[Closed] Do I need more help with wowfx.dll?

TerraRising Topic Starter

Post #1September 18, 2008, 10:24 PM UTC

I got the wowfx.dll trojan and followed the advice given to April Davis in an earlier post. I did the ATF-cleaner and combofix and the tricks and here are the results.

ComboFix 08-09-16.05 - Chris 2008-09-18 14:48:47.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1484 [GMT -7:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\autorun.exe
C:\Documents and Settings\Chris.DF4X3FH1\Application Data\printer.exe
C:\Documents and Settings\Chris.DF4X3FH1\Start Menu\Programs\Startup\findfast.exe
C:\Program Files\altcmd
C:\Program Files\altcmd\altcmd.inf
C:\Program Files\altcmd\uninstall.bat
C:\WINDOWS\shell.exe
C:\WINDOWS\system32\printer.exe
C:\WINDOWS\system32\spoolvs.exe

.
((((((((((((((((((((((((( Files Created from 2008-08-18 to 2008-09-18 )))))))))))))))))))))))))))))))
.

2008-09-18 14:35 . 2008-09-18 14:35 d——– C:\Program Files\Common Files\Wise Installation Wizard
2008-09-18 14:34 . 2008-09-18 14:34 0 –a—— C:\WINDOWS\nsreg.dat
2008-09-18 14:28 . 2008-09-18 14:28 d——– C:\Program Files\Windows Defender
2008-09-18 14:05 . 2008-09-18 14:11 d——– C:\Documents and Settings\Chris.DF4X3FH1\Application Data\AVGTOOLBAR
2008-09-18 14:03 . 2008-09-18 14:03 d——– C:\WINDOWS\ShellNew
2008-09-18 14:03 . 2008-09-18 14:03 d——– C:\Program Files\Microsoft ActiveSync
2008-09-18 14:03 . 2008-09-18 14:03 376 –a—— C:\WINDOWS\ODBC.INI
2008-09-18 13:09 . 2008-09-18 13:09 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-18 13:08 . 2008-09-18 14:35 d——– C:\Program Files\SUPERAntiSpyware
2008-09-18 13:08 . 2008-09-18 14:35 d——– C:\Documents and Settings\Chris.DF4X3FH1\Application Data\SUPERAntiSpyware.com
2008-09-18 12:26 . 2008-09-18 12:26 d——– C:\Documents and Settings\Chris.DF4X3FH1\Application Data\CyberLink
2008-09-18 12:25 . 2008-09-18 12:25 4,720 –a—— C:\WINDOWS\system32\PerfStringBackup.TMP
2008-09-18 12:22 . 2008-09-10 09:09 d——– C:\Documents and Settings\Chris.DF4X3FH1\Application Data\InstallShield
2008-09-18 12:22 . 2008-09-10 09:12 d——– C:\Documents and Settings\Chris.DF4X3FH1\Application Data\ATI
2008-09-18 12:22 . 2008-09-18 12:22 d——– C:\Documents and Settings\Chris.DF4X3FH1
2008-09-18 11:51 . 2008-09-18 11:51 d——– C:\Program Files\Trend Micro
2008-09-18 11:22 . 2008-09-18 11:24 d–h—– C:\$AVG8.VAULT$
2008-09-18 11:21 . 2008-09-18 11:21 97,928 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-09-18 11:21 . 2008-09-18 11:21 76,040 –a—— C:\WINDOWS\system32\drivers\avgtdix.sys
2008-09-18 11:21 . 2008-09-18 11:21 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-09-18 11:20 . 2008-09-18 14:07 d——– C:\WINDOWS\system32\drivers\Avg
2008-09-18 11:13 . 2008-09-18 11:13 d——– C:\WINDOWS\system32\xlib254.dll
2008-09-18 11:13 . 2008-09-18 11:13 d——– C:\WINDOWS\system32\append.dll
2008-09-18 10:43 . 2008-09-18 10:43 d——– C:\Program Files\Common Files\Macrovision Shared
2008-09-18 10:43 . 2008-09-18 10:43 d——– C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-09-18 10:34 . 2008-09-18 13:45 33 –a—— C:\WINDOWS\quark.ini
2008-09-18 09:20 . 2008-09-18 09:21 d——– C:\Program Files\QuarkXPress
2008-09-17 16:07 . 2008-06-23 09:57 6,066,176 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll
2008-09-17 16:07 . 2007-04-17 02:32 2,455,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-09-17 16:07 . 2007-03-07 22:10 991,232 —–c— C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-09-17 16:07 . 2008-06-23 09:57 459,264 —–c— C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-09-17 16:07 . 2008-06-23 09:57 383,488 —–c— C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-09-17 16:07 . 2008-06-23 09:57 267,776 —–c— C:\WINDOWS\system32\dllcache\iertutil.dll
2008-09-17 16:07 . 2008-06-23 09:57 63,488 —–c— C:\WINDOWS\system32\dllcache\icardie.dll
2008-09-17 16:07 . 2008-06-23 09:57 52,224 —–c— C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-09-17 16:07 . 2008-06-23 02:20 13,824 —–c— C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-09-17 15:59 . 2008-04-11 12:04 691,712 —–c— C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-17 15:59 . 2008-06-20 04:51 361,600 —–c— C:\WINDOWS\system32\dllcache\tcpip.sys
2008-09-17 15:59 . 2008-05-01 07:33 331,776 —–c— C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-17 15:59 . 2008-06-13 04:05 272,128 ——— C:\WINDOWS\system32\drivers\bthport.sys
2008-09-17 15:59 . 2008-06-13 04:05 272,128 —–c— C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-17 15:59 . 2008-06-20 10:46 245,248 —–c— C:\WINDOWS\system32\dllcache\mswsock.dll
2008-09-17 15:59 . 2008-06-20 04:08 225,856 —–c— C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-09-17 15:59 . 2008-05-08 07:02 203,136 —–c— C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-17 15:59 . 2008-06-20 10:46 147,968 —–c— C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-09-17 15:59 . 2008-06-20 04:40 138,496 —–c— C:\WINDOWS\system32\dllcache\afd.sys
2008-09-17 15:54 . 2008-09-18 10:40 d——– C:\Program Files\Common Files\Adobe
2008-09-17 15:53 . 1998-10-29 16:45 306,688 –a—— C:\WINDOWS\IsUninst.exe
2008-09-17 15:52 . 2008-09-17 15:52 d——– C:\Program Files\AVG
2008-09-17 15:52 . 2008-09-18 14:04 d——– C:\Documents and Settings\All Users\Application Data\avg8
2008-09-17 15:40 . 2008-06-24 09:43 74,240 —–c— C:\WINDOWS\system32\dllcache\mscms.dll
2008-09-17 15:40 . 2008-09-17 15:40 0 –a—— C:\WINDOWS\system32\null
2008-09-17 15:39 . 2008-09-17 15:39 d–hs—- C:\Documents and Settings\Chris\UserData
2008-09-17 15:32 . 2008-09-17 15:32 d——– C:\Documents and Settings\Chris\Application Data\CyberLink
2008-09-17 15:32 . 2008-04-14 05:00 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2008-09-17 15:31 . 2008-09-10 09:09 d——– C:\WINDOWS\system32\config\systemprofile\Application Data\InstallShield
2008-09-17 15:31 . 2008-09-10 09:12 d——– C:\WINDOWS\system32\config\systemprofile\Application Data\ATI
2008-09-17 15:31 . 2008-09-10 09:09 d——– C:\Documents and Settings\Chris\Application Data\InstallShield
2008-09-17 15:31 . 2008-09-10 09:12 d——– C:\Documents and Settings\Chris\Application Data\ATI
2008-09-17 15:31 . 2008-09-17 15:39 d——– C:\Documents and Settings\Chris
2008-09-17 15:29 . 2008-09-17 15:29 8,192 –a—— C:\WINDOWS\REGLOCS.OLD
2008-09-10 16:00 . 2008-09-10 16:00 d——– C:\WINDOWS\system32\RTCOM
2008-09-10 09:12 . 2008-09-10 09:12 d——– C:\Documents and Settings\Administrator\Application Data\ATI
2008-09-10 09:12 . 2008-09-10 09:12 333 –a—— C:\WINDOWS\system32\$ncsp$.inf
2008-09-10 09:12 . 2008-09-10 09:12 61 –a—— C:\WINDOWS\smscfg.ini
2008-09-10 09:11 . 2008-09-10 09:11 d——– C:\Program Files\CyberLink
2008-09-10 09:11 . 2008-09-17 15:40 d——– C:\Documents and Settings\All Users\Application Data\Dell
2008-09-10 09:11 . 2008-02-26 08:57 1,060,864 –a—— C:\WINDOWS\system32\MFC71.dll
2008-09-10 09:11 . 2008-02-26 08:57 1,047,552 –a—— C:\WINDOWS\system32\MFC71u.dll
2008-09-10 09:11 . 2008-02-26 08:57 499,712 –a—— C:\WINDOWS\system32\msvcp71.dll
2008-09-10 09:11 . 2008-02-26 08:57 348,160 –a—— C:\WINDOWS\system32\msvcr71.dll
2008-09-10 09:11 . 2008-02-26 08:57 89,088 –a—— C:\WINDOWS\system32\atl71.dll
2008-09-10 09:10 . 2008-09-10 09:10 d——– C:\Program Files\Dell Support Center
2008-09-10 09:10 . 2008-09-10 09:10 d——– C:\Program Files\Common Files\supportsoft
2008-09-10 09:10 . 2008-09-10 09:10 d——– C:\Documents and Settings\All Users\Application Data\SupportSoft
2008-09-10 09:09 . 2008-09-10 09:09 d——– C:\Program Files\Realtek
2008-09-10 09:09 . 2008-09-10 09:09 d——– C:\Program Files\Intel
2008-09-10 09:09 . 2008-09-10 09:11 d–h—– C:\Program Files\InstallShield Installation Information
2008-09-10 09:09 . 2008-09-17 15:33 d——– C:\Program Files\Google
2008-09-10 09:09 . 2008-09-10 09:09 d——– C:\Program Files\Dell
2008-09-10 09:09 . 2008-09-10 09:09 d——– C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-09-10 09:09 . 2007-10-05 14:21 59,392 –a—— C:\WINDOWS\system32\RTLVLAN_NB.DLL
2008-09-10 09:09 . 2007-11-19 23:14 16,640 –a—— C:\WINDOWS\system32\drivers\RTLVLAN.SYS
2008-09-10 09:09 . 2007-12-03 09:13 11,264 –a—— C:\WINDOWS\system32\drivers\diag69xp.sys
2008-09-10 09:09 . 2007-11-19 23:04 8,960 –a—— C:\WINDOWS\system32\drivers\LANPkt.sys
2008-09-10 09:08 . 2008-09-10 09:08 d——– C:\Program Files\Java
2008-09-10 09:08 . 2008-09-10 09:08 d——– C:\Program Files\Common Files\Java
2008-09-10 09:08 . 2008-09-10 09:11 d——– C:\Program Files\Common Files\InstallShield
2008-09-10 09:08 . 2008-09-10 09:08 d——– C:\Program Files\ATI Technologies
2008-09-10 09:08 . 2008-02-22 00:33 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-09-10 09:07 . 2008-09-17 16:08 d–h—– C:\WINDOWS\$hf_mig$
2008-09-10 09:07 . 2008-06-23 09:57 826,368 —–c— C:\WINDOWS\system32\dllcache\wininet.dll
2008-09-10 09:04 . 2008-09-10 09:04 d——– C:\WINDOWS\system32\Lang
2008-09-10 09:04 . 2008-09-10 09:04 940,794 –a—— C:\WINDOWS\system32\LoopyMusic.wav
2008-09-10 09:04 . 2008-09-10 09:04 146,650 –a—— C:\WINDOWS\system32\BuzzingBee.wav

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-10 18:56 4,464 —-a-w C:\WINDOWS\system32\drivers\1028_Dell_VOS_VOSTRO_410.mrk
2008-07-19 03:10 94,920 —-a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 —-a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 45,768 —-a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 —-a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:09 563,912 —-a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 325,832 —-a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 205,000 —-a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 1,811,656 —-a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:26 253,952 —-a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 —-a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 —-a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((( snapshot@2008-09-18_13.41.53.28 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-09-18 21:03:51 167,936 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\accicons.exe
+ 2008-09-18 21:03:51 2,560 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2008-09-18 21:03:51 81,920 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\fpicon.exe
+ 2008-09-18 21:03:51 34,304 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\misc.exe
+ 2008-09-18 21:03:51 8,192 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
+ 2008-09-18 21:03:51 3,584 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
+ 2008-09-18 21:03:51 114,688 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe
+ 2008-09-18 21:03:51 16,384 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
+ 2008-09-18 21:03:51 30,720 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe
+ 2008-09-18 21:03:51 22,528 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
+ 2008-09-18 21:03:51 45,056 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
+ 2008-09-18 21:03:51 90,112 —-a-r C:\WINDOWS\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
- 2008-09-18 17:42:49 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe
+ 2008-09-18 20:58:08 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat.exe
- 2008-09-18 17:42:49 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_3D.exe
+ 2008-09-18 20:58:08 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_3D.exe
- 2008-09-18 17:42:49 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_Standard.exe
+ 2008-09-18 20:58:08 295,606 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Acrobat_Standard.exe
- 2008-09-18 17:42:49 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Distiller.exe
+ 2008-09-18 20:58:08 25,214 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_Distiller.exe
- 2008-09-18 17:42:49 7,278 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_ELEMENTS_DT.exe
+ 2008-09-18 20:58:08 7,278 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\_SC_ELEMENTS_DT.exe
- 2008-09-18 17:42:49 23,558 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
+ 2008-09-18 20:58:08 23,558 —-a-r C:\WINDOWS\Installer\{AC76BA86-1033-F400-7760-000000000003}\SC_Designer_PFM.70DBED24_B579_40CB_AB0B_F1221A3E9EC5.exe
- 2008-09-18 20:08:58 18,944 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
+ 2008-09-18 21:35:53 18,944 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
- 2008-09-18 20:08:58 65,024 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2008-09-18 21:35:53 65,024 —-a-r C:\WINDOWS\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2001-01-22 10:25:24 32,768 —-a-w C:\WINDOWS\system32\ATHPRXY.DLL
+ 1999-10-18 02:01:42 1,129,232 —-a-w C:\WINDOWS\system32\FM20.DLL
+ 1999-10-18 02:01:16 26,384 —-a-w C:\WINDOWS\system32\FM20ENU.DLL
- 2008-09-18 19:22:08 93,480 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-09-18 21:46:03 1,524,920 —-a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-03-25 03:21:18 2,889,088 —-a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
+ 2008-03-25 03:21:20 218,496 —-a-w C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
+ 2008-09-18 21:40:01 70,264 —-a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
+ 1998-10-01 19:00:38 520,128 —-a-w C:\WINDOWS\system32\MAPI.DLL
+ 1998-03-26 07:00:00 38,160 —-a-w C:\WINDOWS\system32\MAPISRVR.EXE
+ 1998-06-18 01:08:32 53,248 —-a-w C:\WINDOWS\system32\MFC42ENU.DLL
+ 2000-05-11 20:06:20 397,312 —-a-w C:\WINDOWS\system32\MSRDO20.DLL
+ 2000-05-24 04:45:58 118,784 —-a-w C:\WINDOWS\system32\MSSTDFMT.DLL
+ 1998-08-09 17:07:34 94,208 —-a-w C:\WINDOWS\system32\MSSTKPRP.DLL
+ 2000-04-04 00:52:54 151,552 —-a-w C:\WINDOWS\system32\RDOCURS.DLL
+ 1998-03-25 03:54:08 15,872 —-a-w C:\WINDOWS\system32\SCP32.DLL
- 2008-04-14 12:42:04 728,576 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PS5UI.DLL
+ 2003-05-05 23:47:20 129,024 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\Ps5ui.dll
- 2008-04-14 12:42:04 543,232 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PSCRIPT5.DLL
+ 2003-05-05 23:47:20 455,168 —-a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\PSCRIPT5.DLL
+ 1999-11-25 00:40:50 40,960 —-a-w C:\WINDOWS\system32\VBAME.DLL
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-09-03 1576176]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 90112]
"8169Diag"="C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe" [2008-02-26 909312]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-10 29744]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"PDVDDXSrv"="C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2008-02-26 128296]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 624248]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-09-18 1235736]
"RTHDCPL"="RTHDCPL.EXE" [2008-01-31 C:\WINDOWS\RTHDCPL.EXE]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-09-17 113664]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-09-18 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-09-18 875288]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-09-18 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-09-18 76040]
R2 LANPkt;Realtek LANPkt Protocol Driver;C:\WINDOWS\system32\DRIVERS\LANPkt.sys [2007-11-19 8960]
R3 Diag69xp;Diag69xp;C:\WINDOWS\system32\Drivers\Diag69xp.sys [2007-12-03 11264]
S3 RTLVLAN;Realtek VLAN Intermediate Driver;C:\WINDOWS\system32\DRIVERS\RTLVLAN.SYS [2007-11-19 16640]
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Chris.DF4X3FH1\Application Data\Mozilla\Firefox\Profiles\8xyasdpw.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://my.yahoo.com/
FF -: plugin - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-18 14:51:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.exe
C:\ComboFix\pv.cfexe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-09-18 14:57:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-18 21:57:26
ComboFix2.txt 2008-09-18 20:42:06

Pre-Run: 211,827,273,728 bytes free
Post-Run: 211,811,885,056 bytes free

262

After the computer rebooted, I ran Hijackthis and got this result:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:20:15 PM, on 9/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 SP3 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = partnerpage.google.com/smallbiz.dell.com/en_us?hl=en&client=dell-usuk&channel=us-smb&ibd=4080910
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [8169Diag] C:\Program Files\Realtek\Diagnostics Utility\8169Diag.exe /hw
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Desktop Manager 5.7.801.7324 (GoogleDesktopManager-010708-104812) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

–
End of file - 5634 bytes

are there any new steps I should take in the immediate future?

silver

Post #2September 29, 2008, 4:03 AM UTC

Hi TerraRising,

You took quite a risk using instructions designed for someone else's machine and running ComboFix without supervision. If you were simply keen to resolve the problem as quickly as possible then I completely understand, but you should be aware that doing either of those things could have rendered your system unusable. If you wish to have help then I must ask you to make no system changes or run any tools without specific instructions, otherwise I can't work with your machine safely.

————————————————————————

Download Malwarebytes' Anti-Malware to your Desktop (right-click the link, select Save Target As…, select your Desktop and press Save)
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to both of these options:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Make sure everything is checked, and click Remove Selected.
When finished, a log will open in Notepad. Please save it to your Desktop, and post the contents in your reply.
The log can also be found here if you need it:
- Start->All Programs->Malwarebytes' Anti-Malware->Logs

————————————————————————

Download RSIT by random/random to your Desktop (right-click the link, select Save Target As…, select your Desktop and press Save)

Double click RSIT.exe to start the program, and click Continue at the disclaimer screen.
When the scan is complete, two text files will open - log.txt <- this one will be maximized and info.txt <-this one will be minimized
Make sure Format->Word Wrap is unchecked
Copy (Ctrl+A then Ctrl+C) and paste (Ctrl+V) the contents of log.txt and info.txt in your reply

————————————————————————

Once complete, please post the Malwarebytes Antimalware report and both RSIT logs, you won't need to produce a new HijackThis log as RSIT produces one for you.

silver

Post #3October 2, 2008, 3:09 AM UTC

Do you still need help with your machine? If the instructions are unclear or something isn't working, please let me know before proceeding.

silver

Post #4October 5, 2008, 3:36 AM UTC

Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

✨ Ask AI

Ask AI