What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Possible Backdoor, svchost.exe connecting to external

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Okay So a few days ago my firewall (from Kaspersky AVP), was detecting svchost.exe connecting (i forget whether inbound or outbound, udp/tcp etc) to random IP's (I used a site, one of them traced to Chile, South America :S).
I didnt think much of it because I scanned with kaspersky and Spybot Search and Destroy - Nothing came up. Plus I had azureus running - Possible explanation.

Today a buddy recommended I scan with ad aware just to be safe.
It came up with Win32.backdoor.agent. - In a restore point, and a registry entry (R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local)

I looked at my own hijack this log, and found the registry entry Adaware was talking about. (pasted that above)

Here is the log for good measure:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:41:28 PM, on 30/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
c:\program files\itunes\itunes.exe
C:\Program Files\Vuze\Azureus.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Lavasoft\Ad-Aware\Ad-Aware.exe
G:\Program DL Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft

Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus CX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE /FU

"C:\WINDOWS\TEMP\E_S3A9.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security

7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky

Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -

http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3104F98F-D00F-4FBD-B7A8-70B635BB3BCF}: NameServer = 64.59.135.143,64.59.135.145
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll,wbsys.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device

Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security

7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common

Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\D-Link

RangeBooster N DWA-542\jswpsapi.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 7703 bytes



So I guess my question is.. False positive (Ive had a few before, and this contradiction of tools seems like it.. kinda) or a real backdoor.

I have a decent knowledge of computers, but ive never had malware before.

If i missed anything, just say.
Post #2 last edited
ADDITION: This is just some extra figuring ive done, although im far from an expert like you guys. I scanned just critical things with ad aware (smart scan or something) this time, and it came up clean. (scans like windows folders, and at least part of the registry) To me this kinda suggests my svchost.exe's are clean, as I dont think i have any running outside of this area. Im not sure if that means anything to you guys. EDIT: I found out more "potentially" helpful info. I had running windows firewall at the same time as kaspersky. (Forgot to turn it off, i use it sometimes when kasp interferes with other apps) And I changed my tcp properties to not register connection in DNS (i read somewhere this may stop people from hacking or w/e my svchost, if that is in fact the case [ie this hides my ip more]) Another thing I forgot.. Malware bytes quick scan came up with no infected objects. (the self help said use quick scan).
Post #5
[external image: Posted Image]

Click: Start > All Programs> Accessories
Open Notepad, click on Format and uncheck Word Wrap.

DO NOT use any TOOLS such as Combofix, Vundofix, or HijackThis fixes without supervision.

Doing so could make your pc inoperatible and could require a full reinstall of your OS, losing all your programs and data.



Stay with this topic until I give you the all clean post.

You might want to print these instructions out.

I suggest you do this:

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Clear "Hide file extensions for known file types."
Under the "Hidden files" folder, select "Show hidden files and folders."
Clear "Hide protected operating system files."
Click Apply, and then click OK.


Please do not delete anything unless instructed to.


Please download ATF Cleaner by Atribune.
Download - ATF Cleaner»
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

It's normal after running ATF cleaner that the PC will be slower to boot the first time or two.

Next:

Please download Malwarebytes' Anti-Malware to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform quick scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected .
  • When completed, a log will open in Notepad. Please save it to a convenient location and post the results.
  • Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot.
Also "copy/paste" a new HijackThis log file into this thread.

Also please describe how your computer behaves at the moment.
Post #6
Firstly.. My computer is behaving normally besides the random connecting my svchost.exe was doing (talked about this in the original post).

Secondly.. Ad Aware seems to be the only anti malware app to find something.. So I have not quarantined or deleted any files so far, as I do not like to do things unless necessary, because it could cause possible unstability.

I just did a FULL computer scan with MBAM, came up clean, log file pasted:
HJT log after.
I have not done anything to remove the "win32 backdoor" that ad aware found.
I pasted the registry key it found it in, in the original post. (it found it in a reg key and a restore point on my alternate partition).


LOGS:

Malwarebytes' Anti-Malware 1.30
Database version: 1349
Windows 5.1.2600 Service Pack 3

31/10/2008 8:21:23 PM
mbam-log-2008-10-31 (20-21-23).txt

Scan type: Full Scan (C:\|G:\|)
Objects scanned: 117783
Time elapsed: 27 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:21:53 PM, on 31/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\MagicDisc\MagicDisc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
c:\program files\itunes\itunes.exe
C:\WINDOWS\system32\WISPTIS.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
G:\Program DL Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus CX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE /FU "C:\WINDOWS\TEMP\E_S3A9.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3104F98F-D00F-4FBD-B7A8-70B635BB3BCF}: NameServer = 64.59.135.143,64.59.135.145
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll,wbsys.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 7939 bytes
Post #7 last edited
If it is in the system restore area it's harmless unless you would restore back to that point.

You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.
Post #8
Im just scared that the restore point is evidence of a trojan, that somehow is hidden now. As in the restore point was created when it was in harmless form, then it was activated from the time the point was made and the time I scanned. Also.. Does this look like a false positive to you.. Kaspersky, Spybot, MBAM, all clean. Ad aware finds a backdoor. :S
Post #9
Well we can try to see if it shows up.

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
"copy/paste" a new HijackThis log file into this thread as well.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.


Also please describe how your computer behaves at the moment.
Post #12
That wont impact anything in the long run will it? Like ill just have to click the CD/ DVD etc to get it to start? If any of this stuff like reduces performance I might just want to reformat because I game and thats an issue for me.
Post #13

That wont impact anything in the long run will it?
Like ill just have to click the CD/ DVD etc to get it to start?

If any of this stuff like reduces performance I might just want to reformat because I game and thats an issue for me.

If anything we should be able to find un-needed items to remove.
Post #14
Ok I did the combofix thing.. it seems to have caused a shitload of havoc, hopefully this was not all a false positive lol.
I noticed my browser was changed back to IE7 from firefox, and my wireless wont connect properly anymore..

Heres the logs anyway:

ComboFix 08-10-30.13 - Steve! 2008-10-31 20:53:20.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2110 [GMT -6:00]
Running from: G:\Program DL Files\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-10-01 to 2008-11-01 )))))))))))))))))))))))))))))))
.

2008-10-31 19:42 . 2008-10-31 19:43 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-10-31 19:42 . 2008-10-31 19:42 d——– C:\Program Files\Common Files\Download Manager
2008-10-31 19:42 . 2008-10-31 19:42 d——– C:\Documents and Settings\Steve!\Application Data\Malwarebytes
2008-10-31 19:42 . 2008-10-31 19:42 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-31 19:42 . 2008-10-22 16:10 38,496 –a—— C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-31 19:42 . 2008-10-22 16:10 15,504 –a—— C:\WINDOWS\system32\drivers\mbam.sys
2008-10-30 23:01 . 2008-10-30 23:01 d——– C:\Program Files\ERUNT
2008-10-30 22:03 . 2008-10-30 22:03 d——– C:\Program Files\Lavasoft
2008-10-30 22:03 . 2008-10-30 22:04 d——– C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-10-30 18:57 . 2008-10-30 18:59 d——– C:\Program Files\Spybot - Search & Destroy
2008-10-30 18:57 . 2008-10-30 18:59 d——– C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-27 17:22 . 2008-10-27 17:22 d——– C:\Program Files\Bethesda Softworks
2008-10-26 17:38 . 2008-10-31 14:06 d——– C:\Documents and Settings\Steve!\Application Data\Bioshock
2008-10-26 16:41 . 2008-10-26 16:41 d——– C:\Program Files\2K Games
2008-10-26 15:25 . 2008-10-31 14:53 23 –a—— C:\WINDOWS\BlendSettings.ini
2008-10-26 13:46 . 2008-10-26 13:46 d——– C:\Program Files\MagicDisc
2008-10-26 13:46 . 2008-07-13 21:10 101,120 –a—— C:\WINDOWS\system32\drivers\mcdbus.sys
2008-10-26 00:20 . 2008-10-26 00:20 d——– C:\Program Files\RapidShare Manager (RSM)
2008-10-24 01:27 . 2008-10-24 01:27 664 –a—— C:\WINDOWS\system32\d3d9caps.dat
2008-10-23 22:44 . 2008-10-23 22:44 268 –ah—– C:\sqmdata02.sqm
2008-10-23 22:44 . 2008-10-23 22:44 244 –ah—– C:\sqmnoopt02.sqm
2008-10-23 20:33 . 2008-10-23 20:33 244 –ah—– C:\sqmnoopt01.sqm
2008-10-23 20:33 . 2008-10-23 20:33 232 –ah—– C:\sqmdata01.sqm
2008-10-23 15:42 . 2008-10-15 10:34 337,408 —–c— C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-22 17:41 . 2008-10-22 17:41 d——– C:\Program Files\Pazera FLV Converter
2008-10-20 17:58 . 2008-10-20 17:58 d——– C:\CtDriverInstTemp
2008-10-20 17:56 . 2008-10-20 17:58 d——– C:\Program Files\Creative
2008-10-20 17:56 . 1999-10-10 11:01 41,984 –a—— C:\WINDOWS\CTREGRUN.EXE
2008-10-20 17:55 . 1998-10-29 16:45 306,688 –a—— C:\WINDOWS\IsUninst.exe
2008-10-15 02:41 . 2008-08-14 04:11 2,189,184 —–c— C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 02:41 . 2008-08-14 04:09 2,145,280 —–c— C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 02:41 . 2008-08-14 03:33 2,066,048 —–c— C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 02:41 . 2008-08-14 03:33 2,023,936 —–c— C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 02:41 . 2008-09-15 06:12 1,846,400 —–c— C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-15 02:41 . 2008-09-08 04:41 333,824 —–c— C:\WINDOWS\system32\dllcache\srv.sys
2008-10-10 23:22 . 2008-10-10 23:22 d——– C:\Program Files\Ventrilo
2008-10-10 23:22 . 2008-10-10 23:23 d——– C:\Documents and Settings\Steve!\Application Data\Ventrilo
2008-10-08 18:47 . 2008-10-08 18:47 42,320 –a—— C:\WINDOWS\system32\xfcodec.dll
2008-10-06 22:17 . 2008-10-06 22:17 d——– C:\Program Files\AC3Filter
2008-10-06 22:17 . 2008-07-09 02:05 421,888 –a—— C:\WINDOWS\system32\ac3filter.acm
2008-10-05 13:52 . 2008-10-05 13:52 d——– C:\Documents and Settings\Steve!\Application Data\vlc
2008-10-05 00:58 . 2008-10-05 00:58 d——– C:\Program Files\XviD
2008-10-05 00:58 . 2005-12-30 20:10 761,856 –a—— C:\WINDOWS\system32\xvidcore.dll
2008-10-05 00:58 . 2005-12-30 20:18 180,224 –a—— C:\WINDOWS\system32\xvidvfw.dll
2008-10-05 00:58 . 2005-12-30 20:16 77,824 –a—— C:\WINDOWS\system32\xvid.ax
2008-10-05 00:25 . 2008-10-05 00:25 d——– C:\Program Files\iPod
2008-10-05 00:25 . 2008-10-05 00:25 d——– C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-05 00:24 . 2008-10-01 13:01 32,000 –a—— C:\WINDOWS\system32\drivers\usbaapl.sys
2008-10-05 00:16 . 2008-10-05 00:16 d——– C:\Program Files\WinAVI MP4 Converter

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-01 02:57 12,393,504 –sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-11-01 02:56 757,280 –sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-11-01 02:55 74,036 –sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-11-01 02:55 170,924 –sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-11-01 02:52 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Xfire
2008-11-01 02:18 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Azureus
2008-10-31 06:36 ——— d—–w C:\Program Files\Xfire
2008-10-31 04:02 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-10-29 04:55 ——— d—–w C:\Program Files\Steam
2008-10-28 13:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-10-28 06:40 ——— d—a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-28 00:22 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-10-27 01:00 ——— dc-h–w C:\Documents and Settings\All Users\Application Data\{0151C9FC-719D-4459-B1E2-4685CC6E62A8}
2008-10-26 20:16 183,120 —-a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-10-26 20:16 137,480 —-a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-10-26 18:34 ——— d—–w C:\Documents and Settings\Steve!\Application Data\ESTsoft
2008-10-26 18:34 ——— d—–w C:\Documents and Settings\All Users\Application Data\ESTsoft
2008-10-19 02:58 ——— d—–w C:\Program Files\Fraps
2008-10-16 05:25 107,888 —-a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-10-07 03:54 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Apple Computer
2008-10-05 06:25 ——— d—–w C:\Program Files\iTunes
2008-09-27 15:12 22,328 —-a-w C:\Documents and Settings\Steve!\Application Data\PnkBstrK.sys
2008-09-27 15:11 669,184 —-a-w C:\WINDOWS\system32\pbsvc.exe
2008-09-27 15:11 66,872 —-a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-09-27 06:54 ——— dc-h–w C:\Documents and Settings\All Users\Application Data\{0691F710-1ECA-4B5A-9727-25554F1BFDC6}
2008-09-27 06:39 ——— d—–w C:\Program Files\Electronic Arts
2008-09-27 06:21 ——— d—–w C:\Program Files\AGEIA Technologies
2008-09-21 08:54 ——— d–h–r C:\Documents and Settings\Steve!\Application Data\SecuROM
2008-09-17 03:27 453,152 —-a-w C:\WINDOWS\system32\NVUNINST.EXE
2008-09-15 12:12 1,846,400 —-a-w C:\WINDOWS\system32\win32k.sys
2008-09-14 07:47 ——— d—–w C:\Documents and Settings\Steve!\Application Data\dvdcss
2008-09-14 06:10 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Any Video Converter
2008-09-11 05:25 ——— d—–w C:\Program Files\Activision
2008-09-11 04:59 ——— d—–w C:\Program Files\RivaTuner v2.10
2008-09-11 01:49 ——— d—–w C:\Program Files\THQ
2008-09-11 00:42 ——— d—–w C:\Program Files\Everest
2008-09-11 00:37 ——— d—–w C:\Program Files\Microsoft ActiveSync
2008-09-11 00:36 ——— d—–w C:\Program Files\Microsoft.NET
2008-09-10 23:16 ——— d—–w C:\Program Files\Common Files\Stardock
2008-09-10 22:15 ——— d—–w C:\Program Files\AlienGUIse
2008-09-10 10:00 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Leadertech
2008-09-10 09:59 ——— d—–w C:\Documents and Settings\All Users\Application Data\EPSON
2008-09-10 09:56 ——— d—–w C:\Program Files\epson
2008-09-10 09:55 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-09-10 09:30 ——— d—–w C:\Program Files\QuickTime
2008-09-10 09:30 ——— d—–w C:\Program Files\Common Files\Apple
2008-09-10 09:30 ——— d—–w C:\Program Files\Bonjour
2008-09-10 09:30 ——— d—–w C:\Program Files\Apple Software Update
2008-09-10 09:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-09-10 09:30 ——— d—–w C:\Documents and Settings\All Users\Application Data\Apple
2008-09-10 09:19 ——— d—–w C:\Program Files\Windows Live
2008-09-10 09:18 ——— dcsh–w C:\Program Files\Common Files\WindowsLiveInstaller
2008-09-10 09:17 ——— d—–w C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-09-10 08:42 ——— d—–w C:\Program Files\Saitek
2008-09-10 08:42 ——— d—–w C:\Documents and Settings\All Users\Application Data\Saitek
2008-09-10 08:38 ——— d—–w C:\Program Files\NOS
2008-09-10 08:38 ——— d—–w C:\Documents and Settings\All Users\Application Data\NOS
2008-09-10 08:32 ——— d—–w C:\Program Files\Common Files\Adobe AIR
2008-09-10 08:32 ——— d—–w C:\Program Files\Common Files\Adobe
2008-09-10 08:07 ——— d—–w C:\Program Files\VideoLAN
2008-09-10 07:34 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Windows Search
2008-09-10 06:58 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_SaiK0004_01005.Wdf
2008-09-10 06:55 ——— d—–w C:\Documents and Settings\Steve!\Application Data\teamspeak2
2008-09-10 06:54 ——— d—–w C:\Program Files\Teamspeak2_RC2
2008-09-10 06:43 ——— d—–w C:\Program Files\PoRTaL
2008-09-10 06:20 315,392 —-a-w C:\WINDOWS\HideWin.exe
2008-09-10 06:20 ——— d—–w C:\Program Files\Realtek
2008-09-10 06:19 ——— d—–w C:\Documents and Settings\NetworkService\Application Data\Xfire
2008-09-10 06:02 ——— d—–w C:\Documents and Settings\LocalService\Application Data\Xfire
2008-09-10 06:00 ——— d—–w C:\Program Files\ESTsoft
2008-09-10 05:59 ——— d—–w C:\Program Files\CCleaner
2008-09-10 05:33 ——— d—–w C:\Program Files\Vuze
2008-09-10 05:33 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2008-09-10 05:29 ——— d—–w C:\Program Files\Java
2008-09-10 05:28 ——— d—–w C:\Program Files\Common Files\Java
2008-09-10 05:21 ——— d—–w C:\Documents and Settings\Steve!\Application Data\Logitech
2008-09-10 05:21 ——— d—–w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-09-10 05:20 0 —ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-10 05:20 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-09-10 05:20 0 —ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2008-09-10 05:20 ——— d—–w C:\Program Files\Common Files\Logishrd
2008-09-10 05:19 ——— d—–w C:\Program Files\Logitech
2008-09-10 05:19 ——— d—–w C:\Documents and Settings\All Users\Application Data\Logitech
2008-09-10 05:17 ——— d–h–r C:\Documents and Settings\All Users\Application Data\Atheros
2008-09-10 05:15 ——— d—–w C:\Program Files\D-Link
2008-09-10 05:15 ——— d—–w C:\Documents and Settings\Steve!\Application Data\InstallShield
2008-09-10 05:05 ——— d—–w C:\Program Files\Kaspersky Lab
2008-09-10 05:04 ——— d—–w C:\Documents and Settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-09-10 04:52 ——— d—–w C:\Program Files\Symantec
2008-09-10 04:51 ——— d—–w C:\Program Files\microsoft frontpage
2008-09-10 04:40 96,976 —-a-w C:\WINDOWS\system32\drivers\klin.dat
2008-09-10 04:40 87,855 —-a-w C:\WINDOWS\system32\drivers\klick.dat
2008-09-10 04:40 112,144 —-a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-09-08 10:41 333,824 —-a-w C:\WINDOWS\system32\drivers\srv.sys
2008-09-04 15:31 288,024 —-a-w C:\WINDOWS\system32\PhysXCplUI.exe
2008-08-29 17:18 87,336 —-a-w C:\WINDOWS\system32\dns-sd.exe
2008-08-29 16:53 61,440 —-a-w C:\WINDOWS\system32\dnssd.dll
2008-08-29 14:57 70,936 —-a-w C:\WINDOWS\system32\PhysXLoader.dll
2008-08-26 07:24 826,368 —-a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 10:09 2,145,280 —-a-w C:\WINDOWS\system32\ntoskrnl.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
"EPSON Stylus CX4400 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE" [2007-03-01 180736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ProfilerU"="C:\Program Files\Saitek\SD6\Software\ProfilerU.exe" [2008-04-04 233472]
"SaiMfd"="C:\Program Files\Saitek\SD6\Software\SaiMfd.exe" [2008-04-04 131072]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-09-17 13574144]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-09-17 86016]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-09-06 413696]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-02-29 C:\WINDOWS\KHALMNPR.Exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe]
"nwiz"="nwiz.exe" [2008-09-17 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-13 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-09-09 805392]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-05-02 03:42 72208 c:\Program Files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
2001-12-21 00:34 24576 C:\Program Files\AlienGUIse\fastload.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1"= xfcodec.dll
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Wireless Connection Manager.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Wireless Connection Manager.lnk
backup=C:\WINDOWS\pss\Wireless Connection Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Steve!^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\Steve!\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Xfire\\xfire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Vuze\\Azureus.exe"=

R0 nvgts;nvgts;C:\WINDOWS\system32\DRIVERS\nvgts.sys [2008-01-17 102400]
R3 JSWSCIMD;jswscimd Service;C:\WINDOWS\system32\DRIVERS\jswscimd.sys [2007-08-28 57344]
R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-04-04 24344]
R3 SaiK0004;SaiK0004;C:\WINDOWS\system32\DRIVERS\SaiK0004.sys [2008-04-04 104960]
R3 SaiU0004;SaiU0004;C:\WINDOWS\system32\DRIVERS\SaiU0004.sys [2008-04-04 28544]
R3 WSIMD;wsimd Service;C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-12-13 57408]
S3 jswpsapi;Jumpstart Wifi Protected Setup;C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe [2008-04-16 356434]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3d105568-7e97-11dd-8c55-806d6172696f}]
\Shell\AutoRun\command - D:\KIS7.0.exe
.
Contents of the 'Scheduled Tasks' folder

2008-10-30 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2008-10-27 C:\WINDOWS\Tasks\Crysis Wars® Updates.job
- C:\WINDOWS\Installer\Crysis Wars® Updates for All Users.lnk [2008-09-27 09:11]
.
.
——- Supplementary Scan ——-
.
FireFox -: Profile - C:\Documents and Settings\Steve!\Application Data\Mozilla\Firefox\Profiles\y75vx8d4.default\
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************
scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files:

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-10-31 20:58:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-01 02:58:01

Pre-Run: 129,089,712,128 bytes free
Post-Run: 129,212,260,352 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

276 — E O F — 2008-10-23 23:00:20






HJT


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:05:28 PM, on 31/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\AlienGUIse\wbload.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
G:\Program DL Files\HiJackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
O4 - HKLM\..\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus CX4400 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICAA.EXE /FU "C:\WINDOWS\TEMP\E_S3A9.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3104F98F-D00F-4FBD-B7A8-70B635BB3BCF}: NameServer = 64.59.135.143,64.59.135.145
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Atheros Configuration Service (ACS) - Atheros - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\acs.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\D-Link RangeBooster N DWA-542\jswpsapi.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 7172 bytes
Post #15
Sorry,
It will only run with IE, not FF.

Your logs are really clean.
The only thing I see is Bonjour. If you don't use it, use add/Remove programs and uninstall it.

You can also remove these if listed.
C:\ComboFix
C:\QooBox
C:\combofix.txt
C:\combofix-quarantine-files.txt

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI