What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Winlogon tryig to connect to irc.zief.pl

9 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
My computer is trying to connect to irc.zief.pl. I've tried scanning it with AVG and it has found lots of trojans and Win32/Heur, Win32/Rustock.G and Win32/Agent.AO viruses. The warnings keep popping up and can't seem to do anything to stop them.

I'm using Sygate Firewall and can only connect to the internet when i'm not using it



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:17:58 p.m., on 08/02/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Sygate\SPF\smc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
C:\Archivos de programa\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\slserv.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Archivos de programa\Lexmark X1100 Series\lxbkbmgr.exe
C:\Archivos de programa\Java\jre1.5.0_06\bin\jusched.exe
C:\Archivos de programa\Lexmark X1100 Series\lxbkbmon.exe
C:\WINDOWS\PowerS.exe
C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe
C:\ARCHIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\WDVRCtrl.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\QuickTime\QTTask.exe
C:\Archivos de programa\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Messenger\msmsgs.exe
C:\Archivos de programa\Creative\MediaSource\Detector\CTDetect.exe
C:\ARCHIV~1\AVG\AVG8\avgrsx.exe
C:\ARCHIV~1\AVG\AVG8\avgemc.exe
C:\Archivos de programa\iPod\bin\iPodService.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Archivos de programa\Real\RealPlayer\RealPlay.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.terra.com.mx/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.terra.com.mx
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ndetect.exe,C:\WINDOWS\system32\deviceemulator.exe,C:\WINDOWS\system32\ndetect.exe,
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Windows Live Aplicación auxiliar de inicio de sesión - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SmcService] C:\ARCHIV~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Archivos de programa\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PowerS] C:\WINDOWS\PowerS.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARCHIV~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Windows MSN Live Messenger] winlivemsn.exe
O4 - HKLM\..\Run: [WinDVRCtrl] C:\WINDOWS\WDVRCtrl.exe
O4 - HKLM\..\Run: [ScanRegistry] C:\W
O4 - HKLM\..\Run: [QuickTime Task] "C:\Archivos de programa\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Archivos de programa\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Archivos de programa\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Creative Detector] "C:\Archivos de programa\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [Vidalia] "C:\Archivos de programa\Vidalia Bundle\Vidalia\vidalia.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [nttpbvbd.exe] C:\WINDOWS\nttpbvbd.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [nttpbvbd.exe] C:\WINDOWS\nttpbvbd.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe
O4 - Global Startup: Inicio rápido de Adobe Reader.lnk = C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: Add to AMV Convert Tool… - C:\Archivos de programa\MP3 Player Utilities 4.00\AMVConverter\grab.html
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Archivos de programa\MP3 Player Utilities 4.00\MediaManager\grab.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: www.visa.com.mx - {2D351523-E52B-40ef-98A2-9424250AF8EA} - http://www.visa.com.mx/ (file missing)
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1226936841468
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: crypt - crypts.dll (file missing)
O20 - Winlogon Notify: pmuqoxbr - pmuqoxbr.dll (file missing)
O20 - Winlogon Notify: vzxqnb - vzxqnb.dll (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Archivos de programa\Archivos comunes\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Servicio Bonjour (Bonjour Service) - Apple Inc. - C:\Archivos de programa\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\fci.exe.exe:ext.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Archivos de programa\Archivos comunes\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Servicio del iPod (iPod Service) - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Coordinador de transacciones distribuidas de Microsoft (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Archivos de programa\Sygate\SPF\smc.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - C:\Archivos de programa\Archivos comunes\SolidWorks Shared\Service\SolidWorksLicensing.exe

–
End of file - 9469 bytes


————————————————————————————-
This is what AVG found


Scan "Command line scan" was finished.
Infections found:;"172"
Infected objects removed or healed:;"172"
Not removed or healed:;"0"
Spyware found:;"0"
Spyware removed:;"0"
Not removed:;"0"
Warnings count:;"0"
Information count:;"24"
Scan started:;"Domingo, 08 de Febrero de 2009, 12:21:59 p.m."
Scan finished:;"Domingo, 08 de Febrero de 2009, 06:03:37 p.m. (5 hour(s) 41 minute(s) 38 second(s))"
Total object scanned:;"738248"
User who launched the scan:;"usuario"

Infections
File;"Infection";"Result"
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\\PromoReg;"Found registry key with reference to infected file C:\WINDOWS\TEMP\TMP3D.tmp";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127663.sys;"Virus identified Win32/Rustock.G";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127662.sys;"Virus identified Win32/Rustock.G";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0126660.sys;"Virus identified Win32/Rustock.G";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1A.tmp;"Virus identified Win32/Agent.AO";"Moved to Virus Vault"
C:\WINDOWS\Temp\BNA.tmp;"Virus identified Win32/Agent.AO";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN66.tmp;"Virus identified Win32/Agent.AO";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127724.exe;"Trojan horse SpamTool.AQY";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127725.exe;"Trojan horse SpamTool.AQY";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\YLKXADOH\em[1].txt;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127727.exe;"Trojan horse SpamTool.AQY";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127728.exe;"Trojan horse SpamTool.AQY";"Moved to Virus Vault"
C:\WINDOWS\system32\31.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\J6GWLJ2X\ge[1].txt;"Trojan horse SHeur2.OUT";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\J6GWLJ2X\ge[2].txt;"Trojan horse SHeur2.OUT";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\S9ERODYN\doc[1].txt;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\J6GWLJ2X\doc[1].txt;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127656.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP826\A0121656.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP826\A0122656.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP826\A0120656.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0126656.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP826\A0119668.sys;"Trojan horse Rootkit-Agent.AV";"Moved to Virus Vault"
C:\Documents and Settings\usuario\Configuración local\Archivos temporales de Internet\Content.IE5\A12L2PS3\sev[1].txt;"Trojan horse Injector.BW";"Moved to Virus Vault"
C:\WINDOWS\Temp\euc18.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\zxc33.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\hig7.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\system32\35.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\WINDOWS\system32\3C.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\WINDOWS\system32\4B.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\WINDOWS\system32\41.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\WINDOWS\system32\46.tmp;"Trojan horse SHeur2.OVA";"Moved to Virus Vault"
C:\WINDOWS\system32\43.tmp;"Trojan horse SHeur2.OUT";"Moved to Virus Vault"
C:\WINDOWS\system32\47.tmp;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\WINDOWS\system32\51.tmp;"Trojan horse SHeur2.OUT";"Moved to Virus Vault"
C:\WINDOWS\system32\4C.tmp;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\WINDOWS\system32\27.tmp;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\WINDOWS\system32\3E.tmp;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\WINDOWS\system32\32.tmp;"Trojan horse Rootkit-Agent.BU";"Moved to Virus Vault"
C:\WINDOWS\system32\34.tmp;"Trojan horse Injector.BW";"Moved to Virus Vault"
C:\WINDOWS\system32\38.tmp;"Trojan horse Injector.BW";"Moved to Virus Vault"
C:\WINDOWS\system32\30.tmp;"Trojan horse Injector.BW";"Moved to Virus Vault"
C:\WINDOWS\Temp\VRT1.tmp;"Trojan horse Generic12.BJFR";"Moved to Virus Vault"
C:\WINDOWS\Temp\dlj11.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\ctg15.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\xgo12.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\vll16.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\dtq2D.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\dwm29.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\uvf19.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\dyl21.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\iuc13.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\txs24.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\imm8.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\yjb2F.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\ygs14.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\xhj1A.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\hyhA.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\twnD.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\ofb9.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\oiz2E.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\pcp25.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\pku10.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\ppm1B.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\qly1E.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\qvp17.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\svj32.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\tmo2C.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\bgx5.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\bes29.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\bbi2B.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\fslB.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\fvh1D.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\gajE.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\lve21.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\mfw6.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\mxt22.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\njk2A.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\ndo26.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\2168.tmp;"Trojan horse Downloader.Generic8.TYH";"Moved to Virus Vault"
C:\WINDOWS\Temp\1685171845exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\1626782490exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\enlF.tmp;"Trojan horse Generic12.AONJ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP814\A0107062.rbf;"Trojan horse Generic.WUD";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP813\A0107010.rbf;"Trojan horse Generic.WUD";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127723.exe;"Trojan horse Downloader.Generic8.CYU";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127722.exe;"Trojan horse Downloader.Generic8.CYU";"Moved to Virus Vault"
C:\WINDOWS\Temp\TMP37.tmp;"Trojan horse Downloader.Generic_r.CL";"Moved to Virus Vault"
C:\WINDOWS\Temp\TMP35.tmp;"Trojan horse Downloader.Generic_r.CL";"Moved to Virus Vault"
C:\WINDOWS\Temp\22386482exe.. 192;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\2114902255exe. 1952;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\91BLV5XY\nws32[1].exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\O7QR12LV\nwa32[1].exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\2107457887exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\49595915exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\706112705exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\Z0A2U456\mzx32[1].exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\1800233965exe. 2000;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\1228694797exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\WINDOWS\Temp\1229677465exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\Z0A2U456\mzx32[3].exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\Z0A2U456\mzx32[2].exe;"Trojan horse Downloader.Generic_r.BJ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP825\A0118625.dll;"Trojan horse BackDoor.Generic10.AOSN";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127659.dll;"Trojan horse BackDoor.Generic10.AOSN";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127660.dll;"Trojan horse BackDoor.Generic10.AOSN";"Moved to Virus Vault"
C:\WINDOWS\Temp\E474.tmp;"Trojan horse Downloader.Generic8.TYH";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN8.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN4.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN5.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN6.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN9.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN3.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN7.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\FA5D.tmp;"Trojan horse Downloader.Generic8.TSA";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\Temp\BNB.tmp;"Trojan horse Downloader.Generic8.MSM";"Moved to Virus Vault"
C:\WINDOWS\TEMP\TMP3D.tmp;"Trojan horse Downloader.Generic_r.CL";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN30.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2F.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BNE.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BNF.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2C.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN31.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2A.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN29.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN28.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2B.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1D.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN27.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN26.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BND.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BNC.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN24.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN23.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN2D.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN22.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN21.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN20.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN13.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN25.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1F.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1E.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN17.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1C.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN1B.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN19.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN18.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN10.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN16.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN15.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN14.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN12.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\BN11.tmp;"Trojan horse BackDoor.Generic10.ALKQ";"Moved to Virus Vault"
C:\WINDOWS\system32\44.tmp;"Trojan horse Agent.AXNU";"Moved to Virus Vault"
C:\WINDOWS\system32\39.tmp;"Trojan horse Agent.AXNU";"Moved to Virus Vault"
C:\WINDOWS\system32\3B.tmp;"Trojan horse Agent.AXNU";"Moved to Virus Vault"
C:\WINDOWS\Temp\loz28.tmp;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\WINDOWS\system32\3F.tmp;"Trojan horse Agent.AXNU";"Moved to Virus Vault"
C:\WINDOWS\system32\svchost.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\WINDOWS\Temp\elw2A.tmp;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127729.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0127657.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP827\A0126658.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP826\A0121657.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP825\A0118622.exe:ext.exe;"Trojan horse Adload_r.FQ";"Moved to Virus Vault"
F:\Mis documentos\Viejos\Programas\kmd.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
F:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP825\A0118685.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
F:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP825\A0119089.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
F:\WINDOWS\$NtServicePackUninstall$\comrepl.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
F:\WINDOWS\ServicePackFiles\i386\secedit.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
F:\WINDOWS\system32\dllcache\getmac.exe;"Virus found Win32/Heur";"Moved to Virus Vault"
C:\System Volume Information\_restore{09A328B8-6BF2-48AD-AA3C-34882BE0212B}\RP825\A0118322.exe;"Virus found Win32/Heur";"Moved to Virus Vault"

Information
File;"Infection";"Result"
C:\Documents and Settings\usuario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat;"Locked file. Not tested.";"Locked file. Not tested."
C:\Documents and Settings\usuario\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\Documents and Settings\usuario\NTUSER.DAT;"Locked file. Not tested.";"Locked file. Not tested."
C:\Documents and Settings\usuario\ntuser.dat.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\pagefile.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\System Volume Information\MountPointManagerRemoteDatabase;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\default;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\default.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\SAM;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\SAM.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\SECURITY;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\SECURITY.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\software;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\software.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\system;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\config\system.LOG;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\drivers\leqdovlo.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\drivers\ndisio.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\drivers\sptd.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\drivers\Whr52.sys;"Locked file. Not tested.";"Locked file. Not tested."
C:\WINDOWS\system32\secupdat.dat;"Locked file. Not tested.";"Locked file. Not tested."
F:\Documents and Settings\All Users\Datos de programa\Microsoft\Crypto\DSS\MachineKeys\90be5c83c82be15abe8ae2c66c15d9c6_741fb938-4b39-472d-bb3e-aa15263abba5;"Locked file. Not tested.";"Locked file. Not tested."
F:\Documents and Settings\All Users\Datos de programa\Microsoft\Dr Watson\user.dmp;"Locked file. Not tested.";"Locked file. Not tested."
F:\System Volume Information\MountPointManagerRemoteDatabase;"Locked file. Not tested.";"Locked file. Not tested."
Post #2
Hi GregAustin,

:welcome:

My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following:

  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for the issues on this machine.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.

Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

One of the trojans on your machine is an IRC.bot. It gathers information from your machine and then transmits it to its "owner" through irc channels. I believe that is the activity you are seeing. irc.zief.pl is the channel it is trying to transmit your information to. This entry :

O9 - Extra button: www.visa.com.mx - {2D351523-E52B-40ef-98A2-9424250AF8EA} - http://www.visa.com.mx/ (file missing)

tells me that you do banking on your machine. You need to take steps to protect yourself immediately. Tonight.

If you wish to reformat then please let me know in your next response.
Post #3
Thanks Tomk. I don't do any banking on that machine, so I don't worry about that. Also, as I was working on the computer last night, Sygate Firewall stopped working, apparently trident.dll has gone missing. I've installed malwarebyte's and have found lots of stuff including Whr52.sys and ndisio.sys but i can't do anything to erase them. I also forgot to tell you that the first time i noticed something was when a blue screen "BAD_POOL_CALLER" kept showing up sporadically whenever i shut the machine off. I would like to fix it, but I'm expecting the worst. I would also like to know if any backup could compromise a reformatted system.
Post #4
GregAustin,

As near as I can tell, "BAD_POOL_CALLER" means that a kernel-mode process or driver incorrectly attempted to perform memory operations. This could be related to your malware.

Yes your backups could be contaminated. Let's hope we don't have to go there. Let's get it cleaned up. :)


Please download SDFix and save it to your Desktop.

You should print out these instructions, or copy them to a NotePad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Double click on SDFix.exe. It should automatically extract a folder called SDFix to your system drive (usually C:\). Please reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key repeatedly;
  • Instead of Windows loading as normal, a menu with options should appear;
  • Select the first option, to run Windows in Safe Mode, then press "Enter".
  • Choose your usual user account.
  • Open the SDFix folder and double click on RunThis.bat to start the script.
  • Type Y and press Enter to begin the script.
  • It will start cleaning your PC and then prompt you to press any key to Reboot.
  • Press any key to restart the PC.
  • Your system will take longer than normal to restart as the fixtool will be removing files.
  • When the desktop loads the Fixtool will complete the removal and display Finished.
  • Press any key to end the script and to load your desktop icons.
  • A text file should automatically open, so please copy the contents and post them here.

Then

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link –> http://forums.whatthetech.com/How_Disable_…ams_t96260.html

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.


Notes:

1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.
3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
4. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Post #5
Ok, another problem. I can't connect to the internet anymore. Device Manager shows me some problem with my network adapters. I know have four Ethernet Adapters and only one working fine, the other tell me that the driver in "ROOT\MS_PASSTHRUMP\" is missing or not working properly. I could install the software using a usb memory but i think I should wait for your advice.
Post #7 last edited
Done, I still can't acces the internet


SDFix Log
SDFix: Version 1.240
Run by [removed] on 09/02/2009 at 11:22 p.m.

Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix

Checking Services :

Rootkit Found :
C:\WINDOWS\system32\drivers\WHR52.sys - Rootkit Pandex/Cutwail - Protect.sys

Name :
WHR52

Path :
System32\Drivers\Whr52.sys

WHR52 - Deleted



Restoring Default Security Values
Restoring Default Hosts File

Rebooting

Service WHR52 - Deleted after Reboot

Checking Files :

Trojan Files Found:

C:\-11288~1 - Deleted
C:\WINDOWS\system32\25.tmp - Deleted
C:\WINDOWS\system32\26.tmp - Deleted
C:\WINDOWS\system32\29.tmp - Deleted
C:\WINDOWS\system32\2D.tmp - Deleted
C:\WINDOWS\system32\2E.tmp - Deleted
C:\WINDOWS\system32\2F.tmp - Deleted
C:\WINDOWS\system32\10.tmp - Deleted
C:\WINDOWS\system32\106.tmp - Deleted
C:\WINDOWS\system32\107.tmp - Deleted
C:\WINDOWS\system32\108.tmp - Deleted
C:\WINDOWS\system32\11.tmp - Deleted
C:\WINDOWS\system32\12.tmp - Deleted
C:\WINDOWS\system32\16.tmp - Deleted
C:\WINDOWS\system32\17.tmp - Deleted
C:\WINDOWS\system32\drivers\WHR52.sys - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 04:19:31
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden services & system hive …

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:bf,48,53,69,7e,da,fd,9f,28,bc,69,ff,59,77,74,a7,f7,bd,9b,0b,12,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04]
"h0"=dword:00000000
"ujdew"=hex:bf,48,53,69,7e,da,fd,9f,28,bc,69,ff,59,77,74,a7,f7,bd,9b,0b,12,..

scanning hidden registry entries …

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3F58409B-C4DA-D807-91C0-6C6BA8110509}]
"jakeilpjddollfachnlc"=hex:6b,61,6d,63,6c,70,6b,6f,68,6d,6d,6b,62,66,61,67,61,61,6d,6b,6d,..
"iaafcjafibigjldlec"=hex:6b,61,6d,63,6c,70,6b,6f,68,6d,6d,6b,62,66,61,67,61,61,6d,6b,6d,..
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{60AB99AA-143D-B06E-4206-74FDCC30F194}]
"jagfpgamnmgmpcpgdfcj"=hex:6b,61,6d,6a,63,6e,69,63,6d,62,63,6f,6e,61,70,6d,70,6c,61,63,67,..
"iaagajleipjpbiadae"=hex:6b,61,6d,6a,63,6e,69,63,6d,62,63,6f,6e,61,70,6d,70,6c,61,63,67,..

scanning hidden files …

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Archivos de programa\\Messenger\\msmsgs.exe"="C:\\Archivos de programa\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Archivos de programa\\BitComet\\BitComet.exe"="C:\\Archivos de programa\\BitComet\\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client"
"C:\\Archivos de programa\\DAP\\DAP.exe"="C:\\Archivos de programa\\DAP\\DAP.exe:*:Enabled:Download Accelerator Plus (DAP)"
"C:\\Archivos de programa\\Azureus\\Azureus.exe"="C:\\Archivos de programa\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"C:\\Archivos de programa\\Java\\jre1.5.0_06\\bin\\javaw.exe"="C:\\Archivos de programa\\Java\\jre1.5.0_06\\bin\\javaw.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*:Enabled:Asistente para transferencia de archivos y configuraciones"
"C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe:*:Enabled:Uso compartido de aplicaciones RTC"
"C:\\Archivos de programa\\NetMeeting\\conf.exe"="C:\\Archivos de programa\\NetMeeting\\conf.exe:*:Enabled:Windows© NetMeeting©"
"C:\\WINDOWS\\system32\\LEXPPS.EXE"="C:\\WINDOWS\\system32\\LEXPPS.EXE:*:Disabled:LEXPPS.EXE"
"C:\\Archivos de programa\\uTorrent\\utorrent.exe"="C:\\Archivos de programa\\uTorrent\\utorrent.exe:*:Enabled:æTorrent"
"C:\\Archivos de programa\\TVUPlayer\\TVUPlayer.exe"="C:\\Archivos de programa\\TVUPlayer\\TVUPlayer.exe:*:Enabled:TVU Player Component"
"C:\\Archivos de programa\\Mozilla Firefox\\firefox.exe"="C:\\Archivos de programa\\Mozilla Firefox\\firefox.exe:*:Enabled:Firefox"
"C:\\Archivos de programa\\eMule\\emule.exe"="C:\\Archivos de programa\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Archivos de programa\\VideoLAN\\VLC\\vlc.exe"="C:\\Archivos de programa\\VideoLAN\\VLC\\vlc.exe:*:Enabled:VLC media player"
"C:\\Archivos de programa\\LimeWire\\LimeWire.exe"="C:\\Archivos de programa\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Archivos de programa\\Skype\\Phone\\Skype.exe"="C:\\Archivos de programa\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. Take a deep breath "
"C:\\Archivos de programa\\MSN Messenger\\msncall.exe"="C:\\Archivos de programa\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\WINDOWS\\system32\\aot.exe"="C:\\WINDOWS\\system32\\aot.exe:*:Enabled:ENABLE"
"C:\\Documents and Settings\\usuario\\vwggk.exe"="C:\\Documents and Settings\\usuario\\vwggk.exe:*:Enabled:ENABLE"
"C:\\WINDOWS\\system32\\ydo.exe"="C:\\WINDOWS\\system32\\ydo.exe:*:Enabled:ENABLE"
"C:\\Documents and Settings\\usuario\\kqb.exe"="C:\\Documents and Settings\\usuario\\kqb.exe:*:Enabled:ENABLE"
"C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
"C:\\Archivos de programa\\Google\\Google Talk\\googletalk.exe"="C:\\Archivos de programa\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Archivos de programa\\Java\\jre1.5.0_06\\launch4j-tmp\\JDownloader.exe"="C:\\Archivos de programa\\Java\\jre1.5.0_06\\launch4j-tmp\\JDownloader.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\\WINDOWS\\system32\\java.exe"="C:\\WINDOWS\\system32\\java.exe:*:Enabled:Java™ 2 Platform Standard Edition binary"
"C:\\Archivos de programa\\Ventrilo\\Ventrilo.exe"="C:\\Archivos de programa\\Ventrilo\\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"="C:\\Archivos de programa\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Archivos de programa\\iTunes\\iTunes.exe"="C:\\Archivos de programa\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Archivos de programa\\MSN Messenger\\msncall.exe"="C:\\Archivos de programa\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)"
"C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Wed 4 Feb 2009 32,256 A..H. — "C:\Documents and Settings\usuario\fmxetxv.exe"
Wed 22 Dec 2004 76,568 ..SHR — "C:\Archivos de programa\Autodesk\Autodesk DWF Viewer\Setup.exe"
Thu 13 Jan 2005 11,360 A.SHR — "C:\Archivos de programa\Autodesk\Autodesk DWF Viewer\_Setupx.dll"
Sun 25 Dec 2005 4,348 ..SH. — "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 21 Jul 2002 435,712 …HR — "C:\WINDOWS\system32\Tools\All.exe"
Fri 19 Jul 2002 407,040 …HR — "C:\WINDOWS\system32\Tools\Change.exe"
Fri 19 Jul 2002 591,360 …HR — "C:\WINDOWS\system32\Tools\CheckPath.exe"
Tue 20 Aug 2002 447,488 …HR — "C:\WINDOWS\system32\Tools\Counter.exe"
Tue 23 Jul 2002 407,552 …HR — "C:\WINDOWS\system32\Tools\DelFolders.exe"
Fri 22 Nov 2002 416,768 …HR — "C:\WINDOWS\system32\Tools\DirectSetup.exe"
Fri 19 Jul 2002 404,992 …HR — "C:\WINDOWS\system32\Tools\RegClean.exe"
Fri 19 Jul 2002 405,504 …HR — "C:\WINDOWS\system32\Tools\Regexe.exe"
Mon 2 Dec 2002 448,512 …HR — "C:\WINDOWS\system32\Tools\Restart.exe"
Fri 19 Jul 2002 404,992 …HR — "C:\WINDOWS\system32\Tools\RunRegexe.exe"
Mon 2 Oct 2006 50,280 …H. — "C:\Archivos de programa\Archivos comunes\Adobe\ESD\DLMCleanup.exe"
Mon 17 Nov 2008 0 A.SH. — "C:\Documents and Settings\All Users\DRM\Cache\Indiv02.tmp"
Sun 1 Feb 2009 667,176 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\06e135b244b25041cf9fc099e8e1db89\BIT19.tmp"
Sun 1 Feb 2009 577,064 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\0a35794fc864bc0d2e64a0a7997ca8ff\BIT1B.tmp"
Wed 28 Jan 2009 535,080 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\59eb2033835387d39de3669ddbe50176\BIT1C.tmp"
Sun 16 Nov 2008 1,318,952 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\62923c8696c0b709b07d403f98bb11bb\BIT9.tmp"
Sun 16 Nov 2008 0 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\66bbe901ee61b85acb3f51f475c66bc4\BIT8.tmp"
Sat 7 Feb 2009 2,873,896 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\a3c5afe5e5034144d82b0bcd92bfbcca\BIT13.tmp"
Tue 3 Feb 2009 611,880 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\c47a183bd36dd38bbef396541e5847b2\BIT1E.tmp"
Tue 23 Oct 2007 3,371,008 A..H. — "C:\Documents and Settings\usuario\Datos de programa\U3\temp\Launchpad Removal.exe"
Sun 29 May 2005 21,504 A..H. — "C:\Documents and Settings\usuario\Mis documentos\FIME\respaldo usb\~WRL0004.tmp"
Sun 25 Dec 2005 4,348 A..H. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\Copia de seguridad de la licencia\drmv1key.bak"
Sun 25 Dec 2005 20 A..H. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\Copia de seguridad de la licencia\drmv1lic.bak"
Sun 25 Dec 2005 400 A.SH. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\Copia de seguridad de la licencia\drmv2key.bak"
Sun 25 Dec 2005 4,348 A..H. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\License Backup\drmv1key.bak"
Sat 10 Feb 2007 20 A..H. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\License Backup\drmv1lic.bak"
Thu 16 Nov 2006 9,856 A.SH. — "C:\Documents and Settings\usuario\Mis documentos\Mi m£sica\License Backup\drmv2key.bak"
Tue 18 Nov 2008 2,716,057 A..H. — "C:\WINDOWS\SoftwareDistribution\Download\d6f411d99c400d69b59ec7bfe6cc00d3\download\BIT22.tmp"
Wed 7 Feb 2007 333,312 A..H. — "C:\Documents and Settings\usuario\Mis documentos\FIME\9 Sem\Automatizaci¢n\~WRL3293.tmp"
Mon 5 Feb 2007 68,303,284 A..H. — "C:\Documents and Settings\usuario\Mis documentos\FIME\9 Sem\Automatizaci¢n\Pr cticas Lab. Automatizaci¢n 1-5\~WRL3953.tmp"

Finished!




ComboFix Log

ComboFix 09-02-08.02 - usuario 2009-02-10 19:35:16.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.34.3082.18.958.583 [GMT -6:00]
Running from: c:\documents and settings\[removed]\Escritorio\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: Sygate Personal Firewall *enabled*
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_FCI
——-\Legacy_ICF
——-\Legacy_TCPSR
——-\Service_Passthru


((((((((((((((((((((((((( Files Created from 2009-01-11 to 2009-02-11 )))))))))))))))))))))))))))))))
.

2009-02-09 23:16 . 2009-02-09 23:16 d——– c:\windows\ERUNT
2009-02-09 23:10 . 2009-02-10 04:28 d——– C:\SDFix
2009-02-08 20:02 . 2009-02-08 20:02 d——– c:\documents and settings\usuario\Datos de programa\Malwarebytes
2009-02-08 20:02 . 2009-02-08 20:02 d——– c:\documents and settings\All Users\Datos de programa\Malwarebytes
2009-02-08 20:02 . 2009-02-08 21:58 d——– c:\archivos de programa\Malwarebytes' Anti-Malware
2009-02-08 20:02 . 2009-01-14 16:11 38,496 –a—— c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-08 20:02 . 2009-01-14 16:11 15,504 –a—— c:\windows\system32\drivers\mbam.sys
2009-02-08 19:13 . 2009-02-08 19:13 d——– c:\archivos de programa\Trend Micro
2009-02-08 19:10 . 2009-02-08 19:11 d——– c:\archivos de programa\ERUNT
2009-02-08 18:11 . 2005-11-09 03:57 d–h—– c:\documents and settings\Administrador\Reciente
2009-02-08 18:11 . 2005-11-09 04:10 d–h—– c:\documents and settings\Administrador\Plantillas
2009-02-08 18:11 . 2005-11-09 03:57 d——– c:\documents and settings\Administrador\Mis documentos
2009-02-08 18:11 . 2005-11-09 03:57 dr——- c:\documents and settings\Administrador\Menú Inicio
2009-02-08 18:11 . 2005-11-09 03:57 d–h—– c:\documents and settings\Administrador\Impresoras
2009-02-08 18:11 . 2005-11-09 03:57 d——– c:\documents and settings\Administrador\Favoritos
2009-02-08 18:11 . 2005-11-09 03:57 d——– c:\documents and settings\Administrador\Escritorio
2009-02-08 18:11 . 2005-11-09 03:57 d–h—– c:\documents and settings\Administrador\Entorno de red
2009-02-08 18:11 . 2005-11-09 03:57 dr-h—– c:\documents and settings\Administrador\Datos de programa
2009-02-08 18:11 . 2009-02-08 18:13 d–h—– c:\documents and settings\Administrador\Configuración local
2009-02-08 18:11 . 2009-02-08 18:11 d——– c:\documents and settings\Administrador
2009-02-08 11:59 . 2009-02-08 11:59 168 –a—— c:\windows\system32\4A.tmp
2009-02-08 11:53 . 2009-02-08 11:53 168 –a—— c:\windows\system32\45.tmp
2009-02-08 11:47 . 2009-02-08 11:47 168 –a—— c:\windows\system32\40.tmp
2009-02-08 11:47 . 2009-02-08 11:47 0 –a—— c:\windows\system32\42.tmp
2009-02-08 11:44 . 2009-02-08 11:44 0 –a—— c:\windows\system32\3D.tmp
2009-02-07 23:43 . 2009-02-07 23:43 1,748 –a—— c:\windows\system32\netsf.inf
2009-02-07 23:43 . 2009-02-07 23:43 695 –a—— c:\windows\system32\netsf_m.inf
2009-02-07 23:40 . 2009-02-07 23:40 172 –a—— c:\windows\system32\37.tmp
2009-02-07 23:33 . 2009-02-07 23:33 0 –a—— c:\windows\system32\36.tmp
2009-02-07 23:29 . 2009-02-07 23:29 172 –a—— c:\windows\system32\33.tmp
2009-02-07 23:29 . 2009-02-07 23:29 0 –a—— c:\windows\system32\3A.tmp
2009-02-07 23:13 . 2009-02-07 23:13 d——– c:\archivos de programa\Microsoft CAPICOM 2.1.0.2
2009-02-07 15:38 . 2008-06-14 11:59 272,512 ——— c:\windows\system32\drivers\bthport.sys
2009-02-07 15:38 . 2008-06-14 11:59 272,512 —–c— c:\windows\system32\dllcache\bthport.sys
2009-02-07 15:33 . 2008-08-14 07:44 2,182,784 —–c— c:\windows\system32\dllcache\ntoskrnl.exe
2009-02-07 15:33 . 2008-08-14 07:44 2,138,624 —–c— c:\windows\system32\dllcache\ntkrnlmp.exe
2009-02-07 15:33 . 2008-08-14 07:44 2,060,160 —–c— c:\windows\system32\dllcache\ntkrnlpa.exe
2009-02-07 15:33 . 2008-08-14 07:44 2,018,304 —–c— c:\windows\system32\dllcache\ntkrpamp.exe
2009-02-07 14:45 . 2009-02-07 21:17 d——– c:\windows\system32\CatRoot_bak
2009-02-07 09:24 . 2008-10-16 14:06 268,648 –a—— c:\windows\system32\mucltui.dll
2009-02-07 09:24 . 2008-10-16 14:06 27,496 –a—— c:\windows\system32\mucltui.dll.mui
2009-02-07 09:21 . 2009-02-07 09:21 dr——- c:\documents and settings\LocalService\Favoritos
2009-02-06 18:40 . 2009-02-06 18:40 33,920 –a—— c:\windows\system32\drivers\leqdovlo.sys
2009-02-05 19:44 . 2004-03-19 19:52 804,754 -ra—— c:\windows\system32\drivers\vpctcom.sys.bak
2009-02-05 19:44 . 2004-03-19 19:54 703,737 -ra—— c:\windows\system32\drivers\vmodem.sys.bak
2009-02-05 19:44 . 2004-05-24 06:54 362,878 -ra—— c:\windows\system32\drivers\ptserial.sys.bak
2009-02-05 19:44 . 2004-03-19 19:55 70,384 -ra—— c:\windows\system32\drivers\vvoice.sys.bak
2009-02-05 19:44 . 2003-11-28 18:40 36,984 -ra—— c:\windows\system32\drivers\mohfilt.sys.bak
2009-02-05 19:43 . 2003-11-28 18:41 1,313,509 -ra—— c:\windows\system32\drivers\intelc51.sys.bak
2009-02-05 19:43 . 2003-11-28 18:42 659,065 -ra—— c:\windows\system32\drivers\intelc52.sys.bak
2009-02-05 19:43 . 2003-11-28 18:41 61,541 -ra—— c:\windows\system32\drivers\intelc53.sys.bak
2009-02-04 19:10 . 2009-02-04 19:10 66,560 —h—– c:\windows\system32\secupdat.dat
2009-02-04 19:10 . 2009-02-04 19:10 32,256 –ah—– c:\documents and settings\usuario\fmxetxv.exe
2009-02-03 19:33 . 2009-02-03 19:33 21,504 –a—— C:\ddcyusuf.exe
2009-02-03 19:32 . 2009-02-03 19:32 39,936 –a—— C:\txxsv.exe
2009-02-03 19:32 . 2009-02-03 19:32 21,504 –a—— C:\ophluxmi.exe
2009-02-01 18:59 . 2009-02-01 18:59 73 –a—— c:\windows\MediaManager.INI
2009-02-01 18:59 . 2009-02-01 18:58 36 –a—— C:\mediamp3.dat
2009-02-01 18:49 . 2009-02-01 18:49 d——– c:\archivos de programa\Windows Installer Clean Up
2009-02-01 18:49 . 2009-02-01 18:49 d——– c:\archivos de programa\MSECACHE
2009-02-01 16:09 . 2009-02-01 18:54 d——– c:\archivos de programa\MP3 Player Utilities 3.68
2009-02-01 16:07 . 2005-12-06 20:08 9,279 ——— c:\windows\AmvTransform.ini
2009-02-01 16:07 . 2005-09-15 00:40 8,157 ——— c:\windows\AmvPlayer.ini
2009-02-01 16:07 . 2005-09-14 18:28 170 ——— c:\windows\settings.ini
2009-01-23 18:58 . 2004-03-08 23:00 124,688 –a—— c:\windows\system32\MSWINSCK.OCX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-08 05:35 ——— d—–w c:\documents and settings\All Users\Datos de programa\avg8
2009-02-08 05:03 ——— d—–w c:\archivos de programa\Microsoft Works
2009-02-03 01:47 ——— d—–w c:\documents and settings\usuario\Datos de programa\Azureus
2009-02-01 22:50 ——— d—–w c:\archivos de programa\Windows Media Connect 2
2009-01-28 04:15 ——— d—–w c:\archivos de programa\Azureus
2009-01-17 03:11 ——— d—–w c:\documents and settings\usuario\Datos de programa\LimeWire
2009-01-11 15:33 ——— d—–w c:\documents and settings\usuario\Datos de programa\Apple Computer
2009-01-11 04:15 ——— d—–w c:\documents and settings\All Users\Datos de programa\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-01-11 04:15 ——— d—–w c:\archivos de programa\iTunes
2009-01-11 04:14 ——— d—–w c:\archivos de programa\iPod
2009-01-11 04:14 ——— d—–w c:\archivos de programa\Bonjour
2009-01-11 04:13 ——— d—–w c:\archivos de programa\QuickTime
2009-01-11 04:10 ——— d—–w c:\documents and settings\All Users\Datos de programa\Apple
2009-01-11 04:10 ——— d—–w c:\archivos de programa\Archivos comunes\Apple
2009-01-11 04:10 ——— d—–w c:\archivos de programa\Apple Software Update
2009-01-09 01:57 ——— d—–w c:\archivos de programa\Microsoft
2009-01-09 01:56 ——— d—–w c:\archivos de programa\Windows Live SkyDrive
2009-01-02 00:52 ——— d—–w c:\archivos de programa\LimeWire
2008-12-21 01:42 ——— d—–w c:\documents and settings\usuario\Datos de programa\Ventrilo
2008-12-21 01:24 ——— d—–w c:\archivos de programa\Ventrilo
2008-12-21 01:23 ——— d—–w c:\archivos de programa\Archivos comunes\Wise Installation Wizard
2008-12-12 03:18 ——— d—–w c:\archivos de programa\Windows Live
2008-12-12 03:14 ——— d—–w c:\archivos de programa\MSN Messenger
2008-12-12 03:00 ——— d—–w c:\archivos de programa\Archivos comunes\Windows Live
2008-12-12 02:55 ——— d—–w c:\documents and settings\All Users\Datos de programa\WLInstaller
2008-12-11 11:57 333,184 —-a-w c:\windows\system32\drivers\srv.sys
2008-04-10 15:49 32 —-a-w c:\documents and settings\All Users\Datos de programa\ezsid.dat
.

——- Sigcheck ——-

2008-04-13 20:19 31232 9e4fffb2d59b443ba479bcf857c13c9a c:\windows\SoftwareDistribution\Download\46be4b19c0345884ca18b3368bb9bcb4\svchost.exe
2009-02-08 19:59 31232 a5b89ca77dab7a6f7eb783ed9f383947 c:\windows\system32\svchost.exe
2009-02-03 19:32 31232 12dad3800ac99496810d73e1b485560c c:\windows\system32\dllcache\svchost.exe

2004-08-19 07:42 1051648 9ead853bf1ae7403fe9d8bcc141c5c65 c:\windows\explorer.exe
2008-04-13 20:18 1053184 92bb4cd83a1eed79b9686a984d6e0722 c:\windows\SoftwareDistribution\Download\46be4b19c0345884ca18b3368bb9bcb4\explorer.exe
2004-08-19 07:42 1051648 e4c661aefa76ff4e990bd5c9971f2803 c:\windows\system32\dllcache\explorer.exe

2008-04-13 20:18 32256 a48c06a9856198069a1d57e39dacd13d c:\windows\SoftwareDistribution\Download\46be4b19c0345884ca18b3368bb9bcb4\ctfmon.exe
2004-08-19 07:42 32256 671a7c252787fc0a5ab90dedc28a1142 c:\windows\system32\ctfmon.exe
2004-08-19 07:42 32256 04f8eea5578ea331f5c2e71d6376d526 c:\windows\system32\dllcache\ctfmon.exe

2005-06-10 18:17 74752 6f8bad96d44b811fe78d02e754b23c14 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2004-08-19 07:43 74752 61f831bacad06f5b27df58980e589893 c:\windows\$NtUninstallKB896423$\spoolsv.exe
2008-04-13 20:19 74752 1f38f281f46d1b542f680671e8bc1381 c:\windows\SoftwareDistribution\Download\46be4b19c0345884ca18b3368bb9bcb4\spoolsv.exe
2005-06-10 17:53 74752 313d3aafbf71d14ebd8266c7251e8faf c:\windows\system32\spoolsv.exe
2005-06-10 17:53 74752 6c021878e6358f4de2b887f2638e6bd3 c:\windows\system32\dllcache\spoolsv.exe

2008-04-13 20:19 43520 d9b9885bf90fcda8d0498ea6b8612022 c:\windows\SoftwareDistribution\Download\46be4b19c0345884ca18b3368bb9bcb4\userinit.exe
2004-08-19 07:43 41984 485c451f707be65db867e9e19d1c9cd2 c:\windows\system32\userinit.exe
2004-08-19 07:43 41984 caf67f27ff1ee9ef3890cfa48d7c37b6 c:\windows\system32\dllcache\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-19 32256]
"MSMSGS"="c:\archivos de programa\Messenger\msmsgs.exe" [2004-10-13 1711104]
"Creative Detector"="c:\archivos de programa\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 176128]
"RemoteControl"="c:\archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2003-12-08 53248]
"SmcService"="c:\archiv~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"Lexmark X1100 Series"="c:\archivos de programa\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 77824]
"SunJavaUpdateSched"="c:\archivos de programa\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 57455]
"PowerS"="c:\windows\PowerS.exe" [2001-08-03 180280]
"TkBellExe"="c:\archivos de programa\Archivos comunes\Real\Update_OB\realsched.exe" [2006-07-20 200749]
"AVG8_TRAY"="c:\archiv~1\AVG\AVG8\avgtray.exe" [2008-11-30 1261336]
"WinDVRCtrl"="c:\windows\WDVRCtrl.exe" [2002-04-01 120736]
"QuickTime Task"="c:\archivos de programa\QuickTime\QTTask.exe" [2008-11-04 434176]
"iTunesHelper"="c:\archivos de programa\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"VTTimer"="VTTimer.exe" [2004-09-01 c:\windows\system32\VTTimer.exe]
"PCTVOICE"="pctspk.exe" [2004-01-29 c:\windows\system32\pctspk.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-04-14 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 190696]

c:\documents and settings\All Users\Men£ Inicio\Programas\Inicio\
AutoCAD Startup Accelerator.lnk - c:\archivos de programa\Archivos comunes\Autodesk Shared\acstart16.exe [2005-03-05 10872]
Inicio r pido de Adobe Reader.lnk - c:\archivos de programa\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 46592]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2008-09-13 21:59 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\G:\0autocheck autochk *

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\leqdovlo.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Archivos de programa\\Messenger\\msmsgs.exe"=
"c:\\Archivos de programa\\Azureus\\Azureus.exe"=
"c:\\Archivos de programa\\Java\\jre1.5.0_06\\bin\\javaw.exe"=
"c:\\WINDOWS\\system32\\usmt\\migwiz.exe"=
"c:\\WINDOWS\\system32\\rtcshare.exe"=
"c:\\Archivos de programa\\NetMeeting\\conf.exe"=
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\Archivos de programa\\uTorrent\\utorrent.exe"=
"c:\\Archivos de programa\\Mozilla Firefox\\firefox.exe"=
"c:\\Archivos de programa\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Archivos de programa\\LimeWire\\LimeWire.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"=
"c:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"=
"c:\\Archivos de programa\\Google\\Google Talk\\googletalk.exe"=
"c:\\Archivos de programa\\Java\\jre1.5.0_06\\launch4j-tmp\\JDownloader.exe"=
"c:\\WINDOWS\\system32\\java.exe"=
"c:\\Archivos de programa\\Ventrilo\\Ventrilo.exe"=
"c:\\Archivos de programa\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Archivos de programa\\Bonjour\\mDNSResponder.exe"=
"c:\\Archivos de programa\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 leqdovlo;leqdovlo;c:\windows\system32\drivers\leqdovlo.sys [2009-02-06 33920]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-11-16 28544]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-09-13 97928]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\archiv~1\AVG\AVG8\avgemc.exe [2008-09-13 875288]
R2 avg8wd;AVG Free8 WatchDog;c:\archiv~1\AVG\AVG8\avgwdsvc.exe [2008-09-13 231704]
R2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-09-13 76040]
S2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.SYS –> c:\windows\system32\drivers\BT848.SYS [?]
S2 BTTUNER;BtTuner, WDM TV Tuner;c:\windows\system32\drivers\Bttuner.sys [2006-07-28 21824]
S2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\Btxbar.sys [2006-07-28 12796]
S3 Cdankiwp;Cdankiwp; [x]
S3 VL815;USB ARCADE STICK;c:\windows\system32\drivers\VL815.sys [2006-07-14 28733]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{24875579-a02d-11dc-ac54-0013d3a53670}]
\Shell\AutoRun\command - G:\xpbkh.com
\Shell\explore\Command - G:\xpbkh.com
\Shell\open\Command - G:\xpbkh.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53224a42-8031-11dc-ac1c-0013d3a53670}]
\shell\Setup\command - G:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{72137092-bca6-11db-aa6e-0013d3a53670}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d6cb10a7-cb6b-11dc-aca1-0013d3a53670}]
\shell\Setup\command - G:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2009-02-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\archivos de programa\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

ShellIconOverlayIdentifiers-{45A9B2C0-0D04-4AE6-B2F6-544B5C5E1EF3} - c:\windows\System32\wmproxt.dll
HKCU-Run-Vidalia - c:\archivos de programa\Vidalia Bundle\Vidalia\vidalia.exe
HKU-Default-Run-nttpbvbd.exe - c:\windows\nttpbvbd.exe
HKU-Default-Run-zzfxlisv.exe - c:\windows\zzfxlisv.exe
Notify-pmuqoxbr - pmuqoxbr.dll
Notify-vzxqnb - vzxqnb.dll


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.terra.com.mx/
mStart Page = hxxp://www.terra.com.mx
mWindow Title = Terra
uInternet Settings,ProxyOverride = *.local
IE: Add to AMV Convert Tool… - c:\archivos de programa\MP3 Player Utilities 4.00\AMVConverter\grab.html
IE: E&xportar; a Microsoft Excel - c:\archiv~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: MediaManager tool grab multimedia file - c:\archivos de programa\MP3 Player Utilities 4.00\MediaManager\grab.html
IE: {{2D351523-E52B-40ef-98A2-9424250AF8EA} - http://www.visa.com.mx/
FF - ProfilePath - c:\documents and settings\usuario\Datos de programa\Mozilla\Firefox\Profiles\Nueva carpeta\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;=
FF - prefs.js: browser.startup.homepage - hxxp://www.elnorte.com
FF - component: c:\archivos de programa\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJava11.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJava12.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJava13.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJava14.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJava32.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPJPI150_06.dll
FF - plugin: c:\archivos de programa\Java\jre1.5.0_06\bin\NPOJI610.dll
FF - plugin: c:\archivos de programa\Mozilla Firefox\plugins\npmusicn.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-10 19:41:43
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\OMSCAN]
"ImagePath"="\Sys"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1085031214-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{3F58409B-C4DA-D807-91C0-6C6BA8110509}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jakeilpjddollfachnlc"=hex:6b,61,6d,63,6c,70,6b,6f,68,6d,6d,6b,62,66,61,67,61,
61,6d,6b,6d,70,00,77
"iaafcjafibigjldlec"=hex:6b,61,6d,63,6c,70,6b,6f,68,6d,6d,6b,62,66,61,67,61,61,
6d,6b,6d,70,00,01

[HKEY_USERS\S-1-5-21-1085031214-492894223-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{60AB99AA-143D-B06E-4206-74FDCC30F194}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"jagfpgamnmgmpcpgdfcj"=hex:6b,61,6d,6a,63,6e,69,63,6d,62,63,6f,6e,61,70,6d,70,
6c,61,63,67,61,00,00
"iaagajleipjpbiadae"=hex:6b,61,6d,6a,63,6e,69,63,6d,62,63,6f,6e,61,70,6d,70,6c,
61,63,67,61,00,00

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•Ñw*]
"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(568)
c:\archivos de programa\Bonjour\mdnsNSP.dll
c:\windows\system32\avgrsstx.dll
.
———————— Other Running Processes ————————
.
c:\archivos de programa\Sygate\SPF\Smc.exe
c:\windows\system32\LEXBCES.EXE
c:\windows\system32\LEXPPS.EXE
c:\archivos de programa\Archivos comunes\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\archivos de programa\Bonjour\mDNSResponder.exe
c:\windows\system32\CTSVCCDA.EXE
c:\archivos de programa\Archivos comunes\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\wscntfy.exe
c:\archivos de programa\Lexmark X1100 Series\lxbkbmon.exe
c:\archivos de programa\AVG\AVG8\avgrsx.exe
c:\archivos de programa\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-10 19:47:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-11 01:46:10

Pre-Run: 15,912,386,560 bytes libres
Post-Run: 15,866,814,464 bytes libres

317
Post #8
GregAustin,

I believe that you may have the most infected machine I've ever worked on. :pullhair:

You will have to transfer this file also in order to run.

Download the diagnostic tool MGADiag and save it to your desktop.

  • Double-click on MGADiag.exe.
  • Click Run and Run again.
  • Click Continue, then Copy.
  • Paste the report in your next reply.
Post #9
Diagnostic Report (1.9.0006.1): —————————————– WGA Data–> Validation Status: Genuine Validation Code: 0 Online Validation Code: N/A Cached Validation Code: N/A Windows Product Key: *****-*****-3R89F-D2KXW-VPK3J Windows Product Key Hash: Ro/Y7HENE9CfW7lW+QtlNbYQEE8= Windows Product ID: 55274-640-8365391-23920 Windows Product ID Type: 1 Windows License Type: Volume Windows OS version: 5.1.2600.2.00010100.2.0.pro ID: {375FECBF-CAFE-4438-85AA-1364CB5F0A20}(1) Is Admin: Yes TestCab: 0x0 WGA Version: Registered, 1.5.723.1 Signed By: Microsoft Product Name: N/A Architecture: N/A Build lab: N/A TTS Error: N/A Validation Diagnostic: 025D1FF3-230-1 Resolution Status: N/A WgaER Data–> ThreatID(s): N/A Version: N/A WGA Notifications Data–> Cached Result: 0 File Exists: Yes Version: 1.5.540.0 WgaTray.exe Signed By: Microsoft WgaLogon.dll Signed By: Microsoft OGA Notifications Data–> Cached Result: N/A, hr = 0x80070002 Version: N/A, hr = 0x80070002 WGATray.exe Signed By: Microsoft OGAAddin.dll Signed By: N/A, hr = 0x80070002 OGA Data–> Office Status: 114 Blocked VLK 2 Microsoft Office Professional Edition 2003 - 114 Blocked VLK 2 OGA Version: N/A, 0x80070002 Signed By: N/A, hr = 0x80070002 Office Diagnostics: 025D1FF3-230-1 Browser Data–> Proxy settings: N/A User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32) Default Browser: C:\Archivos de programa\Mozilla Firefox\firefox.exe Download signed ActiveX controls: Prompt Download unsigned ActiveX controls: Disabled Run ActiveX controls and plug-ins: Allowed Initialize and script ActiveX controls not marked as safe: Disabled Allow scripting of Internet Explorer Webbrowser control: Disabled Active scripting: Allowed Script ActiveX controls marked as safe for scripting: Allowed File Scan Data–> Other data–> Office Details: {375FECBF-CAFE-4438-85AA-1364CB5F0A20}1.9.0006.15.1.2600.2.00010100.2.0.prox32*****-*****-*****-*****-VPK3J55274-640-8365391-239201S-1-5-21-1085031214-492894223-725345543MICRO-STAR INTERNATIONAL CO., LTDMS-7071Phoenix Technologies, LTD6.00 PG20050926000000.000000+000190130C70184226D080A0C0AHora estándar central (México)(GMT-06:00)03 114 Licensing Data–> N/A HWID Data–> N/A OEM Activation 1.0 Data–> BIOS string matches: no Marker string from BIOS: N/A Marker string from OEMBIOS.DAT: N/A, hr = 0x80004005 OEM Activation 2.0 Data–> N/A
Post #10
I'm not sure yet how to get you back online. You're going to have to transfer a couple more tools. Download both tools before running either of them.

Download Rooter.exe to your desktop

  • Then doubleclick it to start the tool
  • A Notepad file containing the report will open, also found at %systemdrive%\Rooter.txt. Post that here

Download avz4.zip from here[1]Unzip it to your desktop to a folder named avz4
[2]Double click on AVZ.exe to run it.
[3]Choose from the menu "File" => "Standard scripts " and mark the "Healing/Quarantine and Advanced System Investigation"check box.
[4]Click on the “Execute selected scripts”.
[5]Automatic scanning, healing and system check will be executed.
[6]A logfile (avz_sysinfo.htm) will be created and saved in the LOG folder in the AVZ directory as virusinfo_syscure.zip.
[7]It is necessary to reboot your machine, because AVZ might disturb some program operations (like antiviruses and firewall) during the system scan.
[8]All applications will work properly after the system restart.

When restarted
[1]Start AVZ.
[2]Choose from the menu "File" => "Standard scripts " and mark the “Advanced System Investigation" check box.
[3]Click on the "Execute selected scripts".
[4]A system check will be automatically performed, and the created logfile (avz_sysinfo.htm) will be saved in the LOG folder in the AVZdirectory as virusinfo_syscheck.zip.
Attach both zip files to your next post

To attach a file, do the following:
  • Click Add Reply
  • Under the reply panel is the Attachments Panel
  • Browse for the attachment file you want to upload, then click the green Upload button
  • Once it has uploaded, click the Manage Current Attachments drop down box
  • Click on [external image: Posted Image]to insert the attachment into your post
Post #11
Microsoft Windows XP Professional ( v5.1.2600 ) Service Pack 2 X86-based PC ( Multiprocessor Free : Intel® Pentium® 4 CPU 2.66GHz ) BIOS : Phoenix - AwardBIOS v6.00PG USER : usuario ( Administrator ) BOOT : Normal boot Antivirus : AVG Anti-Virus Free 8.0 (Not Activated) Firewall : Sygate Personal Firewall 4.6 (Activated) C:\ (Local Disk) - NTFS - Total:100 Go (Free:14 Go) D:\ (CD or DVD) - CDFS - Total:0 Go (Free:0 Go) 10/02/2009|21:20 ———————-\\ Search.. ———————-\\ Cracks & Keygens.. C:\DOCUME~1\usuario\Datos de programa\Azureus\torrents\[isoHunt] Adobe_Photoshop_CS3_v10.0_Extended_Incl_Keygen.3962267.TPB.torrent C:\DOCUME~1\usuario\Escritorio\chuy\img\cjmc24\cjmc25\CuteFTPES\crackcute.exe C:\DOCUME~1\usuario\Escritorio\roms\cracksht.zip C:\DOCUME~1\usuario\Escritorio\roms\mt_crack.zip C:\DOCUME~1\usuario\Mis documentos\Adobe Photoshop CS3 v10.0 Extended Incl Keygen C:\DOCUME~1\usuario\Mis documentos\Adobe Photoshop CS3 v10.0 Extended Incl Keygen\Adobe Photoshop CS3 v10.0 Extended Incl Keygen.daa C:\DOCUME~1\usuario\Mis documentos\GoodNESv3.1 [GoodMerged]\Crackout.7z 1 - "C:\Rooter$\Rooter_1.txt" - 10/02/2009|21:22 ———————-\\ Scan completed at 21:22

Attachments:

Post #12
GregAustin, It has been pointed out to me that even though the Microsoft Diagnostic tool shows your XP as genuine, it is actually a pirated copy. That makes sense seeing as most of the rest of your programs are pirated. If you take a look at the terms of use, you will see that we do not work on unauthorized systems and/or programs. Therefore, this thread will be closed. Do you have anything you'd like to say before I close this thread?

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI