What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] inbox file infected with W32/Trojan3.HN. I'm not

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
here is the log but I was still getting the previous error messages

ComboFix 08-11-07.01 - Gary Lazarus 2008-11-08 3:17:31.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.127 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Gary Lazarus\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_000006_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2008-10-08 to 2008-11-08 )))))))))))))))))))))))))))))))
.

2008-11-08 03:02 . 2008-11-08 03:01 388,608 –a—— c:\windows\system32\CF15465.exe.vir
2008-11-08 02:13 . 2008-11-08 02:13 d——– c:\windows\LastGood
2008-11-08 02:11 . 2008-10-15 16:57 332,800 –a—— c:\windows\system32\SET8A.tmp
2008-11-08 01:02 . 2008-11-08 02:33 d——– c:\windows\system32\CatRoot_bak
2008-11-07 23:33 . 2008-11-07 23:50 d——– c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-08 03:19 ——— d—–w c:\documents and settings\Gary Lazarus\Application Data\Skype
2008-11-08 02:03 ——— d—–w c:\program files\Mozilla Thunderbird
2008-11-04 22:52 40,272 —-a-w c:\documents and settings\Gary Lazarus\Application Data\GDIPFONTCACHEV1.DAT
2008-10-28 23:54 ——— d—–w c:\program files\Google
2008-10-15 16:57 332,800 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-07 06:10 ——— d—–w c:\program files\Raxco
2008-10-07 06:10 ——— d—–w c:\documents and settings\All Users\Application Data\Raxco
2008-10-07 06:08 53,192 —-a-w c:\windows\system32\drivers\rp_skt32.sys
2008-10-04 11:52 ——— d—–w c:\program files\iTunes
2008-10-04 11:52 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-04 11:51 ——— d—–w c:\program files\iPod
2008-10-03 17:41 6,066,176 —-a-w c:\windows\system32\SETDF.tmp
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-24 22:01 ——— d—–w c:\program files\Flickr Uploadr
2008-09-20 11:42 ——— d—–w c:\program files\QuickTime
2008-09-20 11:40 ——— d—–w c:\program files\Common Files\Apple
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-09-15 11:57 1,846,016 ——w c:\windows\system32\dllcache\win32k.sys
2008-08-28 10:04 333,056 ——w c:\windows\system32\dllcache\srv.sys
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\SETD7.tmp
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ——w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 10:00 2,180,352 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 10:00 2,180,352 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2008-08-14 09:58 2,136,064 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2008-08-14 09:51 138,368 ——w c:\windows\system32\dllcache\afd.sys
2008-08-14 09:22 2,057,728 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-08-14 09:22 2,057,728 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2008-08-14 09:22 2,015,744 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2008-06-01 10:53 40,688 —-a-w c:\documents and settings\Lois Grant\Application Data\GDIPFONTCACHEV1.DAT
2007-01-25 19:01 92,064 —-a-w c:\documents and settings\Gary Lazarus\mqdmmdm.sys
2007-01-25 19:01 9,232 —-a-w c:\documents and settings\Gary Lazarus\mqdmmdfl.sys
2007-01-25 19:01 79,328 —-a-w c:\documents and settings\Gary Lazarus\mqdmserd.sys
2007-01-25 19:01 66,656 —-a-w c:\documents and settings\Gary Lazarus\mqdmbus.sys
2007-01-25 19:01 6,208 —-a-w c:\documents and settings\Gary Lazarus\mqdmcmnt.sys
2007-01-25 19:01 5,936 —-a-w c:\documents and settings\Gary Lazarus\mqdmwhnt.sys
2007-01-25 19:01 4,048 —-a-w c:\documents and settings\Gary Lazarus\mqdmcr.sys
2007-01-25 19:01 25,600 —-a-w c:\documents and settings\Gary Lazarus\usbsermptxp.sys
2007-01-25 19:01 22,768 —-a-w c:\documents and settings\Gary Lazarus\usbsermpt.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4A9D-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4A9D-BDFE-192AAD5099B1}]
2007-06-07 21:00 2274872 –a—— c:\program files\Mozy\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}]
2007-06-07 21:00 2274872 –a—— c:\program files\Mozy\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-09-13 22880040]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"SAFEHOME HotKeys"="c:\program files\Steganos Safe Home\SteganosHotKeyService.exe" [2007-03-21 25088]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"Broadbandadvisor.exe"="c:\program files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2007-08-07 2061552]
"PCguard"="c:\program files\Virgin Broadband\PCguard\Rps.exe" [2007-09-05 310000]
"-FreedomNeedsReboot"="c:\program files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2007-09-05 13552]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"IndexCleaner"="c:\program files\Virgin Broadband\PCguard\IdxClnR.exe" [2007-09-05 61168]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Gary Lazarus\Start Menu\Programs\Startup\
Winding Road Automatic.lnk - c:\program files\Winding Road Automatic\Winding Road Automatic.exe [2006-10-17 3506439]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2005-08-24 315392]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Mozy Status.lnk - c:\program files\Mozy\mozystat.exe [2007-06-07 1783352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Winding Road Automatic\\assets\\Issue 28\\Winding Road Issue 28.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8679:TCP"= 8679:TCP:ppLive
"7446:UDP"= 7446:UDP:ppLive

R1 mozyFilter;mozyFilter;c:\windows\system32\DRIVERS\mozy.sys [2007-06-07 52984]
R1 SLEE_15_DRIVER;Steganos Live Encryption Engine 15 [Driver];c:\windows\system32\drivers\Sleen15.sys [2007-02-21 12:33 80232]
S3 Radialpoint Security Services;Virgin Broadband PCguard;c:\windows\system32\dllhost.exe [2004-08-04 5120]
.
Contents of the 'Scheduled Tasks' folder

2008-11-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-03 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 04:00]

2008-11-08 c:\windows\Tasks\HPpromotions psc 2350 series.job
- c:\program files\HP\Digital Imaging\bin\HP Promotions\AiOMVC\HPpromo.exe [2005-01-28 13:26]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-08 03:19:22
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-08 3:20:28
ComboFix-quarantined-files.txt 2008-11-08 03:20:20
ComboFix2.txt 2008-11-08 00:50:20

Pre-Run: 131,436,662,784 bytes free
Post-Run: 131,427,041,280 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

165 — E O F — 2008-11-08 03:09:28
Post #18 last edited
I think this one was causing the email issues:
C:\Documents and Settings\Gary Lazarus\Application Data\Thunderbird\Profiles\zs4uh7rd.default\Mail\Local Folders\Trash


Copy/paste the text in the Codebox below into notepad:

Here's how to do that:
Click Start > Run type Notepad click OK.
This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text. 

File::
c:\windows\system32\CF15465.exe.vir
c:\windows\system32\SET8A.tmp
c:\windows\system32\SETDF.tmp
c:\windows\system32\SETD7.tmp

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:
1.Click File;
2.Click Save As… Change the directory to your desktop;
3.Change the Save as type to "All Files";
4.Type in the file name: CFScript
5.Click Save …


[external image: Posted Image]

Drag CFScript.txt into ComboFix.exe

Then post the results log and a new HijackThis log.

Also please describe how your computer behaves at the moment.
Post #19
Hi LDTate

The computer seems to be running well.

Here is the latest log

ComboFix 08-11-07.01 - Gary Lazarus 2008-11-08 17:09:30.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.111 [GMT 0:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Gary Lazarus\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\windows\system32\CF15465.exe.vir
c:\windows\system32\SET8A.tmp
c:\windows\system32\SETD7.tmp
c:\windows\system32\SETDF.tmp
.

((((((((((((((((((((((((( Files Created from 2008-10-08 to 2008-11-08 )))))))))))))))))))))))))))))))
.

2008-11-08 01:02 . 2008-11-08 02:33 d——– c:\windows\system32\CatRoot_bak
2008-11-07 23:33 . 2008-11-07 23:50 d——– c:\program files\ERUNT

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-08 17:14 ——— d—–w c:\documents and settings\Gary Lazarus\Application Data\Skype
2008-11-08 07:58 ——— d—–w c:\program files\Mozilla Thunderbird
2008-11-04 22:52 40,272 —-a-w c:\documents and settings\Gary Lazarus\Application Data\GDIPFONTCACHEV1.DAT
2008-10-28 23:54 ——— d—–w c:\program files\Google
2008-10-15 16:57 332,800 ——w c:\windows\system32\dllcache\netapi32.dll
2008-10-07 06:10 ——— d—–w c:\program files\Raxco
2008-10-07 06:10 ——— d—–w c:\documents and settings\All Users\Application Data\Raxco
2008-10-07 06:08 53,192 —-a-w c:\windows\system32\drivers\rp_skt32.sys
2008-10-04 11:52 ——— d—–w c:\program files\iTunes
2008-10-04 11:52 ——— d—–w c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-04 11:51 ——— d—–w c:\program files\iPod
2008-10-03 17:41 6,066,176 ——w c:\windows\system32\dllcache\ieframe.dll
2008-09-24 22:01 ——— d—–w c:\program files\Flickr Uploadr
2008-09-20 11:42 ——— d—–w c:\program files\QuickTime
2008-09-20 11:40 ——— d—–w c:\program files\Common Files\Apple
2008-09-15 11:57 1,846,016 —-a-w c:\windows\system32\win32k.sys
2008-09-15 11:57 1,846,016 ——w c:\windows\system32\dllcache\win32k.sys
2008-08-28 10:04 333,056 ——w c:\windows\system32\dllcache\srv.sys
2008-08-27 08:24 3,593,216 —-a-w c:\windows\system32\dllcache\mshtml.dll
2008-08-25 08:38 13,824 ——w c:\windows\system32\dllcache\ieudinit.exe
2008-08-25 08:37 70,656 ——w c:\windows\system32\dllcache\ie4uinit.exe
2008-08-23 05:56 635,848 ——w c:\windows\system32\dllcache\iexplore.exe
2008-08-23 05:54 161,792 ——w c:\windows\system32\dllcache\ieakui.dll
2008-08-14 10:00 2,180,352 —-a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 10:00 2,180,352 ——w c:\windows\system32\dllcache\ntoskrnl.exe
2008-08-14 09:58 2,136,064 ——w c:\windows\system32\dllcache\ntkrnlmp.exe
2008-08-14 09:51 138,368 ——w c:\windows\system32\dllcache\afd.sys
2008-08-14 09:22 2,057,728 —-a-w c:\windows\system32\ntkrnlpa.exe
2008-08-14 09:22 2,057,728 ——w c:\windows\system32\dllcache\ntkrnlpa.exe
2008-08-14 09:22 2,015,744 ——w c:\windows\system32\dllcache\ntkrpamp.exe
2008-06-01 10:53 40,688 —-a-w c:\documents and settings\Lois Grant\Application Data\GDIPFONTCACHEV1.DAT
2007-01-25 19:01 92,064 —-a-w c:\documents and settings\Gary Lazarus\mqdmmdm.sys
2007-01-25 19:01 9,232 —-a-w c:\documents and settings\Gary Lazarus\mqdmmdfl.sys
2007-01-25 19:01 79,328 —-a-w c:\documents and settings\Gary Lazarus\mqdmserd.sys
2007-01-25 19:01 66,656 —-a-w c:\documents and settings\Gary Lazarus\mqdmbus.sys
2007-01-25 19:01 6,208 —-a-w c:\documents and settings\Gary Lazarus\mqdmcmnt.sys
2007-01-25 19:01 5,936 —-a-w c:\documents and settings\Gary Lazarus\mqdmwhnt.sys
2007-01-25 19:01 4,048 —-a-w c:\documents and settings\Gary Lazarus\mqdmcr.sys
2007-01-25 19:01 25,600 —-a-w c:\documents and settings\Gary Lazarus\usbsermptxp.sys
2007-01-25 19:01 22,768 —-a-w c:\documents and settings\Gary Lazarus\usbsermpt.sys
.

((((((((((((((((((((((((((((( snapshot@2008-11-08_ 3.19.39.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-23 16:57:27 124,928 ——w c:\windows\system32\advpack.dll
+ 2008-08-26 07:24:28 124,928 —-a-w c:\windows\system32\advpack.dll
- 2008-10-28 23:54:08 180,240 —-a-w c:\windows\system32\FNTCACHE.DAT
+ 2008-11-08 03:47:27 180,240 —-a-w c:\windows\system32\FNTCACHE.DAT
- 2008-06-23 16:57:28 63,488 ——w c:\windows\system32\icardie.dll
+ 2008-08-26 07:24:28 63,488 —-a-w c:\windows\system32\icardie.dll
- 2008-06-23 16:57:29 383,488 ——w c:\windows\system32\ieapfltr.dll
+ 2008-08-26 07:24:28 383,488 —-a-w c:\windows\system32\ieapfltr.dll
- 2008-06-23 16:57:33 6,066,176 ——w c:\windows\system32\ieframe.dll
+ 2008-10-03 17:41:15 6,066,176 —-a-w c:\windows\system32\ieframe.dll
- 2008-06-23 16:57:34 267,776 ——w c:\windows\system32\iertutil.dll
+ 2008-08-26 07:24:29 267,776 —-a-w c:\windows\system32\iertutil.dll
- 2008-06-23 16:57:36 459,264 ——w c:\windows\system32\msfeeds.dll
+ 2008-08-26 07:24:30 459,264 —-a-w c:\windows\system32\msfeeds.dll
- 2008-06-23 16:57:36 52,224 ——w c:\windows\system32\msfeedsbs.dll
+ 2008-08-26 07:24:30 52,224 —-a-w c:\windows\system32\msfeedsbs.dll
- 2008-06-24 09:57:40 3,592,192 ——w c:\windows\system32\mshtml.dll
+ 2008-08-27 08:24:32 3,593,216 —-a-w c:\windows\system32\mshtml.dll
- 2006-08-17 12:28:27 332,288 ——w c:\windows\system32\netapi32.dll
+ 2008-10-15 16:57:55 332,800 —-a-w c:\windows\system32\netapi32.dll
- 2008-06-23 16:57:40 105,984 ——w c:\windows\system32\url.dll
+ 2008-08-26 07:24:30 105,984 —-a-w c:\windows\system32\url.dll
- 2008-06-23 16:57:40 1,159,680 ——w c:\windows\system32\urlmon.dll
+ 2008-08-26 07:24:31 1,159,680 —-a-w c:\windows\system32\urlmon.dll
- 2008-06-23 16:57:41 233,472 ——w c:\windows\system32\webcheck.dll
+ 2008-08-26 07:24:31 233,472 —-a-w c:\windows\system32\webcheck.dll
- 2008-06-23 16:57:41 826,368 ——w c:\windows\system32\wininet.dll
+ 2008-08-26 07:24:31 826,368 —-a-w c:\windows\system32\wininet.dll
+ 2008-11-08 03:47:41 16,384 —-atw c:\windows\Temp\Perflib_Perfdata_104.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy2]
@="{747E722C-CB46-4A9D-BDFE-192AAD5099B1}"
[HKEY_CLASSES_ROOT\CLSID\{747E722C-CB46-4A9D-BDFE-192AAD5099B1}]
2007-06-07 21:00 2274872 –a—— c:\program files\Mozy\mozyshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozy3]
@="{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}"
[HKEY_CLASSES_ROOT\CLSID\{EE6F5A00-7898-40F7-AB77-51FF9D6DEB20}]
2007-06-07 21:00 2274872 –a—— c:\program files\Mozy\mozyshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2007-09-13 22880040]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-02-26 443968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 1404928]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-02-12 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"SAFEHOME HotKeys"="c:\program files\Steganos Safe Home\SteganosHotKeyService.exe" [2007-03-21 25088]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 32881]
"Broadbandadvisor.exe"="c:\program files\Virgin Broadband\advisor\Broadbandadvisor.exe" [2007-08-07 2061552]
"PCguard"="c:\program files\Virgin Broadband\PCguard\Rps.exe" [2007-09-05 310000]
"-FreedomNeedsReboot"="c:\program files\Virgin Broadband\PCguard\ZkRunOnceR.exe" [2007-09-05 13552]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

c:\documents and settings\Gary Lazarus\Start Menu\Programs\Startup\
Winding Road Automatic.lnk - c:\program files\Winding Road Automatic\Winding Road Automatic.exe [2006-10-17 3506439]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2005-08-24 315392]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Mozy Status.lnk - c:\program files\Mozy\mozystat.exe [2007-06-07 1783352]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Winding Road Automatic\\assets\\Issue 28\\Winding Road Issue 28.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8679:TCP"= 8679:TCP:ppLive
"7446:UDP"= 7446:UDP:ppLive

R1 mozyFilter;mozyFilter;c:\windows\system32\DRIVERS\mozy.sys [2007-06-07 52984]
R1 SLEE_15_DRIVER;Steganos Live Encryption Engine 15 [Driver];c:\windows\system32\drivers\Sleen15.sys [2007-02-21 12:33 80232]
S3 Radialpoint Security Services;Virgin Broadband PCguard;c:\windows\system32\dllhost.exe [2004-08-04 5120]
.
Contents of the 'Scheduled Tasks' folder

2008-11-08 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2008-11-03 c:\windows\Tasks\Disk Cleanup.job
- c:\windows\system32\cleanmgr.exe [2004-08-04 04:00]

2008-11-08 c:\windows\Tasks\HPpromotions psc 2350 series.job
- c:\program files\HP\Digital Imaging\bin\HP Promotions\AiOMVC\HPpromo.exe [2005-01-28 13:26]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-08 17:13:45
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: c:\windows\explorer.exe
-> c:\program files\Mozy\mozyshell.dll
.
Completion time: 2008-11-08 17:18:39
ComboFix-quarantined-files.txt 2008-11-08 17:17:34
ComboFix2.txt 2008-11-08 03:20:29
ComboFix3.txt 2008-11-08 00:50:20

Pre-Run: 131,436,273,664 bytes free
Post-Run: 131,423,793,152 bytes free

187 — E O F — 2008-11-08 03:09:28
Post #20
Good job :thumbup:

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.

    • [external image: Posted Image]


    Here's my usual all clean post

    Log looks good :D


    • Make your Internet Explorer more secure - This can be done by following these simple instructions:
      • From within Internet Explorer click on the Tools menu and then click on Options.
      • Click once on the Security tab
      • Click once on the Internet icon so it becomes highlighted.
      • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Update your AntiVirus Software - It is imperative that you update your Antivirus software at least once a week
    (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer.
    Without a firewall your computer is succeptible to being hacked and taken over.
    I am very serious about this and see it happen almost every day with my clients.
    Simply using a Firewall in its default configuration can lower your risk greatly.

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly.
    This will ensure your computer has always the latest security updates available installed on your computer.
    If there are new updates to install, install them immediately, reboot your computer, and revisit the site
    until there are no more critical updates.

  • MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.
  • Winpatrol

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly.
    Without regular updates you WILL NOT be protected when new malicious programs are released.

Only run one Anti-Virus and Firewall program.

I would also suggest you read this:
So how did I get infected in the first place?
by Tony Klein

Also: "How to prevent malware"
Post #21
Very many thanks, You have been terrific to deal with and you provide a brilliant service. I owe you a debt of gratitute. I have made a (small) donation. I'm sorry that it can't be more but I will be sure to recommend the website. Regards Gary
Post #23
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI