What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] rcp-Smitfraud-C/Zlob/ISTbar infection

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1 last edited
On night of 8/7 while on web looking for athsma drug info I started receiving multiple hits on my firewall(Zonealarm). I thought I denied them all but something got thru and first symptom was blue and yellow screen with message, "Warning! Spyware detected on your computer. Install an antivirus or spyware remover to clean your computer." After this several incidents occurred where I would search web and choose to see a certain site and a different site would appear. I use Computer Associates software from SBC-Yahoo for anti-virus and anti-spy and Zone Alarm for firewall. I had Spyware Eliminator on the computer and ran it. It indicated a problem file named 'BACKDOOR.W32.Delf.SCV'. I could not tell if it did anything as it kept putting up a message that svchost.exe could not be stopped. I went into Task Manager and stopped all svchost.exe sessions but couldn't see any results. I downloaded Spybot and ran it several times. It identified several problem items at different times: Smitfraud=C.bs, Zlob.downloader.rib, virtumonde.dll.bs, and two Microsoft Windows Systems items. I clicked Repair and the best I can tell it removes the offending items but they are immediately re-installed. I was able to remove the blue/yellow screen one time by changing the Desktop theme back to XP default but on next startup it came back and I can no longer remove it this way. Is the problem learning.? I did a System Recovery to a previous week but a message said a 'System recovery could not be done.' After work most of the day with the above, I received a message from the anti-virus program that it had detected a virus. I failed to write down the name but I will scan again to see it it picks it up. By the end of a day of working with this and reading thru the web, I believe I need some knowledgeable assistance. The automatic programs are not working. I have some questions. What is the infection, what is it doing, and what can it do? It seems to learn to stop a fix after I have tried it once. Also, when it stops or re-directs an action, if I try several times it finally works correctly. Will it infect any or all of my other files? If I use a thumb-drive to transfer files to the infected computer, what is the probability the thumb-drive could be infected? What precautions should be taken to contain this thing? I have downloaded HijackThis from your site(I was surprised it let me) and have run it. I ran a Computer Assoc spyware scan just before tho' so I need to run again. I will very much appreciate any assistance you can give,
Post #2
Hello claypot

Welcome to the Whatthetech Malware Removal Forum Sorry for the delay in responding but with the amount of people posting with infected computers there are not enough hours in the day

Don't really know what your infected with until we see a Hijackthis log. And yes there are infections going around that can infect your thumb drive.

Download Trendmicros Hijackthis to your desktop.
  • Double click it to install
  • Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
  • Open HJT Scan and Save a Log File, it will open in Notepad
  • Go to Format and make sure Wordwrap is Unchecked
  • Go to Edit> Select All…..Edit > Copy and Paste the new log into this thread by using the Post Reply and not start a New Thread.
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
Post #3
ken545, thank you for the response. Below is the HiJackThis log for my computer. I have not kept the operating system up to date.

If you can walk me thru this one like it is a lesson as I intend to take the training after this is fixed. I imagine there are many people who need assistance and after my experience I would be glad to help out. dickp


Logfile of HijackThis v1.99.1
Scan saved at 9:59:26 PM, on 8/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Yahoo!\Antivirus\autodown.exe
C:\Program Files\Yahoo!\Antivirus\cafix.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdstu.exe] C:\WINDOWS\system32\kdstu.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - Global Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite…vex-2.0.6.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Post #4
ken545, here is same HiJackThis log with WORDWRAP off. dp


Logfile of HijackThis v1.99.1
Scan saved at 9:59:26 PM, on 8/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\wuauclt.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Hijackthis\HijackThis.exe
C:\Program Files\Yahoo!\Antivirus\autodown.exe
C:\Program Files\Yahoo!\Antivirus\cafix.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdstu.exe] C:\WINDOWS\system32\kdstu.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - Global Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite…vex-2.0.6.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WUSB54GCSVC - Unknown owner - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe" "WUSB54GC.exe (file missing)
Post #5
Claypot,

First thing you need to do if you want to take some training for removing this garbage is to read and follow the instructions, I gave you a link for the latest version of Hijackthis with instructions on how to install it and you posted an outdated version that may not be showing everything. Drag this copy of HJT to the trash and download and install the latest version by Trendmicro per my previous post.

Your infected with a Backdoor Trojan that could be letting more of this garbage in.


Please download OTMoveIt2 by OldTimer.
  • Save it to your desktop.
  • Please double-click OTMoveIt.exe to run it.
  • Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

    C:\Program Files\WinDates

  • Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste. Yellow Window
  • Click the red Moveit! button.
  • Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply.
  • Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.





Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.<– Don't forget this
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a New Hijackthis log.




I need to see the OTMoveIt log, the Malwarebytes log and a new Hijackthis log from Trendmicro please
Post #6
ken545, let's see if I did better this time. Here are the three items requested. What avenue does a 'backdoor trojan' use to infect the computer? thank you, dp


OTMOVEIT2 LOG

C:\Program Files\WinDates\BACKUP moved successfully.
C:\Program Files\WinDates moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_101349


ANTI-MALWARE LOG


Malwarebytes' Anti-Malware 1.25
Database version: 1072
Windows 5.1.2600 Service Pack 2

10:32:32 AM 8/20/2008
mbam-log-08-20-2008 (10-32-32).txt

Scan type: Quick Scan
Objects scanned: 46707
Time elapsed: 7 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 19

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc1vcj0e15p.scr.ren (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phc1vcj0e15p.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysrest32.exe (Rootkit.Agent) -> Quarantined and deleted successfully.


HIJACKTHIS LOG

OTMOVEIT2 LOG

C:\Program Files\WinDates\BACKUP moved successfully.
C:\Program Files\WinDates moved successfully.

OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08202008_101349


ANTI-MALWARE LOG


Malwarebytes' Anti-Malware 1.25
Database version: 1072
Windows 5.1.2600 Service Pack 2

10:32:32 AM 8/20/2008
mbam-log-08-20-2008 (10-32-32).txt

Scan type: Quick Scan
Objects scanned: 46707
Time elapsed: 7 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 19

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\xpre (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\blphc1vcj0e15p.scr.ren (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phc1vcj0e15p.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sysrest32.exe (Rootkit.Agent) -> Quarantined and deleted successfully.


HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:43:55 AM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdstu.exe] C:\WINDOWS\system32\kdstu.exe
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - Global Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite…vex-2.0.6.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 6529 bytes
Post #7
Claypot,

A backdoor trojan has the ability to download other garbage to your system while your online.

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html

O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdstu.exe] C:\WINDOWS\system32\kdstu.exe
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old" G
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr" G
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr" G
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe" G
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old" G
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old" G
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr" G
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr" G
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe" G
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe" G
O4 - Global Startup: WinDates.lnk = C:\Program Files\WinDates\WinDates.exe





Please download ATF Cleaner by Atribune to your desktop.
  • This program is for XP and Windows 2000 only
  • Double-click ATF-Cleaner.exe to run the program.
  • Under Main choose: Select All
  • Click the Empty Selected button.
Your system may start up slower after running ATF Cleaner, this is expected but will be back to normal after the first or second boot up
Please note: If you use online banking or are registered online with any other organizations, ensure you have memorized password and other personal information as removing cookies will temporarily disable the auto-login facility.





Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
  • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
  • Remember to re enable the protection again afterwards before connecting to the net
2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
  • IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
  • If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.
3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review
Post #8
ken545, I don't think I did very well on this one. The first two items, HiJackThis Scan and Fix
and the ATF Cleaner seemed to go ok. Before the first run of Combofix I exited the Computer
Associates Protection software and the SpyBot software but during the Combofix run CA
indicated a virus and SpyBot started a scan at beginning which I cancelled and at the end of
run after the Combofix log was posted, SpyBot indicated several attempted registry changes.
Most of these were to change the default browser and search engine from Google to some
Microsoft.com/isapi.dll…..values. Also 'regedit.exe "%1" %*' and 'regedit.exe "%1" and
Autorun 'value' deleted and NT startup, value deleted, 'load'. To be safe I refused all the
changes. The log is RUN 1 below

Then, I went into Task Manager/processes and stopped all processes that looked like CA
anti-virus or SpyBot(TeaKettle). I ran Combofix again(RUN 2 below). The anti-virus warning
did not appear again but all the SpyBot actions did. Since the registry/system changes were
after Combofix appeared to be complete and log issued, I refused them again.

I ran and attached a new HJT scan below.

While starting up I noticed that the ZoneAlarm firewall does not start at startup like it should
and it does not allow me to check the box to start up at computer startup.

thank you, dp



RUN 1

ComboFix 08-08-19.02 - Compaq_Owner 2008-08-20 12:07:09.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.178 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Compaq_Owner\Application Data\macromedia\Flash Player\#SharedObjects\KWJWZ73U\interclick.com
C:\Documents and Settings\Compaq_Owner\Application Data\macromedia\Flash Player\#SharedObjects\KWJWZ73U\interclick.com\ud.sol
C:\Documents and Settings\Compaq_Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Compaq_Owner\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\system32\eWebControl.dll
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 )))))))))))))))))))))))))))))))
.

2008-08-20 10:43 . 2008-08-20 10:43 d——– C:\Program Files\Trend Micro
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-17 15:05 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-20 10:21 . 2008-08-17 15:05 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 10:13 . 2008-08-20 10:13 d——– C:\_OTMoveIt
2008-08-20 02:51 . 2008-08-19 23:20 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 23:20 . 2008-08-20 08:21 d——– C:\Documents and Settings\Compaq_Owner\.housecall6.6
2008-08-19 23:02 . 2008-08-19 23:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-08-19 23:02 . 2008-08-19 23:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-08-13 11:14 . 2008-08-20 11:59 d——– C:\hijackthis
2008-08-09 13:05 . 2008-08-09 13:05 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-09 13:05 . 2008-08-10 00:23 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-09 13:01 . 2008-08-09 13:02 d——– C:\spybot
2008-08-06 22:18 . 2008-08-06 22:18 d——– C:\Defraggler
2008-08-06 22:07 . 2008-08-06 22:10 d——– C:\ccleanertemp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 19:45 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB279.tmp
2008-08-08 04:38 888,320 —-a-w C:\WINDOWS\Internet Logs\xDB278.tmp
2008-08-08 04:37 3,398,144 —-a-w C:\WINDOWS\Internet Logs\xDB277.tmp
2008-08-07 21:12 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-08-07 03:54 359,424 —-a-w C:\WINDOWS\Internet Logs\xDB276.tmp
2008-08-07 03:54 3,377,152 —-a-w C:\WINDOWS\Internet Logs\xDB275.tmp
2008-08-06 04:44 1,810,432 —-a-w C:\WINDOWS\Internet Logs\xDB274.tmp
2008-08-06 04:42 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB273.tmp
2008-08-05 04:40 862,208 —-a-w C:\WINDOWS\Internet Logs\xDB272.tmp
2008-08-05 04:38 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB271.tmp
2008-08-04 03:08 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB270.tmp
2008-08-03 22:29 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26E.tmp
2008-08-03 22:29 2,495,488 —-a-w C:\WINDOWS\Internet Logs\xDB26F.tmp
2008-08-01 03:40 471,552 —-a-w C:\WINDOWS\Internet Logs\xDB26D.tmp
2008-08-01 03:39 3,374,592 —-a-w C:\WINDOWS\Internet Logs\xDB26C.tmp
2008-07-31 04:11 576,000 —-a-w C:\WINDOWS\Internet Logs\xDB26B.tmp
2008-07-31 04:11 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26A.tmp
2008-07-29 03:20 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB269.tmp
2008-07-29 02:24 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB267.tmp
2008-07-29 02:24 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB268.tmp
2008-07-25 03:46 859,648 —-a-w C:\WINDOWS\Internet Logs\xDB266.tmp
2008-07-25 03:45 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB265.tmp
2008-07-24 03:56 300,032 —-a-w C:\WINDOWS\Internet Logs\xDB264.tmp
2008-07-24 03:55 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB263.tmp
2008-07-23 04:13 688,640 —-a-w C:\WINDOWS\Internet Logs\xDB262.tmp
2008-07-23 04:11 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB261.tmp
2008-07-22 20:05 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25F.tmp
2008-07-22 20:05 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB260.tmp
2008-07-22 04:11 1,192,960 —-a-w C:\WINDOWS\Internet Logs\xDB25E.tmp
2008-07-22 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25D.tmp
2008-07-21 04:18 1,975,296 —-a-w C:\WINDOWS\Internet Logs\xDB25C.tmp
2008-07-21 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25B.tmp
2008-07-20 04:56 2,256,896 —-a-w C:\WINDOWS\Internet Logs\xDB25A.tmp
2008-07-20 04:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB259.tmp
2008-07-19 03:27 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB258.tmp
2008-07-18 07:45 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB257.tmp
2008-07-18 04:21 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB256.tmp
2008-07-17 20:42 662,016 —-a-w C:\WINDOWS\Internet Logs\xDB255.tmp
2008-07-17 20:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB254.tmp
2008-07-17 03:41 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB253.tmp
2008-07-16 03:53 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB251.tmp
2008-07-16 03:53 1,520,640 —-a-w C:\WINDOWS\Internet Logs\xDB252.tmp
2008-07-15 03:53 1,571,328 —-a-w C:\WINDOWS\Internet Logs\xDB250.tmp
2008-07-15 03:52 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB24F.tmp
2008-07-14 04:41 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB24E.tmp
2008-07-13 04:21 2,117,632 —-a-w C:\WINDOWS\Internet Logs\xDB24D.tmp
2008-07-13 04:20 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24C.tmp
2008-07-12 04:22 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB24B.tmp
2008-07-11 04:24 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24A.tmp
2008-07-10 06:32 79,872 —-a-w C:\WINDOWS\Internet Logs\xDB249.tmp
2008-07-10 06:31 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB248.tmp
2008-07-10 06:00 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB246.tmp
2008-07-10 06:00 13,312 —-a-w C:\WINDOWS\Internet Logs\xDB247.tmp
2008-07-10 05:57 620,032 —-a-w C:\WINDOWS\Internet Logs\xDB245.tmp
2008-07-10 05:57 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB244.tmp
2008-07-10 04:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB243.tmp
2008-07-09 03:08 346,112 —-a-w C:\WINDOWS\Internet Logs\xDB242.tmp
2008-07-09 03:07 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB241.tmp
2008-07-08 04:09 1,600,512 —-a-w C:\WINDOWS\Internet Logs\xDB240.tmp
2008-07-08 04:07 3,382,272 —-a-w C:\WINDOWS\Internet Logs\xDB23F.tmp
2008-07-06 04:44 770,560 —-a-w C:\WINDOWS\Internet Logs\xDB23E.tmp
2008-07-06 04:43 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23D.tmp
2008-07-05 21:27 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23C.tmp
2008-07-05 04:29 1,495,552 —-a-w C:\WINDOWS\Internet Logs\xDB23B.tmp
2008-07-05 04:28 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB23A.tmp
2008-07-04 04:14 1,614,336 —-a-w C:\WINDOWS\Internet Logs\xDB239.tmp
2008-07-04 04:13 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB238.tmp
2008-07-03 03:56 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB236.tmp
2008-07-03 03:56 1,567,232 —-a-w C:\WINDOWS\Internet Logs\xDB237.tmp
2008-07-02 04:48 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB235.tmp
2008-06-30 04:53 224,256 —-a-w C:\WINDOWS\Internet Logs\xDB234.tmp
2008-06-30 04:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB233.tmp
2008-06-30 01:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB231.tmp
2008-06-30 01:16 1,804,800 —-a-w C:\WINDOWS\Internet Logs\xDB232.tmp
2008-06-29 04:19 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB230.tmp
2008-06-28 04:03 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22F.tmp
2008-06-27 04:04 951,296 —-a-w C:\WINDOWS\Internet Logs\xDB22E.tmp
2008-06-27 04:03 3,383,296 —-a-w C:\WINDOWS\Internet Logs\xDB22D.tmp
2008-06-26 03:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22C.tmp
2008-06-25 04:07 453,120 —-a-w C:\WINDOWS\Internet Logs\xDB22B.tmp
2008-06-25 04:07 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22A.tmp
2008-06-24 03:54 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB229.tmp
2008-06-23 03:50 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB227.tmp
2008-06-23 03:50 1,230,848 —-a-w C:\WINDOWS\Internet Logs\xDB228.tmp
2008-06-22 04:36 1,477,632 —-a-w C:\WINDOWS\Internet Logs\xDB226.tmp
2008-06-22 04:34 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB225.tmp
2008-06-21 03:34 2,633,216 —-a-w C:\WINDOWS\Internet Logs\xDB224.tmp
2008-06-21 03:33 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB223.tmp
2008-06-20 04:14 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB222.tmp
2008-06-17 03:52 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB221.tmp
2008-06-16 05:09 1,360,384 —-a-w C:\WINDOWS\Internet Logs\xDB220.tmp
2008-06-16 05:08 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB21F.tmp
2008-06-15 05:46 23,040 —-a-w C:\WINDOWS\Internet Logs\xDB21E.tmp
2008-06-15 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21D.tmp
2008-06-14 04:12 1,532,416 —-a-w C:\WINDOWS\Internet Logs\xDB21C.tmp
2008-06-14 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21B.tmp
2008-06-13 04:05 1,149,440 —-a-w C:\WINDOWS\Internet Logs\xDB21A.tmp
2008-06-13 04:04 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB219.tmp
2008-06-12 03:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB217.tmp
2008-06-12 03:54 1,009,664 —-a-w C:\WINDOWS\Internet Logs\xDB218.tmp
2004-11-24 03:20 0 -csha-w C:\WINDOWS\SMINST\HPCD.sys
2006-06-26 04:25 56 –sh–r C:\WINDOWS\system32\E41CAA6D8B.sys
2006-10-12 01:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 16:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 22:43 233472]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2005-04-22 19:49 397312]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2006-01-01 12:39 230512]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2006-01-01 12:39 185456]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-08-10 10:28 98304]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 53248 C:\WINDOWS\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 MLPTDR_Q;MLPTDR_Q;C:\WINDOWS\system32\MLPTDR_Q.sys [2003-07-22 02:04]
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2000-08-21 03:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0796b4e-e8dc-11dc-83c7-00112faa9163}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
*Newly Created Service* - TMCOMM
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\vygvqns9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official|http://forecast.weather.gov/MapClick.php?CityName=Orange&state;=TX&site;=LCH&textField1;=30.1039&textField2;=-93.7582|http://www.google.com/calendar/render?gsessionid=d6RBq063JtX7J6PJkCSGEA
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 12:16:37
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-20 12:21:29
ComboFix-quarantined-files.txt 2008-08-20 17:20:56

Pre-Run: 6,279,086,080 bytes free
Post-Run: 6,264,512,512 bytes free

201


RUN 2

ComboFix 08-08-19.02 - Compaq_Owner 2008-08-20 12:39:35.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.165 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 )))))))))))))))))))))))))))))))
.

2008-08-20 10:43 . 2008-08-20 10:43 d——– C:\Program Files\Trend Micro
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-17 15:05 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-20 10:21 . 2008-08-17 15:05 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 10:13 . 2008-08-20 10:13 d——– C:\_OTMoveIt
2008-08-20 02:51 . 2008-08-19 23:20 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 23:20 . 2008-08-20 08:21 d——– C:\Documents and Settings\Compaq_Owner\.housecall6.6
2008-08-19 23:02 . 2008-08-19 23:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-08-19 23:02 . 2008-08-19 23:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-08-13 11:14 . 2008-08-20 12:27 d——– C:\hijackthis
2008-08-09 13:05 . 2008-08-09 13:05 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-09 13:05 . 2008-08-10 00:23 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-09 13:01 . 2008-08-09 13:02 d——– C:\spybot
2008-08-06 22:18 . 2008-08-06 22:18 d——– C:\Defraggler
2008-08-06 22:07 . 2008-08-06 22:10 d——– C:\ccleanertemp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-13 19:45 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB279.tmp
2008-08-08 04:38 888,320 —-a-w C:\WINDOWS\Internet Logs\xDB278.tmp
2008-08-08 04:37 3,398,144 —-a-w C:\WINDOWS\Internet Logs\xDB277.tmp
2008-08-07 21:12 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-08-07 03:54 359,424 —-a-w C:\WINDOWS\Internet Logs\xDB276.tmp
2008-08-07 03:54 3,377,152 —-a-w C:\WINDOWS\Internet Logs\xDB275.tmp
2008-08-06 04:44 1,810,432 —-a-w C:\WINDOWS\Internet Logs\xDB274.tmp
2008-08-06 04:42 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB273.tmp
2008-08-05 04:40 862,208 —-a-w C:\WINDOWS\Internet Logs\xDB272.tmp
2008-08-05 04:38 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB271.tmp
2008-08-04 03:08 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB270.tmp
2008-08-03 22:29 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26E.tmp
2008-08-03 22:29 2,495,488 —-a-w C:\WINDOWS\Internet Logs\xDB26F.tmp
2008-08-01 03:40 471,552 —-a-w C:\WINDOWS\Internet Logs\xDB26D.tmp
2008-08-01 03:39 3,374,592 —-a-w C:\WINDOWS\Internet Logs\xDB26C.tmp
2008-07-31 04:11 576,000 —-a-w C:\WINDOWS\Internet Logs\xDB26B.tmp
2008-07-31 04:11 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26A.tmp
2008-07-29 03:20 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB269.tmp
2008-07-29 02:24 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB267.tmp
2008-07-29 02:24 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB268.tmp
2008-07-25 03:46 859,648 —-a-w C:\WINDOWS\Internet Logs\xDB266.tmp
2008-07-25 03:45 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB265.tmp
2008-07-24 03:56 300,032 —-a-w C:\WINDOWS\Internet Logs\xDB264.tmp
2008-07-24 03:55 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB263.tmp
2008-07-23 04:13 688,640 —-a-w C:\WINDOWS\Internet Logs\xDB262.tmp
2008-07-23 04:11 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB261.tmp
2008-07-22 20:05 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25F.tmp
2008-07-22 20:05 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB260.tmp
2008-07-22 04:11 1,192,960 —-a-w C:\WINDOWS\Internet Logs\xDB25E.tmp
2008-07-22 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25D.tmp
2008-07-21 04:18 1,975,296 —-a-w C:\WINDOWS\Internet Logs\xDB25C.tmp
2008-07-21 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25B.tmp
2008-07-20 04:56 2,256,896 —-a-w C:\WINDOWS\Internet Logs\xDB25A.tmp
2008-07-20 04:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB259.tmp
2008-07-19 03:27 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB258.tmp
2008-07-18 07:45 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB257.tmp
2008-07-18 04:21 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB256.tmp
2008-07-17 20:42 662,016 —-a-w C:\WINDOWS\Internet Logs\xDB255.tmp
2008-07-17 20:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB254.tmp
2008-07-17 03:41 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB253.tmp
2008-07-16 03:53 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB251.tmp
2008-07-16 03:53 1,520,640 —-a-w C:\WINDOWS\Internet Logs\xDB252.tmp
2008-07-15 03:53 1,571,328 —-a-w C:\WINDOWS\Internet Logs\xDB250.tmp
2008-07-15 03:52 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB24F.tmp
2008-07-14 04:41 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB24E.tmp
2008-07-13 04:21 2,117,632 —-a-w C:\WINDOWS\Internet Logs\xDB24D.tmp
2008-07-13 04:20 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24C.tmp
2008-07-12 04:22 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB24B.tmp
2008-07-11 04:24 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24A.tmp
2008-07-10 06:32 79,872 —-a-w C:\WINDOWS\Internet Logs\xDB249.tmp
2008-07-10 06:31 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB248.tmp
2008-07-10 06:00 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB246.tmp
2008-07-10 06:00 13,312 —-a-w C:\WINDOWS\Internet Logs\xDB247.tmp
2008-07-10 05:57 620,032 —-a-w C:\WINDOWS\Internet Logs\xDB245.tmp
2008-07-10 05:57 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB244.tmp
2008-07-10 04:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB243.tmp
2008-07-09 03:08 346,112 —-a-w C:\WINDOWS\Internet Logs\xDB242.tmp
2008-07-09 03:07 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB241.tmp
2008-07-08 04:09 1,600,512 —-a-w C:\WINDOWS\Internet Logs\xDB240.tmp
2008-07-08 04:07 3,382,272 —-a-w C:\WINDOWS\Internet Logs\xDB23F.tmp
2008-07-06 04:44 770,560 —-a-w C:\WINDOWS\Internet Logs\xDB23E.tmp
2008-07-06 04:43 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23D.tmp
2008-07-05 21:27 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23C.tmp
2008-07-05 04:29 1,495,552 —-a-w C:\WINDOWS\Internet Logs\xDB23B.tmp
2008-07-05 04:28 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB23A.tmp
2008-07-04 04:14 1,614,336 —-a-w C:\WINDOWS\Internet Logs\xDB239.tmp
2008-07-04 04:13 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB238.tmp
2008-07-03 03:56 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB236.tmp
2008-07-03 03:56 1,567,232 —-a-w C:\WINDOWS\Internet Logs\xDB237.tmp
2008-07-02 04:48 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB235.tmp
2008-06-30 04:53 224,256 —-a-w C:\WINDOWS\Internet Logs\xDB234.tmp
2008-06-30 04:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB233.tmp
2008-06-30 01:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB231.tmp
2008-06-30 01:16 1,804,800 —-a-w C:\WINDOWS\Internet Logs\xDB232.tmp
2008-06-29 04:19 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB230.tmp
2008-06-28 04:03 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22F.tmp
2008-06-27 04:04 951,296 —-a-w C:\WINDOWS\Internet Logs\xDB22E.tmp
2008-06-27 04:03 3,383,296 —-a-w C:\WINDOWS\Internet Logs\xDB22D.tmp
2008-06-26 03:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22C.tmp
2008-06-25 04:07 453,120 —-a-w C:\WINDOWS\Internet Logs\xDB22B.tmp
2008-06-25 04:07 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22A.tmp
2008-06-24 03:54 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB229.tmp
2008-06-23 03:50 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB227.tmp
2008-06-23 03:50 1,230,848 —-a-w C:\WINDOWS\Internet Logs\xDB228.tmp
2008-06-22 04:36 1,477,632 —-a-w C:\WINDOWS\Internet Logs\xDB226.tmp
2008-06-22 04:34 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB225.tmp
2008-06-21 03:34 2,633,216 —-a-w C:\WINDOWS\Internet Logs\xDB224.tmp
2008-06-21 03:33 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB223.tmp
2008-06-20 04:14 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB222.tmp
2008-06-17 03:52 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB221.tmp
2008-06-16 05:09 1,360,384 —-a-w C:\WINDOWS\Internet Logs\xDB220.tmp
2008-06-16 05:08 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB21F.tmp
2008-06-15 05:46 23,040 —-a-w C:\WINDOWS\Internet Logs\xDB21E.tmp
2008-06-15 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21D.tmp
2008-06-14 04:12 1,532,416 —-a-w C:\WINDOWS\Internet Logs\xDB21C.tmp
2008-06-14 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21B.tmp
2008-06-13 04:05 1,149,440 —-a-w C:\WINDOWS\Internet Logs\xDB21A.tmp
2008-06-13 04:04 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB219.tmp
2008-06-12 03:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB217.tmp
2008-06-12 03:54 1,009,664 —-a-w C:\WINDOWS\Internet Logs\xDB218.tmp
2004-11-24 03:20 0 -csha-w C:\WINDOWS\SMINST\HPCD.sys
2006-06-26 04:25 56 –sh–r C:\WINDOWS\system32\E41CAA6D8B.sys
2006-10-12 01:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 16:00 15360]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 22:43 233472]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2005-04-22 19:49 397312]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2006-01-01 12:39 230512]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2006-01-01 12:39 185456]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-08-10 10:28 98304]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 53248 C:\WINDOWS\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R2 MLPTDR_Q;MLPTDR_Q;C:\WINDOWS\system32\MLPTDR_Q.sys [2003-07-22 02:04]
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2000-08-21 03:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0796b4e-e8dc-11dc-83c7-00112faa9163}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - CATCHME
*Newly Created Service* - GTNDIS5
*Newly Created Service* - PROCEXP90
*Newly Created Service* - TMCOMM
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\vygvqns9.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official|http://forecast.weather.gov/MapClick.php?CityName=Orange&state;=TX&site;=LCH&textField1;=30.1039&textField2;=-93.7582|http://www.google.com/calendar/render?gsessionid=d6RBq063JtX7J6PJkCSGEA
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 12:48:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-20 12:52:51
ComboFix-quarantined-files.txt 2008-08-20 17:51:59
ComboFix2.txt 2008-08-20 17:21:33

Pre-Run: 6,267,604,992 bytes free
Post-Run: 6,254,215,168 bytes free

192


HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:03:07 PM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\WINDOWS\system32\cisvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a;…&pf;=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite…vex-2.0.6.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 5844 bytes
Post #9
Do this, you still have the TeaTimer enabled in Spybot, you need to disable it and leave it disabled until we're done


Do this first…Important


Disable the TeaTimer, leave it disabled until we're done,
  • Run Spybot-S&D in Advanced Mode.
  • If it is not already set to do this Go to the Mode menu select "Advanced Mode"
  • On the left hand side, Click on Tools
  • Then click on the Resident Icon in the List
  • Uncheck "Resident TeaTimer" and OK any prompts.
  • Restart your computer.<–You need to do this for it to take effect



Remove these with HJT

O4 - HKCU\..\RunOnce: [SpybotDeletingB6625] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD9953] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5183] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1660] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKCU\..\RunOnce: [SpybotDeletingB6334] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3725] cmd /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5510] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA465] command /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9058] cmd /c del "C:\WINDOWS\system32\blphc1vcj0e15p.scr"
O4 - HKLM\..\RunOnce: [SpybotDeletingA6455] command /c del "C:\WINDOWS\system32\kdstu.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4859] cmd /c del "C:\WINDOWS\system32\kdstu.exe"






Open Notepad Go to Start> All Programs> Assessories> Notepad ( this will only work with Notepad )and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\system32\kdstu.exe
C:\WINDOWS\system32\blphc1vcj0e15p.scr
C:\WINDOWS\system32\blphc1vcj0e15p.scr_old

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Post #10
ComboFix 08-08-19.02 - Compaq_Owner 2008-08-20 21:09:06.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.157 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Compaq_Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\System32\blphc1vcj0e15p.scr
C:\WINDOWS\System32\blphc1vcj0e15p.scr_old
C:\WINDOWS\System32\kdstu.exe
.

((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.

2008-08-20 15:22 . 2008-08-20 15:22 d——– C:\Program Files\COMODO
2008-08-20 15:22 . 2008-08-20 15:22 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Comodo
2008-08-20 15:22 . 2008-08-20 16:34 d——– C:\Documents and Settings\All Users\Application Data\comodo
2008-08-20 15:22 . 2008-08-20 15:22 143,104 –a—— C:\WINDOWS\system32\guard32.dll
2008-08-20 15:22 . 2008-08-20 15:22 87,056 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-08-20 15:22 . 2008-08-20 15:22 24,208 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-08-20 15:09 . 2008-08-20 15:15 d——– C:\Comodo
2008-08-20 14:55 . 2008-08-20 14:57 d——– C:\WINDOWS\BDOSCAN8
2008-08-20 10:43 . 2008-08-20 10:43 d——– C:\Program Files\Trend Micro
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\Compaq_Owner\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-20 10:21 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-20 10:21 . 2008-08-17 15:05 38,472 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-20 10:21 . 2008-08-17 15:05 17,144 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-08-20 10:13 . 2008-08-20 10:13 d——– C:\_OTMoveIt
2008-08-20 02:51 . 2008-08-19 23:20 102,664 –a—— C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-19 23:20 . 2008-08-20 08:21 d——– C:\Documents and Settings\Compaq_Owner\.housecall6.6
2008-08-19 23:02 . 2008-08-19 23:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-08-19 23:02 . 2008-08-19 23:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-08-13 11:14 . 2008-08-20 21:03 d——– C:\hijackthis
2008-08-09 13:05 . 2008-08-09 13:05 d——– C:\Program Files\Spybot - Search & Destroy
2008-08-09 13:05 . 2008-08-10 00:23 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-09 13:01 . 2008-08-09 13:02 d——– C:\spybot
2008-08-06 22:18 . 2008-08-20 15:27 d——– C:\Defraggler
2008-08-06 22:07 . 2008-08-06 22:10 d——– C:\ccleanertemp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-20 20:42 ——— d—–w C:\Program Files\CCleaner
2008-08-13 19:45 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB279.tmp
2008-08-08 04:38 888,320 —-a-w C:\WINDOWS\Internet Logs\xDB278.tmp
2008-08-08 04:37 3,398,144 —-a-w C:\WINDOWS\Internet Logs\xDB277.tmp
2008-08-07 21:12 ——— d—–w C:\Program Files\Mozilla Thunderbird
2008-08-07 03:54 359,424 —-a-w C:\WINDOWS\Internet Logs\xDB276.tmp
2008-08-07 03:54 3,377,152 —-a-w C:\WINDOWS\Internet Logs\xDB275.tmp
2008-08-06 04:44 1,810,432 —-a-w C:\WINDOWS\Internet Logs\xDB274.tmp
2008-08-06 04:42 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB273.tmp
2008-08-05 04:40 862,208 —-a-w C:\WINDOWS\Internet Logs\xDB272.tmp
2008-08-05 04:38 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB271.tmp
2008-08-04 03:08 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB270.tmp
2008-08-03 22:29 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26E.tmp
2008-08-03 22:29 2,495,488 —-a-w C:\WINDOWS\Internet Logs\xDB26F.tmp
2008-08-01 03:40 471,552 —-a-w C:\WINDOWS\Internet Logs\xDB26D.tmp
2008-08-01 03:39 3,374,592 —-a-w C:\WINDOWS\Internet Logs\xDB26C.tmp
2008-07-31 04:11 576,000 —-a-w C:\WINDOWS\Internet Logs\xDB26B.tmp
2008-07-31 04:11 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB26A.tmp
2008-07-29 03:20 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB269.tmp
2008-07-29 02:24 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB267.tmp
2008-07-29 02:24 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB268.tmp
2008-07-25 03:46 859,648 —-a-w C:\WINDOWS\Internet Logs\xDB266.tmp
2008-07-25 03:45 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB265.tmp
2008-07-24 03:56 300,032 —-a-w C:\WINDOWS\Internet Logs\xDB264.tmp
2008-07-24 03:55 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB263.tmp
2008-07-23 04:13 688,640 —-a-w C:\WINDOWS\Internet Logs\xDB262.tmp
2008-07-23 04:11 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB261.tmp
2008-07-22 20:05 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25F.tmp
2008-07-22 20:05 12,800 —-a-w C:\WINDOWS\Internet Logs\xDB260.tmp
2008-07-22 04:11 1,192,960 —-a-w C:\WINDOWS\Internet Logs\xDB25E.tmp
2008-07-22 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25D.tmp
2008-07-21 04:18 1,975,296 —-a-w C:\WINDOWS\Internet Logs\xDB25C.tmp
2008-07-21 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB25B.tmp
2008-07-20 04:56 2,256,896 —-a-w C:\WINDOWS\Internet Logs\xDB25A.tmp
2008-07-20 04:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB259.tmp
2008-07-19 03:27 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB258.tmp
2008-07-18 07:45 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB257.tmp
2008-07-18 04:21 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB256.tmp
2008-07-17 20:42 662,016 —-a-w C:\WINDOWS\Internet Logs\xDB255.tmp
2008-07-17 20:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB254.tmp
2008-07-17 03:41 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB253.tmp
2008-07-16 03:53 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB251.tmp
2008-07-16 03:53 1,520,640 —-a-w C:\WINDOWS\Internet Logs\xDB252.tmp
2008-07-15 03:53 1,571,328 —-a-w C:\WINDOWS\Internet Logs\xDB250.tmp
2008-07-15 03:52 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB24F.tmp
2008-07-14 04:41 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB24E.tmp
2008-07-13 04:21 2,117,632 —-a-w C:\WINDOWS\Internet Logs\xDB24D.tmp
2008-07-13 04:20 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24C.tmp
2008-07-12 04:22 3,380,736 —-a-w C:\WINDOWS\Internet Logs\xDB24B.tmp
2008-07-11 04:24 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB24A.tmp
2008-07-10 06:32 79,872 —-a-w C:\WINDOWS\Internet Logs\xDB249.tmp
2008-07-10 06:31 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB248.tmp
2008-07-10 06:00 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB246.tmp
2008-07-10 06:00 13,312 —-a-w C:\WINDOWS\Internet Logs\xDB247.tmp
2008-07-10 05:57 620,032 —-a-w C:\WINDOWS\Internet Logs\xDB245.tmp
2008-07-10 05:57 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB244.tmp
2008-07-10 04:42 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB243.tmp
2008-07-09 03:08 346,112 —-a-w C:\WINDOWS\Internet Logs\xDB242.tmp
2008-07-09 03:07 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB241.tmp
2008-07-08 04:09 1,600,512 —-a-w C:\WINDOWS\Internet Logs\xDB240.tmp
2008-07-08 04:07 3,382,272 —-a-w C:\WINDOWS\Internet Logs\xDB23F.tmp
2008-07-06 04:44 770,560 —-a-w C:\WINDOWS\Internet Logs\xDB23E.tmp
2008-07-06 04:43 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23D.tmp
2008-07-05 21:27 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB23C.tmp
2008-07-05 04:29 1,495,552 —-a-w C:\WINDOWS\Internet Logs\xDB23B.tmp
2008-07-05 04:28 3,373,056 —-a-w C:\WINDOWS\Internet Logs\xDB23A.tmp
2008-07-04 04:14 1,614,336 —-a-w C:\WINDOWS\Internet Logs\xDB239.tmp
2008-07-04 04:13 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB238.tmp
2008-07-03 03:56 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB236.tmp
2008-07-03 03:56 1,567,232 —-a-w C:\WINDOWS\Internet Logs\xDB237.tmp
2008-07-02 04:48 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB235.tmp
2008-06-30 04:53 224,256 —-a-w C:\WINDOWS\Internet Logs\xDB234.tmp
2008-06-30 04:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB233.tmp
2008-06-30 01:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB231.tmp
2008-06-30 01:16 1,804,800 —-a-w C:\WINDOWS\Internet Logs\xDB232.tmp
2008-06-29 04:19 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB230.tmp
2008-06-28 04:03 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22F.tmp
2008-06-27 04:04 951,296 —-a-w C:\WINDOWS\Internet Logs\xDB22E.tmp
2008-06-27 04:03 3,383,296 —-a-w C:\WINDOWS\Internet Logs\xDB22D.tmp
2008-06-26 03:51 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22C.tmp
2008-06-25 04:07 453,120 —-a-w C:\WINDOWS\Internet Logs\xDB22B.tmp
2008-06-25 04:07 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB22A.tmp
2008-06-24 03:54 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB229.tmp
2008-06-23 03:50 3,372,544 —-a-w C:\WINDOWS\Internet Logs\xDB227.tmp
2008-06-23 03:50 1,230,848 —-a-w C:\WINDOWS\Internet Logs\xDB228.tmp
2008-06-22 04:36 1,477,632 —-a-w C:\WINDOWS\Internet Logs\xDB226.tmp
2008-06-22 04:34 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB225.tmp
2008-06-21 03:34 2,633,216 —-a-w C:\WINDOWS\Internet Logs\xDB224.tmp
2008-06-21 03:33 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB223.tmp
2008-06-20 04:14 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB222.tmp
2008-06-17 03:52 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB221.tmp
2008-06-16 05:09 1,360,384 —-a-w C:\WINDOWS\Internet Logs\xDB220.tmp
2008-06-16 05:08 3,371,520 —-a-w C:\WINDOWS\Internet Logs\xDB21F.tmp
2008-06-15 05:46 23,040 —-a-w C:\WINDOWS\Internet Logs\xDB21E.tmp
2008-06-15 04:16 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21D.tmp
2008-06-14 04:12 1,532,416 —-a-w C:\WINDOWS\Internet Logs\xDB21C.tmp
2008-06-14 04:10 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB21B.tmp
2008-06-13 04:05 1,149,440 —-a-w C:\WINDOWS\Internet Logs\xDB21A.tmp
2008-06-13 04:04 3,372,032 —-a-w C:\WINDOWS\Internet Logs\xDB219.tmp
2008-06-12 03:54 3,371,008 —-a-w C:\WINDOWS\Internet Logs\xDB217.tmp
2004-11-24 03:20 0 -csha-w C:\WINDOWS\SMINST\HPCD.sys
2006-06-26 04:25 56 –sh–r C:\WINDOWS\system32\E41CAA6D8B.sys
2006-10-12 01:42 3,350 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-20_12.19.25.39 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-20 19:56:21 181,760 —-a-w C:\WINDOWS\BDOSCAN8\bdcore.dll
+ 2008-01-09 20:01:48 118,784 —-a-w C:\WINDOWS\BDOSCAN8\bdupd.dll
+ 2008-01-09 20:01:48 53,248 —-a-w C:\WINDOWS\BDOSCAN8\ipsupd.dll
+ 2008-08-20 19:56:43 142,848 —-a-w C:\WINDOWS\BDOSCAN8\libfn.dll
+ 2008-01-09 20:01:48 53,248 —-a-w C:\WINDOWS\bdoscandel.exe
+ 2008-01-09 20:01:48 118,784 —-a-w C:\WINDOWS\Downloaded Program Files\bdupd.dll
+ 2008-01-09 20:01:48 53,248 —-a-w C:\WINDOWS\Downloaded Program Files\ipsupd.dll
+ 2008-08-20 20:22:39 79,760 —-a-w C:\WINDOWS\system32\drivers\inspect.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 16:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2004-04-14 22:43 233472]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2005-04-22 19:49 397312]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2006-01-01 12:39 230512]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2006-01-01 12:39 185456]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2004-08-10 10:28 98304]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-08-20 15:22 1655552]
"VTTimer"="VTTimer.exe" [2004-10-22 12:53 53248 C:\WINDOWS\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogoff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.ACDV"= ACDV.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-08-20 15:22]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-08-20 15:22]
R2 MLPTDR_Q;MLPTDR_Q;C:\WINDOWS\system32\MLPTDR_Q.sys [2003-07-22 02:04]
S3 Wdm1;USB Bridge Cable Driver;C:\WINDOWS\system32\Drivers\usbbc.sys [2000-08-21 03:23]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b0796b4e-e8dc-11dc-83c7-00112faa9163}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-20 21:19:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-08-20 21:24:37
ComboFix-quarantined-files.txt 2008-08-21 02:23:41
ComboFix2.txt 2008-08-21 01:36:34
ComboFix3.txt 2008-08-20 17:52:54
ComboFix4.txt 2008-08-20 17:21:33

Pre-Run: 6,076,854,272 bytes free
Post-Run: 6,064,685,056 bytes free

218


HIJACKTHIS LOG

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:29 PM, on 8/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a…&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://yahoo.sbc.com/dsl
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = "C:\Program Files\Outlook Express\msimn.exe"
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [YOP] "C:\PROGRA~1\Yahoo!\YOP\yop.exe" /autostart
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O12 - Plugin for .mid: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin2.dll
O12 - Plugin for .wav: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin.dll
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {2AF5BD25-90C5-4EEC-88C5-B44DC2905D8B} (DownloadManager Control) - http://dlmanager.akamaitools.com.edgesuite…vex-2.0.6.0.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {D18F962A-3722-4B59-B08D-28BB9EB2281E} (PhotosCtrl Class) - http://photos.yahoo.com/ocx/us/yexplorer1_9us.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

–
End of file - 5368 bytes
Post #11
Looking good :thumbup:


  • Your Java is out of date and leaving your system vulnerable.
  • Go to your Add-Remove Programs in the Control Panel and uninstall any previous versions of Java (J2SE Runtime Environment)
  • It should have an icon next to it:
    [external image: Posted Image]
    Select it and click Remove.
  • Reboot your system.
  • Then go to the Sun Microsystems and install the update
  • Java Runtime Environment (JRE) 6 Update 7 <–This is what you need to download and install.
  • If you chose the online installation, it will prompt you to run the program.
  • If you chose the offline installation, you will be prompted to save the file and you can run it from wherever you saved it.
  • Then after install you can verify your installation here Sun Java Verify
I like to to do the offline installation and save the setup file in case I may need it in the future



How are things running now??
Post #12
ken545, I'm really depending on your interpretation of what you see to let me know when the system is clean. What I was seeing that indicated a problem was 1) the blue/yellow spyware warnining screen which I have been able to get rid of now by changing the Desktop theme and it stays changed. 2) I was able to see when something was changing the registry settings or other system settings or changing them back after legitimate changes, but since I have turrned off SpyBot, Resident, and TeaKettle I don't see any of that. 3) I did have a problem of being shut off the internet after about 10 minutes. I was going to describe this in last nights post but when I took the time to type it out I couldn't send it as I was off the internet. I finally just attached the ComboFix and HJT logs and sent them. I had mentioned earlier that Zone Alarm no longer started up automatically with the computer and I am not able to check the box in Preferences to have automatic startup. I check it and the check disappears and that is still going on now. I tried to update Zone Alarm with the latest security fix and when I click the update button I get a 'Cannot connect….' screen. Is it likely that the malware is causing this? BEFORE running the last fixes with HJT and Combofix and sending you the logs last night, I decided to download and install Comodo and shut Zone Alarm off and I did. After starting back up and while Resident/TeaKettle were running I could see something trying to remove Comodo from starting up with the computer. That is also when I noticed that I was being disconnected from the internet. Today I uninstalled Comodo and restarted Zone Alarm and after some difficulty I am on the internet and not disconnected after 2 hrs…so may be an unrelated problem. Otherwise, I don't notice anything untoward. I have questions of what to do to prevent recurrence and I checked your website. You recommend Spyware Blaster vs SpyBot; do they perform different functions or does it just perform better? I used Firefox and Thunderbird 'til just before this infection. They had some problems and I switched back to IE and OE. I also noticed the ship on your website…quite a home away from home. I worked on restoration of the radio room on the museum ship USS Orleck and was fascinated with the ship and what life aboard must have been; very compact to say the least. thank you again, dp
Post #13
Hello,

Sometimes all it takes is to uninstall a program and reinstall it so I take by what you said that your on the internet with no problems.

Spybot Search and Destroy is a great program but I am not fond of the TeaTimer ( TeaKettle to you) it gets in your face to much. We recommend both SB and SG, and they will conflict with the TeaTmer so I would keep that disabled. SG is a one time install, it just works in the background blocking some of this garbage from installing. SB, no scan to run , it to blocks bad sites from installing garbage on your system, but you need to check for updates a few times a month and enable all protection.

The ship I was on was when I was a kid and its been mothballed, I believe you and I are most likely shaving with it now. :)


OTMoveIt <—Drag it to the trash

ATF Cleaner <– Yours to keep, run it now and then to clean out the clutter.

Malwarebytes <– Yours to keep also, check for updates and run a scan now and then.

Combofix <—Is not a general cleaning tool, just run it with supervision or you can bork your system

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.


    • [external image: Posted Image]

  • When shown the disclaimer, Select "2"

The above procedure will:
  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present
  • Reset the clock settings.
  • Hide file extensions, if required.
  • Hide System/Hidden files, if required.
  • Reset System Restore.


  • How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
  • Tutorial for System Restore <– Do this first to prevent yourself from being reinfected.
  • WhattheTech
  • TonyKlein CastleCops
  • Grinler BleepingComputer
  • GeeksTo Go
  • Dslreports


Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.


Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community
  • Spybot Search and Destroy 1.6
    Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.
  • Spyware Blaster It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.
  • Spyware Guard It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.
  • IE-Spyad
    IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.
  • Firefox 3 It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.


Safe Surfn
Ken
Post #14
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI