark\Application Data\AdobeUM
2008-06-04 22:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-06-04 22:26 ——— d—–w C:\Program Files\MSXML 6.0
2008-06-04 12:45 ——— d—–w C:\Program Files\TechSmith
2008-06-04 12:44 ——— d—–w C:\Program Files\MSBuild
2008-06-04 12:42 ——— d—–w C:\Program Files\Reference Assemblies
2008-06-04 09:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-03 08:17 ——— d—–w C:\Program Files\Common Files\ChaosGroup
2008-06-03 08:09 ——— d—–w C:\Program Files\Chaos Group
2008-06-03 04:59 ——— d—–w C:\Documents and Settings\mark\Application Data\Apple Computer
2008-06-03 04:58 ——— d—–w C:\Program Files\QuickTime
2008-06-03 04:42 ——— d—–w C:\Program Files\Veoh Networks
2008-06-03 02:05 ——— d—–w C:\Program Files\Windows XP Home-Pro-2003 SP2 Crack
2008-06-02 09:52 ——— d—–w C:\Program Files\uTorrent
2008-06-02 09:15 ——— d—–w C:\Program Files\Pixologic
2008-06-02 07:47 ——— d—–w C:\Program Files\DAP
2008-06-02 07:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-06-02 06:59 ——— d—–w C:\Documents and Settings\mark\Application Data\Autodesk
2008-06-02 06:56 ——— d—–w C:\Program Files\turbo squid tentacles
2008-06-02 06:54 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-06-02 06:54 ——— d—–w C:\Program Files\Autodesk
2008-06-02 06:44 ——— d—–w C:\Program Files\Macromedia
2008-06-02 06:44 ——— d—–w C:\Program Files\Common Files\Macromedia
2008-06-02 06:38 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-06-02 06:30 ——— d—–w C:\Program Files\microsoft frontpage
2008-06-02 06:30 ——— d—–w C:\Documents and Settings\mark\Application Data\Microsoft Web Folders
2008-06-02 06:26 ——— d—–w C:\Program Files\Ahead
2008-06-02 06:25 ——— d—–w C:\Program Files\Common Files\Ahead
2008-06-02 06:22 ——— d—–w C:\Program Files\AVG
2008-06-02 06:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-06-02 06:04 ——— d—–w C:\Program Files\Alien Skin
2008-06-02 05:44 50,688 —-a-w C:\WINDOWS\system32\wbhelp2.dll
2008-06-02 05:43 ——— d—–w C:\Program Files\WS_FTP
2008-06-02 05:31 ——— d—–w C:\Program Files\CONEXANT
2008-06-02 05:23 ——— d—–w C:\Program Files\Yahoo!
2008-06-02 05:22 ——— d—–w C:\Program Files\Realtek
2008-06-02 05:22 ——— d—–w C:\Documents and Settings\mark\Application Data\InstallShield
2008-06-02 05:20 315,392 —-a-w C:\WINDOWS\HideWin.exe
2008-06-02 05:18 ——— d—–w C:\Program Files\Intel
2008-06-02 05:17 ——— d—–w C:\Program Files\GIGABYTE
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 02:24 1694208]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-15 16:11 3644464]
"Jing"="C:\Program Files\TechSmith\Jing\Jing.exe" [2008-05-07 03:01 738560]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="C:\Program Files\GIGABYTE\GEST\RUN.exe" [2007-12-14 11:46 236040]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-08-29 18:55 1966080]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-11 08:03 8429568]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-11 08:03 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-22 03:14 35328]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-04 08:57 1232152]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 18:50 155648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 20:14 16844800 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-05-11 08:03 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-02 15:51:25 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 06:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
"C:\\Program Files\\DAP\\DAP.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-04 08:57]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-04 08:57]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 08:57]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 08:57]
R2 NOBICYT;NOBICYT;C:\WINDOWS\system32\Nobicyt.exe [2001-08-23 22:00]
R3 GEST Service;GEST Service for program management.;C:\Program Files\GIGABYTE\GEST\GSvr.exe [2007-12-14 11:46]
.
Contents of the 'Scheduled Tasks' folder
"2008-07-17 06:39:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com/
R0 -: HKCU-Main,SearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
R1 -: HKCU-SearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ptec/defaults/su/*http://www.yahoo.com
O8 -: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 -: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O18 -: Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~1\DAP\dapie.dll
O18 -: Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~1\DAP\dapie.dll
O18 -: Name-Space Handler: HTTPS\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - C:\PROGRA~1\DAP\dapie.dll


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-22 21:23:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-22 21:24:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-22 11:24:46

Pre-Run: 9,835,036,672 bytes free
Post-Run: 9,838,231,552 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

228 — E O F — 2008-07-10 11:53:47
Post #5
OK, looking better, but still some way to go.

  • Click Start > Run type Notepad click OK.
  • This will open an empty Notepad file.
  • Copy/Paste the contents of the box below into Notepad.
File::
C:\WINDOWS\system32\Nobicyt.exe

Driver::
NOBICYT
  • Click Format and ensure Wordwrap is unchecked.
  • Save as CFScript.txt to your Desktop.
[external image: Posted Image]

Refering to the picture above, drag CFScript.txt into ComboFix.exe

Combofix will now process that file.

When finished, it will produce a log for you. Post that log in your next reply please. (it can also be found at C:\Combofix.txt)

Next

Please download Malwarebytes' Anti-Malware to your Desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.

  • Click on the Malwarebytes' Anti-Malware icon to launch the programme.
    • Click the Updates tab.
    • Click Check for Updates and allow the programme to download the latest definitions.
  • Click the Scanner tab.
    • Check Perform Full Scan.
    • Click Scan and wait for the scan to complete.
    • When the scan is complete, click OK, then Show Results.
    • Ensure all items are checked then click Remove Selected.
    • A box will pop-up telling you that files have been quarantined.
    • A log will pop-up.
  • Post the log in your next reply please.

You can also access the log by doing the following
  • Click on the Logs tab.
  • Click on the log at the bottom of those listed to highlight it.
  • Click Open

Next

Run a new scan with HJT and post me the log please.

Summary of the logs I need from you in your next post:
  • Latest Combofix log
  • MBAM log
  • New HJT log


Please post each log separately to prevent them being cut off by the forum post size limiter.
Post #6
Hi GaryR, here are the new logs

Logfile of HijackThis v1.99.1
Scan saved at 9:50:09 AM, on 7/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\TechSmith\Jing\Jing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Documents and Settings\mark\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Jing] C:\Program Files\TechSmith\Jing\Jing.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O17 - HKLM\System\CCS\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #7
Malwarebytes' Anti-Malware 1.22 Database version: 980 Windows 5.1.2600 Service Pack 2 9:48:19 AM 7/23/2008 mbam-log-7-23-2008 (09-48-19).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 101029 Time elapsed: 21 minute(s), 59 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 2 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\perfs.exe (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\mark\list.txt (Malware.Trace) -> Quarantined and deleted successfully.
Post #8
ComboFix 08-07-21.2 - mark 2008-07-23 8:52:32.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1538 [GMT 10:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\mark\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\Nobicyt.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\afinding.exe
C:\WINDOWS\system32\comsa32.sys
C:\WINDOWS\system32\Nobicyt.exe
C:\WINDOWS\system32\routing.exe
C:\WINDOWS\system32\WServing.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_AFINDING
——-\Legacy_NOBICYT
——-\Legacy_PERFMONS
——-\Legacy_ROUTING
——-\Legacy_WSERVING
——-\Service_AFinding
——-\Service_NOBICYT
——-\Service_perfmons
——-\Service_Routing
——-\Service_WServing


((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.

2008-07-22 14:00 . 2008-07-22 14:00 d——– C:\Documents and Settings\mark\Application Data\wsInspector
2008-07-22 13:50 . 2008-07-22 13:50 d——– C:\Program Files\Startup Inspector for Windows
2008-07-20 15:02 . 2008-07-20 15:02 d——– C:\Program Files\CCleaner
2008-07-20 14:57 . 2008-07-20 15:18 d——– C:\Program Files\Spybot - Search & Destroy
2008-07-20 14:57 . 2008-07-20 15:18 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-20 14:47 . 2008-07-20 14:47 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-07-20 14:47 . 2008-07-20 14:47 d——– C:\Documents and Settings\All Users\Application Data\Macrovision
2008-07-11 10:07 . 2008-07-11 10:08 d——– C:\WINDOWS\MetaCreations
2008-07-11 10:07 . 2008-07-11 10:07 d——– C:\Program Files\MetaCreations
2008-07-11 10:07 . 2008-07-11 10:07 0 –a—— C:\WINDOWS\PowerReg.dat
2008-07-10 23:28 . 2008-07-10 23:28 d——– C:\Program Files\Wondershare
2008-07-10 21:07 . 2008-07-10 21:07 d——– C:\Program Files\Cucusoft
2008-07-10 21:07 . 2008-07-10 21:07 d——– C:\ConverterOutput
2008-07-10 21:07 . 2003-03-18 22:20 1,060,864 –a—— C:\WINDOWS\system32\MFC71.DLL
2008-07-10 21:07 . 2003-03-30 20:08 372,736 –a—— C:\WINDOWS\system32\xvid.ax
2008-07-10 20:25 . 2008-07-10 20:25 d——– C:\Program Files\Common Files\Download Manager
2008-07-10 19:26 . 2008-07-10 19:27 d——– C:\videooutput
2008-07-10 19:26 . 2008-07-10 19:26 d——– C:\Program Files\Free FLV to AVI Converter
2008-07-10 19:26 . 2007-03-07 00:45 3,086,336 –a—— C:\WINDOWS\system32\NCMedia.dll
2008-07-10 19:26 . 2007-03-07 00:45 3,086,336 –a—— C:\WINDOWS\system32\flvvideo.dll
2008-07-10 19:26 . 2006-11-01 14:52 765,952 –a—— C:\WINDOWS\system32\xvidcore.dll
2008-07-10 19:26 . 2007-02-25 15:36 383,238 –a—— C:\WINDOWS\system32\libmp3lame-0.dll
2008-07-10 16:07 . 2008-07-19 00:01 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-10 16:07 . 2008-07-10 16:07 1,409 –a—— C:\WINDOWS\QTFont.for
2008-06-30 18:58 . 2008-06-30 18:58 d——– C:\WINDOWS\Applian FLV Player
2008-06-30 18:58 . 2008-06-30 18:58 d——– C:\Program Files\FLV Player
2008-06-24 08:38 . 2008-06-24 08:38 d——– C:\WINDOWS\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 22:56 16,608 —-a-w C:\WINDOWS\gdrv.sys
2008-07-22 22:23 ——— d—–w C:\Documents and Settings\mark\Application Data\uTorrent
2008-07-20 04:46 ——— d—–w C:\Program Files\Common Files\Adobe
2008-07-09 12:24 ——— d—–w C:\Program Files\Singular Inversions
2008-07-03 22:57 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-03 22:57 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-03 22:57 10,520 —-a-w C:\WINDOWS\system32\avgrsstx.dll
2008-06-24 08:01 ——— d—–w C:\Program Files\RoadKill 1_1
2008-06-22 23:07 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-22 22:58 ——— d—–w C:\Program Files\Winamp
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 12:57 ——— d—–w C:\Program Files\VideoLAN
2008-06-14 12:58 ——— d—–w C:\Program Files\ffdshow
2008-06-14 09:58 ——— d—–w C:\Program Files\Apple Software Update
2008-06-14 09:58 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 12:31 ——— d—–w C:\Program Files\Ligos
2008-06-08 23:23 ——— d—–w C:\Program Files\FMP141
2008-06-07 23:47 ——— d—–w C:\Program Files\MSXML 4.0
2008-06-06 09:33 ——— d—–w C:\Documents and Settings\mark\Application Data\Talkback
2008-06-06 06:24 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-06-06 06:20 ——— d—–w C:\Documents and Settings\mark\Application Data\AdobeUM
2008-06-04 22:43 ——— d—–w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-06-04 22:26 ——— d—–w C:\Program Files\MSXML 6.0
2008-06-04 12:45 ——— d—–w C:\Program Files\TechSmith
2008-06-04 12:44 ——— d—–w C:\Program Files\MSBuild
2008-06-04 12:42 ——— d—–w C:\Program Files\Reference Assemblies
2008-06-04 09:52 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-03 08:17 ——— d—–w C:\Program Files\Common Files\ChaosGroup
2008-06-03 08:09 ——— d—–w C:\Program Files\Chaos Group
2008-06-03 04:59 ——— d—–w C:\Documents and Settings\mark\Application Data\Apple Computer
2008-06-03 04:58 ——— d—–w C:\Program Files\QuickTime
2008-06-03 04:42 ——— d—–w C:\Program Files\Veoh Networks
2008-06-03 02:05 ——— d—–w C:\Program Files\Windows XP Home-Pro-2003 SP2 Crack
2008-06-02 09:52 ——— d—–w C:\Program Files\uTorrent
2008-06-02 09:15 ——— d—–w C:\Program Files\Pixologic
2008-06-02 07:47 ——— d—–w C:\Program Files\DAP
2008-06-02 07:08 ——— d—–w C:\Documents and Settings\All Users\Application Data\QuickTime
2008-06-02 06:59 ——— d—–w C:\Documents and Settings\mark\Application Data\Autodesk
2008-06-02 06:56 ——— d—–w C:\Program Files\turbo squid tentacles
2008-06-02 06:54 ——— d—–w C:\Program Files\Common Files\Autodesk Shared
2008-06-02 06:54 ——— d—–w C:\Program Files\Autodesk
2008-06-02 06:44 ——— d—–w C:\Program Files\Macromedia
2008-06-02 06:44 ——— d—–w C:\Program Files\Common Files\Macromedia
2008-06-02 06:38 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-06-02 06:30 ——— d—–w C:\Program Files\microsoft frontpage
2008-06-02 06:30 ——— d—–w C:\Documents and Settings\mark\Application Data\Microsoft Web Folders
2008-06-02 06:26 ——— d—–w C:\Program Files\Ahead
2008-06-02 06:25 ——— d—–w C:\Program Files\Common Files\Ahead
2008-06-02 06:22 ——— d—–w C:\Program Files\AVG
2008-06-02 06:22 ——— d—–w C:\Documents and Settings\All Users\Application Data\avg8
2008-06-02 06:04 ——— d—–w C:\Program Files\Alien Skin
2008-06-02 05:44 50,688 —-a-w C:\WINDOWS\system32\wbhelp2.dll
2008-06-02 05:43 ——— d—–w C:\Program Files\WS_FTP
2008-06-02 05:31 ——— d—–w C:\Program Files\CONEXANT
2008-06-02 05:23 ——— d—–w C:\Program Files\Yahoo!
2008-06-02 05:22 ——— d—–w C:\Program Files\Realtek
2008-06-02 05:22 ——— d—–w C:\Documents and Settings\mark\Application Data\InstallShield
2008-06-02 05:20 315,392 —-a-w C:\WINDOWS\HideWin.exe
2008-06-02 05:18 ——— d—–w C:\Program Files\Intel
2008-06-02 05:17 ——— d—–w C:\Program Files\GIGABYTE
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 02:24 1694208]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-05-15 16:11 3644464]
"Jing"="C:\Program Files\TechSmith\Jing\Jing.exe" [2008-05-07 03:01 738560]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"GEST"="C:\Program Files\GIGABYTE\GEST\RUN.exe" [2007-12-14 11:46 236040]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 16:36 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-08-29 18:55 1966080]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-05-11 08:03 8429568]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-05-11 08:03 81920]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2006-06-22 03:14 35328]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-04 08:57 1232152]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 18:50 155648]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 20:14 16844800 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-05-11 08:03 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-06-02 15:51:25 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-18 06:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3codec"= l3codecp.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 2008\\3dsmax.exe"=
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\WS_FTP\\WS_FTP95.exe"=
"C:\\Program Files\\DAP\\DAP.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-04 08:57]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-04 08:57]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 08:57]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 08:57]
R3 GEST Service;GEST Service for program management.;C:\Program Files\GIGABYTE\GEST\GSvr.exe [2007-12-14 11:46]
.
Contents of the 'Scheduled Tasks' folder
"2008-07-17 06:39:29 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-23 08:57:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-23 8:59:46 - machine was rebooted [mark]
ComboFix-quarantined-files.txt 2008-07-22 22:59:41
ComboFix2.txt 2008-07-22 11:24:49

Pre-Run: 9,929,146,368 bytes free
Post-Run: 9,925,951,488 bytes free

210 — E O F — 2008-07-10 11:53:47
Post #9
OK, looking a whole lot better.

Run a scan with HJT and when finished check the following items (if found).

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com



Now close all open windows and click Fix Checked to remove them.

I need you to run an online scan for me Kaspersky is a good general purpose scanner, and will look into areas not scanned by the previous tools, I need to make sure we haven't missed anything.
  • Please go to Kaspersky Online Scanner.
  • Read through the requirements and privacy statement and click on the Accept button.
  • It will start downloading and installing the scanner and virus definitions.
    • You will be prompted to install an application from Kaspersky. Click Run.
  • When the downloads have finished, click on Settings.
  • Make sure these boxes are checked (ticked). If they're not, please tick them and click on the Save button:
    • Spyware, Adware, Dialers and other potentially dangerous programs.
    • Archives.
    • Mail databases.
  • Under Scan, click on My Computer.
  • Once the scan is complete, it will display the results.
    • Click on View Scan Report.
  • You will see a list of infected items.
    • Click the Save Report As… button (see red arrow below)

      [external image: Posted Image]
    • In the Save as… prompt, select Desktop
    • In the File name box, name the file KAVScan
    • In the Save as type prompt, select Text file (see below)

      [external image: Posted Image]
    • Copy and paste that information in your next post please.

Now run a new scan with HJT and post me the log please.
Post #10
New logs :) , thanks!
——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Thursday, July 24, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, July 23, 2008 09:32:37
Records in database: 996706
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 67873
Threat name: 14
Infected objects: 14
Suspicious objects: 1
Duration of the scan: 00:24:15


File name / Threat name / Threats count
C:\Documents and Settings\mark\Local Settings\Application Data\Identities\{E6150CC5-B476-4523-9925-59E24195701C}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\andt.sys.vir Infected: Trojan.Win32.DNSChanger.ews 1
C:\QooBox\Quarantine\C\WINDOWS\system32\Indt2.sys.vir Infected: Trojan.Win32.VB.dco 1
C:\QooBox\Quarantine\C\WINDOWS\system32\Nobicyt.exe.vir Infected: Trojan-Downloader.Win32.Delf.jte 1
C:\WINDOWS\system32\atpsck.exe Infected: not-a-virus:AdWare.Win32.AlexaBar.aj 1
C:\WINDOWS\system32\cexwxfst.sys Infected: Trojan-Clicker.Win32.VB.bfh 1
C:\WINDOWS\system32\mtmc.exe Infected: Trojan.Win32.Delf.cxf 1
C:\WINDOWS\system32\nftscpd.sys Infected: Trojan.Win32.Delf.dbc 1
C:\WINDOWS\system32\nxtscpd.sys Infected: Trojan.Win32.Delf.dbc 1
C:\WINDOWS\system32\stsycod.sys Infected: Trojan.Win32.Delf.djl 1
C:\WINDOWS\system32\swand.sys Infected: Trojan.Win32.DNSChanger.ewt 1
C:\WINDOWS\system32\sxwand.sys Infected: Trojan.Win32.DNSChanger.ffi 1
C:\WINDOWS\system32\xfst.sys Infected: Trojan-Clicker.Win32.VB.bcq 1
C:\WINDOWS\system32\xwxfst.sys Infected: Trojan-Clicker.Win32.VB.azs 1
C:\WINDOWS\system32\yaxcnxd.sys Infected: Trojan.Win32.DNSChanger.fgx 1

The selected area was scanned.

———————————————–

Logfile of HijackThis v1.99.1
Scan saved at 10:05:46 AM, on 7/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\GIGABYTE\GEST\gest.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\TechSmith\Jing\Jing.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\GIGABYTE\GEST\GSvr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\DAP\DAP.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Documents and Settings\mark\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - C:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [GEST] C:\Program Files\GIGABYTE\GEST\RUN.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [Jing] C:\Program Files\TechSmith\Jing\Jing.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Download with &DAP - C:\PROGRA~1\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - C:\PROGRA~1\DAP\dapextie2.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - C:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jd…ows-i586-jc.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{11B81C12-FD90-492D-87C4-71E587F8D68C}: NameServer = 202.162.96.5 202.162.96.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: GEST Service for program management. (GEST Service) - Unknown owner - C:\Program Files\GIGABYTE\GEST\GSvr.exe
O23 - Service: mental ray 3.6 Satellite for Autodesk 3ds Max 2008 32-bit 32-bit (mi-raysat_3dsMax2008_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 2008\mentalray\satellite\raysat_3dsMax2008_32server.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
Post #11
Hi markoid,

Bad news I'm afraid.

The kaspersky log shows you have signs of a Remote Access Trojan (trojan backdoor) on your computer.

C:\WINDOWS\system32\mtmc.exe Infected: Trojan.Win32.Delf.cxf 1
C:\WINDOWS\system32\nftscpd.sys Infected: Trojan.Win32.Delf.dbc 1
C:\WINDOWS\system32\nxtscpd.sys Infected: Trojan.Win32.Delf.dbc 1
C:\WINDOWS\system32\stsycod.sys Infected: Trojan.Win32.Delf.djl 1

http://research.sunbelt-software.com/threa…threatid=299754
http://research.sunbelt-software.com/threa…threatid=328942
http://www.emsisoft.com/en/malware/?Backdoor.Win32.Delf.dbc
http://www.viruslist.com/en/viruses/encycl…?virusid=286718
http://www.viruslist.com/en/virusesdescrib…=152540521#back
http://www.emsisoft.com/en/malware/?Backdoor.Win32.Delf.djl

This means your attacker may have full remote access to your computer and can use it as if he were sat in front of it.

You are strongly advised to do the following immediately:

1. Disconnect infected computer from the internet and from any networked computers until the computer can be cleaned.

2. Call all of your banks, credit card companies, and financial institutions. Inform them that you may be a victim of identity theft and to put a watch on your accounts or change all your account numbers.

3. From a clean computer, change *all* your online passwords – for email, for banks, financial accounts, PayPal, eBay, online companies, any online forums or groups you belong to.

Do NOT change passwords or do any transactions while using the infected computer, because the attacker will get the new passwords and transaction information.

IF YOU USE THIS COMPUTER FOR ONLINE BANKING OR OTHER FINANCIAL TRANSACTIONS, OR HAVE DATA OF A CONFIDENTIAL NATURE ON IT, MY RECOMMENDATION IS THAT YOU RE-FORMAT AND RE-INSTALL YOUR OPERATING SYSTEM AND PROGRAMMES. WE CAN NEVER BE TOTALLY SURE WE HAVE GOT RID OF ALL MODIFICATIONS WHICH MAY HAVE BEEN MADE BY THE ATTACKER, AND THEREFORE CANNOT GUARANTEE THE SAFETY OF YOUR DATA.

Guide to re-formatting and re-installing courtesy of wng_z3r0

If you don't have the resources to reinstall your OS and/or would like me to attempt to clean your machine, I'll be happy to do so.

To help you decide, please take some time to read the following articles, then let me know how you want to proceed.

What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should I do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups
Post #12
Oh carp**… OK, thanks Gary. I'll reformat etc. Thanks very much for all your help, much appreciated… glad I came and checked this out.
Post #13 last edited
Hey GaryB… two quick questions, if you are aware, is it netspy trojan? Should I be able to see port interaction by it using netstat cmd? I'm not sure if I'm allowed to ask you for such details… thanks again mate. Have blocked all financial accounts etc :)
Post #14
I think if you're using your computer for anything "secure", that re-formatting and re-installing is the only safe option. If this were my machine, it's what I'd do. Whether you could spot any Port interaction will depend on whether you're scanning the appropriate ports when an actual communication is taking place, at all other times nothing will show. The real danger with any backdoor, is not removing the actual infection, it's that we can't know what alterations your attacker has made to the Registry. The Registry is a pretty large place, and though we can look in the "usual" places for any security alterations, there are an awful lot of ways that an attacker can modify things to make it easier for them to re-gain access once we've removed the current infection, finding them is like looking for a needle in several haystacks. As you've decided to re-format, I'll close this thread now, sorry I had to be the bearer of bad news.
Post #15
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI