Morphling 0 Report post Posted November 20, 2008 Mozilla Firefox suddenly crashed while i was scanning with Kaspersky. Going to scan with Kaspersky on Saturday because im too busy with my exams today and tomorrow. Then i'll follow the next steps you told me. Thanks again Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 20, 2008 (edited) The Kasperksy online scan website doesn't work again and when i try to open HijackThis or anything from the Control Panel i get an Application Error. Edited November 20, 2008 by Morphling Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 20, 2008 (edited) explorer.exe crashed and wasn't starting up. My task manager was also disabled so i was forced to use system restore. It fixed the Application error but the Kaspersky online scan website still doesn't work. Task manager works now and i have 22 svchost.exe again and, iexplore.exe is running too. Edited November 20, 2008 by Morphling Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 20, 2008 Do this after Kaspersky 1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present): O4 - HKLM\..\Run: [system Config Boot] syscgboot.exe 2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis. Then post a new HJT log The Kaspersky website still doesn't work. Here is the new HJT Log after checking O4 - HKLM\..\Run: [system Config Boot] syscgboot.exe and clicking "Fix Checked". Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:24:37, on 20/11/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 O2 - BHO: (no name) - {BF95FDC3-8AA3-4480-833F-A5CB31A26602} - C:\WINDOWS\system32\pmnnLEXo.dll O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [reader] C:\WINDOWS\System32\reader.exe O4 - HKLM\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe O4 - HKLM\..\Run: [NvSvc] C:\WINDOWS\system32\nvsvc32.exe O4 - HKLM\..\Run: [system Config Boot] syscgboot.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [rs32net] C:\WINDOWS\System32\rs32net.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1221311057437 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1221801125421 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll O20 - Winlogon Notify: efcDUkIy - C:\WINDOWS\SYSTEM32\efcDUkIy.dll O20 - Winlogon Notify: hcfnujod - C:\WINDOWS\SYSTEM32\hcfnujod.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: FCI - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe O23 - Service: ICF - Unknown owner - C:\WINDOWS\system32\svchost.exe:ext.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 5054 bytes Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 20, 2008 Something is returning Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 21, 2008 ComboFix 08-11-19.08 - Mahamed 2008-11-21 17:51:19.5 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.174 [GMT 11:00] Running from: c:\documents and settings\Mahamed\Desktop\ComboFix.exe * Created a new restore point . ADS - svchost.exe: deleted 37376 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\ctfmon.exe c:\windows\system\_sv_CMD_ c:\windows\system\_sv_CMD_\_U_.exe c:\windows\system32\__c0047B94.dat c:\windows\system32\__c009A4F9.dat c:\windows\system32\__c00D38B1.dat c:\windows\system32\A.tmp c:\windows\system32\ahwxsfgv.dll c:\windows\system32\crypts.dll c:\windows\system32\D.tmp c:\windows\system32\drivers\ati5imxx.sys c:\windows\system32\drivers\ntndis.exe c:\windows\system32\drivers\ntndis.sys c:\windows\system32\E.tmp c:\windows\system32\hcfnujod.dll c:\windows\system32\hcfnujod32(2)(2).dll c:\windows\system32\hcfnujod32.dll c:\windows\system32\jkkLBstS.dll c:\windows\system32\mcrh.tmp c:\windows\system32\oXELnnmp.ini c:\windows\system32\qgukdjmx.ini c:\windows\system32\rqRIbxxv.dll c:\windows\system32\rs32net.exe c:\windows\system32\StsBLkkj.ini c:\windows\system32\StsBLkkj.ini2 c:\windows\system32\uhoggs.dll c:\windows\system32\wfsqbggf.dll c:\windows\system32\xmjdkugq.dll c:\windows\Tasks\bakueynm.job c:\windows\system32\lsass.exe . . . is infected!! c:\windows\system32\winlogon.exe . . . is infected!! c:\windows\system32\services.exe . . . is infected!! c:\windows\system32\svchost.exe . . . is infected!! c:\windows\system32\spoolsv.exe . . . is infected!! c:\windows\explorer.exe . . . is infected!! . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ATI5IMXX -------\Legacy_FCI -------\Legacy_ICF -------\Legacy_LPTRDCSRV -------\Legacy_TCPSR -------\Service_ati5imxx -------\Service_FCI -------\Service_ICF -------\Service_tcpsr ((((((((((((((((((((((((( Files Created from 2008-10-21 to 2008-11-21 ))))))))))))))))))))))))))))))) . 2008-12-22 15:59 . 2008-12-22 15:59 447,200 --a------ c:\windows\system32\OpenQuicktimeLib.dll 2008-12-22 15:59 . 2008-12-22 15:59 332,512 --a------ c:\windows\system32\3ivxVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\SamsungVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\DivXVfWCodec.dll 2008-12-22 15:58 . 2008-12-22 15:58 1,155,808 --a------ c:\windows\system32\3ivx.dll 2008-12-22 15:52 . 2008-12-22 15:52 66,272 --a------ c:\windows\system32\libfaac.dll 2008-11-21 00:09 . 2008-11-21 00:09 38,400 --a------ c:\windows\system32\geBrOefg.dll 2008-11-21 00:08 . 2008-11-21 00:08 88 --a------ c:\windows\system32\B.tmp 2008-11-21 00:08 . 2008-11-21 00:08 0 --a------ c:\windows\system32\14.tmp 2008-11-20 23:29 . 2008-11-20 23:29 38,400 --a------ c:\windows\system32\geBsSLDw.dll 2008-11-20 22:05 . 2008-11-20 22:05 88 --a------ c:\windows\system32\18.tmp 2008-11-20 22:05 . 2008-11-20 22:05 0 --a------ c:\windows\system32\1B.tmp 2008-11-20 21:33 . 2008-11-20 21:33 88 --a------ c:\windows\system32\3.tmp 2008-11-20 21:33 . 2008-11-20 21:33 0 --a------ c:\windows\system32\7.tmp 2008-11-20 15:41 . 2008-11-20 15:42 245,760 --a------ c:\windows\system32\pmnnLEXo.dll 2008-11-20 15:36 . 2008-11-20 15:36 38,400 --a------ c:\windows\system32\efcDUkIy.dll 2008-11-20 15:34 . 2008-11-20 15:34 88 --a------ c:\windows\system32\2.tmp 2008-11-20 15:34 . 2008-11-20 15:34 0 --a------ c:\windows\system32\5.tmp 2008-11-20 13:48 . 2008-11-20 13:48 0 --a------ c:\windows\system32\A2.tmp 2008-11-20 12:42 . 2008-11-20 12:42 0 --a------ c:\windows\system32\7B.tmp 2008-11-19 22:01 . 2008-11-19 22:01 0 --a------ c:\windows\system32\16.tmp 2008-11-19 22:00 . 2008-11-19 22:00 88 --a------ c:\windows\system32\12.tmp 2008-11-19 18:14 . 2008-11-19 18:14 88 --a------ c:\windows\system32\67.tmp 2008-11-19 18:14 . 2008-11-19 18:14 0 --a------ c:\windows\system32\6A.tmp 2008-11-19 17:21 . 2008-11-19 17:21 244 --ah----- C:\sqmnoopt07.sqm 2008-11-19 17:21 . 2008-11-19 17:21 232 --ah----- C:\sqmdata07.sqm 2008-11-19 13:50 . 2008-11-19 13:50 64,512 --a------ c:\windows\system32\nvsvc32.exe 2008-11-19 13:43 . 2008-11-19 13:43 132 --a------ c:\windows\system32\8.tmp 2008-11-19 13:43 . 2008-11-19 13:43 0 --a------ c:\windows\system32\C.tmp 2008-11-18 22:45 . 2008-11-18 22:45 0 --a------ c:\windows\system32\20.tmp 2008-11-18 22:36 . 2008-11-18 22:36 0 --a------ c:\windows\system32\17.tmp 2008-11-18 22:27 . 2008-11-18 22:27 0 --a------ c:\windows\system32\11.tmp 2008-11-18 18:21 . 2008-11-18 18:21 80,896 --a------ c:\windows\system32\10.tmp 2008-11-18 18:21 . 2008-11-18 18:21 132 --a------ c:\windows\system32\F.tmp 2008-11-18 18:21 . 2008-11-18 18:21 0 --a------ c:\windows\system32\13.tmp 2008-11-18 16:57 . 2008-11-18 16:57 80,896 --a------ c:\windows\system32\DC2.tmp 2008-11-18 16:57 . 2008-11-18 16:57 0 --a------ c:\windows\system32\DC5.tmp 2008-11-18 16:56 . 2008-11-18 16:57 132 --a------ c:\windows\system32\DC1.tmp 2008-11-18 15:44 . 2008-11-20 19:11 32,768 --a------ c:\windows\system32\drivers\ati5imxx(5).sys 2008-11-18 15:44 . 2008-11-20 21:11 32,768 --a------ c:\windows\system32\drivers\ati5imxx(4).sys 2008-11-18 15:44 . 2008-11-20 21:34 32,768 --a------ c:\windows\system32\drivers\ati5imxx(3).sys 2008-11-18 15:44 . 2008-11-20 15:36 32,768 --a------ c:\windows\system32\drivers\ati5imxx(2).sys 2008-11-18 15:44 . 2008-11-18 15:44 0 --a------ c:\windows\system32\81.tmp 2008-11-18 15:43 . 2008-11-18 15:43 80,896 --a------ c:\windows\system32\7E.tmp 2008-11-18 15:43 . 2008-11-18 15:43 132 --a------ c:\windows\system32\7D.tmp 2008-11-17 20:28 . 2008-11-17 20:28 12,800 --a------ c:\windows\system32\74.tmp 2008-11-17 20:28 . 2008-11-17 20:28 0 --a------ c:\windows\system32\77.tmp 2008-11-17 20:27 . 2008-11-17 20:28 88 --a------ c:\windows\system32\70.tmp 2008-11-17 19:37 . 2008-11-21 00:08 31,744 --a------ c:\windows\system32\reader.exe 2008-11-17 19:37 . 2008-11-17 19:37 12,800 --a------ c:\windows\system32\2F.tmp 2008-11-17 19:37 . 2008-11-17 19:37 128 --a------ c:\windows\system32\2E.tmp 2008-11-17 19:37 . 2008-11-17 19:37 0 --a------ c:\windows\system32\32.tmp 2008-11-17 19:35 . 2008-11-03 13:18 36,864 -rahs---- c:\windows\system32\syscgboot.exe 2008-11-17 14:23 . 2008-11-17 14:23 44 --a------ c:\windows\system32\4E.tmp 2008-11-17 14:23 . 2008-11-17 14:23 0 --a------ c:\windows\system32\50.tmp 2008-11-17 13:53 . 2008-11-17 13:53 44 --a------ c:\windows\system32\35.tmp 2008-11-17 13:53 . 2008-11-17 13:53 0 --a------ c:\windows\system32\37.tmp 2008-11-17 00:45 . 2008-11-17 00:45 44 --a------ c:\windows\system32\88.tmp 2008-11-17 00:45 . 2008-11-17 00:45 0 --a------ c:\windows\system32\8A.tmp 2008-11-16 17:40 . 2008-11-16 17:40 44 --a------ c:\windows\system32\2A.tmp 2008-11-16 17:40 . 2008-11-16 17:40 0 --a------ c:\windows\system32\2D.tmp 2008-11-15 14:19 . 2008-11-15 14:19 207,360 --a--c--- c:\windows\system32\dllcache\ndis.sys 2008-11-15 11:46 . 2008-11-15 11:46 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-15 11:42 . 2008-11-15 11:42 <DIR> d-------- c:\windows\ERUNT 2008-11-15 11:18 . 2008-11-15 12:02 <DIR> d-------- C:\SDFix 2008-11-15 09:29 . 2008-11-15 09:29 <DIR> d-------- C:\_OTMoveIt 2008-11-15 08:35 . 2008-11-15 09:10 <DIR> d-------- C:\Lop SD 2008-11-14 19:54 . 2008-11-14 19:54 <DIR> d-------- c:\program files\Trend Micro 2008-11-12 19:13 . 2008-11-12 19:13 <DIR> d-------- c:\documents and settings\Administrator\DoctorWeb 2008-11-12 18:49 . 2008-11-12 18:49 <DIR> d-------- c:\documents and settings\Mahamed\DoctorWeb 2008-11-12 17:07 . 2008-11-12 18:28 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-12 16:17 . 2008-11-12 16:28 15,083,520 --a------ c:\program files\spybotsd160.exe 2008-11-12 16:00 . 2008-11-12 16:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET 2008-11-12 15:54 . 2008-11-13 17:25 <DIR> d-------- c:\program files\RogueRemover FREE 2008-11-12 15:53 . 2008-09-05 04:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 15:53 . 2008-10-24 22:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 10:57 . 2008-11-12 10:57 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Apple Computer 2008-11-11 20:14 . 2008-11-13 18:35 <DIR> d-------- c:\program files\Lavasoft 2008-11-11 19:37 . 2008-11-11 19:59 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h(2).exe 2008-11-11 17:01 . 2008-11-11 17:17 23,804,784 --a------ c:\program files\aaw2008.exe 2008-11-10 17:56 . 2008-11-10 17:56 <DIR> d-------- c:\program files\Alwil Software 2008-11-09 10:56 . 2008-11-09 10:56 <DIR> d-------- c:\program files\3ivx 2008-11-09 10:04 . 2008-11-09 10:49 <DIR> d-------- c:\windows\system32\quicktime 2008-11-09 09:49 . 2008-11-13 18:20 <DIR> d-------- c:\program files\QuickTime 2008-11-09 09:39 . 2008-11-09 09:40 <DIR> d-------- c:\program files\Service Packs 2008-11-08 11:02 . 2008-11-14 02:15 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\LimeWire 2008-11-08 11:01 . 2008-11-13 13:26 <DIR> d-------- c:\program files\LimeWire 2008-11-07 23:18 . 2008-11-07 23:18 <DIR> d-------- c:\windows\Sun 2008-11-07 19:16 . 2008-11-10 18:45 <DIR> d-------- c:\program files\DNA 2008-11-07 19:16 . 2008-11-10 23:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DNA 2008-11-07 17:54 . 2008-11-07 20:25 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DivX 2008-11-07 17:15 . 2008-11-07 17:17 <DIR> d-------- c:\program files\DivX 2008-11-06 22:31 . 2008-11-06 22:31 <DIR> d-------- c:\program files\Sun 2008-11-06 22:28 . 2008-11-06 22:27 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-06 22:28 . 2008-11-06 22:27 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-06 22:27 . 2008-11-06 22:27 <DIR> d-------- c:\program files\Java 2008-11-04 18:23 . 2008-11-04 18:25 <DIR> d-------- c:\windows\system32\NtmsData 2008-11-04 10:08 . 2008-11-04 10:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-04 10:07 . 2008-11-13 17:23 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-04 10:07 . 2008-11-04 10:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\SUPERAntiSpyware.com 2008-11-04 10:04 . 2008-11-13 18:34 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-03 20:04 . 2008-11-03 20:04 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Search 2008-11-03 18:53 . 2008-11-12 10:42 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Comodo 2008-11-03 15:00 . 2008-11-12 10:42 <DIR> d-------- c:\program files\COMODO 2008-11-03 09:17 . 2008-11-03 09:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\MSN6 2008-11-03 09:12 . 2008-11-20 23:18 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 08:09 . 2008-11-03 09:15 <DIR> d-------- c:\program files\Smart Virus Remover 2008-11-03 01:16 . 2008-11-03 01:16 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\MSN6 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx07.dll 2008-10-29 09:35 . 2008-10-29 09:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll 2008-10-29 09:35 . 2008-10-29 09:35 802,816 --a------ c:\windows\system32\divx_xx11.dll 2008-10-28 03:44 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\xing shared 2008-10-28 03:43 . 2008-10-28 03:43 <DIR> d-------- c:\program files\Real 2008-10-26 22:21 . 2008-10-26 22:21 <DIR> d-------- c:\program files\Real Alternative 2008-10-26 22:21 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\Real 2008-10-25 19:18 . 2008-10-25 19:18 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Desktop Search 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\windows\system32\GroupPolicy 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\program files\Windows Desktop Search 2008-10-25 19:15 . 2008-03-08 04:02 192,000 -----c--- c:\windows\system32\dllcache\offfilt.dll 2008-10-25 19:15 . 2008-03-08 04:02 98,304 -----c--- c:\windows\system32\dllcache\nlhtml.dll 2008-10-25 19:15 . 2008-03-08 04:02 29,696 -----c--- c:\windows\system32\dllcache\mimefilt.dll 2008-10-25 19:14 . 2008-10-25 19:14 <DIR> d-------- c:\program files\CONEXANT 2008-10-25 19:13 . 2008-10-16 03:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-25 17:16 . 2008-10-25 17:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-21 00:21 23,040 ----a-w c:\windows\system32\svchost.exe 2008-11-20 11:37 23,040 ----a-w c:\windows\system32\svchost(2)(2).exe 2008-11-15 04:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-15 03:19 207,360 ----a-w c:\windows\system32\drivers\ndis.sys 2008-11-14 21:20 --------- d-----w c:\program files\Common Files\Adobe 2008-11-12 05:43 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-11-12 05:24 --------- d-----w c:\program files\QuickGamma 2008-11-12 05:24 --------- d-----w c:\program files\Free FLV Converter 2008-11-12 02:16 19,762 ----a-w c:\program files\Common Files\ynojysu.ban 2008-11-07 08:06 263 ----a-w c:\program files\gapa.ini 2008-11-03 05:58 --------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla! 2008-10-27 16:43 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-10-27 16:43 348,160 ----a-w c:\windows\system32\msvcr71.dll 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-22 05:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 05:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-21 06:31 --------- d-----w c:\documents and settings\Mahamed\Application Data\uTorrent 2008-10-18 03:38 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\o4Patch.exe 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\IEDFix.C.exe 2008-10-03 01:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\Media Player Classic 2008-10-03 00:49 --------- d-----w c:\program files\Combined Community Codec Pack 2008-10-02 07:53 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-10-02 07:53 --------- d-----w c:\program files\AskBarDis 2008-10-01 04:51 98,816 ----a-w c:\windows\system32\VACFix.exe 2008-09-30 05:28 --------- d-----w c:\program files\Xvid 2008-09-25 09:10 --------- d-----w c:\program files\NOS 2008-09-25 09:10 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2008-09-25 08:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2008-09-25 08:11 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 536,576 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-23 02:51 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-09-22 11:00 --------- d-----w c:\program files\Messenger Plus! Live 2008-09-21 02:04 --------- d-----w c:\program files\Windows Live 2008-09-21 02:02 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-09-21 01:55 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:57 129,784 ----a-w c:\windows\system32\pxafs.dll 2008-09-19 21:57 120,056 ----a-w c:\windows\system32\pxcpyi64.exe 2008-09-19 21:57 118,520 ----a-w c:\windows\system32\pxinsi64.exe 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-12 18:30 278,528 ----a-w c:\windows\system32\TubeFinder.exe 2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-08 12:38 99,840 ----a-w c:\windows\system32\AntiXPVSTFix.exe 2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ------- Sigcheck ------- 2004-08-04 01:56 14336 5de5b5c556f04f26dd6068267644a8ca c:\windows\$NtServicePackUninstall$\svchost.exe 2008-04-14 06:42 23040 06fcb16ca84dcc11302fd1854b6b246c c:\windows\ServicePackFiles\i386\svchost.exe 2004-08-04 18:56 23040 385a7e4e53c27ae4047816c5ec582f5e c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\svchost.exe 2008-11-21 11:21 23040 06fcb16ca84dcc11302fd1854b6b246c c:\windows\system32\svchost.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\$NtServicePackUninstall$\winlogon.exe 2008-04-14 06:42 516608 808f4f0941af51bd295eded8071a286b c:\windows\ServicePackFiles\i386\winlogon.exe 2004-08-04 18:56 510976 8c45beb4d178e0b993ca55ab14ce53fd c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\winlogon.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\system32\winlogon.exe 2004-08-04 00:14 182912 1df7f42665c94b825322fae71721130d c:\windows\$NtServicePackUninstall$\ndis.sys 2008-04-14 01:50 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys 2004-08-04 17:14 182912 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ndis.sys 2008-11-15 14:19 207360 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys 2008-11-15 14:19 207360 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys 2004-08-04 01:56 1032192 56195559d22a24d39c0d04b954fb1901 c:\windows\explorer.exe 2004-08-04 01:56 1032192 56195559d22a24d39c0d04b954fb1901 c:\windows\$NtServicePackUninstall$\explorer.exe 2008-04-14 06:42 1042432 8aab8f71347002bc2ac64ae0beb5e905 c:\windows\ServicePackFiles\i386\explorer.exe 2004-08-04 18:56 1040896 0c8ec25cd14642a3cd74d794176645b5 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\$NtServicePackUninstall$\services.exe 2008-04-14 06:42 117248 ef1758444f1504c33b79c26a5926d69b c:\windows\ServicePackFiles\i386\services.exe 2004-08-04 18:56 116736 b83fefe879296a209915092ee67437fa c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\services.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\system32\services.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\$NtServicePackUninstall$\lsass.exe 2008-04-14 06:42 22016 0df2519a636ddbf74e43c73f6db43943 c:\windows\ServicePackFiles\i386\lsass.exe 2004-08-04 18:56 22016 0b6bba57a1bb9998e542d911e27b5bd6 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lsass.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\system32\lsass.exe 2004-08-04 01:56 15360 fe408f07f63eece65f4e3f8ce09030d5 c:\windows\$NtServicePackUninstall$\ctfmon.exe 2008-04-14 06:42 24064 7799f2ecb1713979335e8abc1ec42bcf c:\windows\ServicePackFiles\i386\ctfmon.exe 2004-08-04 18:56 24064 e0e0a63fa6e13fcee9d77d729a14e7b1 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe 2008-04-14 06:42 15360 b61439f0bc14b836101d6387197715e8 c:\windows\system32\CTFMON.EXE 2005-06-11 11:17 57856 8cfa993f4fdf5568aff15d99765c21d6 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 10:53 57856 07763dfe5ea3c14946d4052c56ba377d c:\windows\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 01:56 57856 cb39079b8adca54c691db044351b94bf c:\windows\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 06:42 66560 5a45de4b505cbbc52e4b09706357c050 c:\windows\ServicePackFiles\i386\spoolsv.exe 2004-08-04 18:56 66560 234df4f1361db1af65a3fe7ef06925fe c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe 2005-06-11 11:17 57856 8cfa993f4fdf5568aff15d99765c21d6 c:\windows\system32\spoolsv.exe 2004-08-04 01:56 24576 27f29f65bf97a1dd81d50229b5023745 c:\windows\$NtServicePackUninstall$\userinit.exe 2008-04-14 06:42 34816 f7746144dda31959e03610f052c33d92 c:\windows\ServicePackFiles\i386\userinit.exe 2004-08-04 18:56 33280 215be2b305baa8e049760ba95cb8b6ba c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe 2008-04-14 06:42 26112 31c92b93500c4ee80248b3d67acf4480 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((( [email protected]_10.40.06.95 ))))))))))))))))))))))))))))))))))))))))) . + 2008-11-21 07:03:36 4,475 ----a-w c:\windows\ERDNT\CFUNDO.dat + 2008-08-07 04:27:04 175,616 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-11-15 00:42:34 4,595,712 ----a-w c:\windows\ERUNT\SDFIX\Users\00000001\ntuser.dat + 2008-11-15 00:42:34 294,912 ----a-w c:\windows\ERUNT\SDFIX\Users\00000002\UsrClass.dat + 2008-08-07 04:27:04 175,616 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-11-15 00:42:21 4,595,712 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat + 2008-11-15 00:42:21 294,912 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat + 2008-04-13 19:41:50 61,440 -c--a-w c:\windows\ie7\admparse.dll + 2008-04-13 19:41:50 99,840 -c--a-w c:\windows\ie7\advpack.dll + 2008-04-13 19:41:52 33,792 -c--a-w c:\windows\ie7\custsat.dll + 2008-04-13 19:41:54 357,888 -c--a-w c:\windows\ie7\dxtmsft.dll + 2008-04-13 19:41:54 205,312 -c--a-w c:\windows\ie7\dxtrans.dll + 2008-04-13 19:41:54 55,808 -c--a-w c:\windows\ie7\extmgr.dll + 2008-04-13 19:41:56 38,912 -c--a-w c:\windows\ie7\hmmapi.dll + 2008-04-13 19:42:24 34,304 -c--a-w c:\windows\ie7\ie4uinit.exe + 2008-04-13 19:41:56 143,360 -c--a-w c:\windows\ie7\ieakeng.dll + 2008-04-13 19:41:56 216,576 -c--a-w c:\windows\ie7\ieaksie.dll + 2003-03-31 12:00:00 221,184 -c--a-w c:\windows\ie7\ieakui.dll + 2008-04-13 19:41:56 323,584 -c--a-w c:\windows\ie7\iedkcs32.dll + 2008-04-13 19:42:24 18,432 -c--a-w c:\windows\ie7\iedw.exe + 2008-04-13 19:41:56 251,904 -c--a-w c:\windows\ie7\iepeers.dll + 2008-04-13 19:41:56 48,640 -c--a-w c:\windows\ie7\iernonce.dll + 2008-04-13 19:41:56 62,976 -c--a-w c:\windows\ie7\iesetup.dll + 2008-04-13 19:42:24 93,184 -c--a-w c:\windows\ie7\iexplore.exe + 2008-04-13 19:41:56 35,840 -c--a-w c:\windows\ie7\imgutil.dll + 2008-04-13 19:41:56 96,256 -c--a-w c:\windows\ie7\inseng.dll + 2008-04-13 19:41:58 15,872 -c--a-w c:\windows\ie7\jsproxy.dll + 2008-04-13 19:41:58 22,016 -c--a-w c:\windows\ie7\licmgr10.dll + 2008-04-13 19:42:28 37,888 -c--a-w c:\windows\ie7\mshta.exe + 2008-08-20 05:30:53 3,067,904 -c--a-w c:\windows\ie7\mshtml.dll + 2008-04-13 19:42:00 449,024 -c--a-w c:\windows\ie7\mshtmled.dll + 2008-04-13 11:56:28 56,832 -c--a-w c:\windows\ie7\mshtmler.dll + 2003-03-31 12:00:00 146,432 -c--a-w c:\windows\ie7\msls31.dll + 2008-04-13 19:42:02 146,432 -c--a-w c:\windows\ie7\msrating.dll + 2008-04-13 19:42:02 532,480 -c--a-w c:\windows\ie7\mstime.dll + 2008-04-13 19:42:04 96,256 -c--a-w c:\windows\ie7\occache.dll + 2008-04-13 19:42:04 39,424 -c--a-w c:\windows\ie7\pngfilt.dll + 2007-08-13 07:54:42 32,960 -c--a-w c:\windows\ie7\spuninst\iecustom.dll + 2007-08-13 07:52:06 66,048 -c--a-w c:\windows\ie7\spuninst\ieResetIcons.exe + 2006-09-06 06:43:16 213,216 -c--a-w c:\windows\ie7\spuninst\spuninst.exe + 2006-09-06 06:43:18 371,424 -c--a-w c:\windows\ie7\spuninst\updspapi.dll + 2008-04-13 19:42:10 37,888 -c--a-w c:\windows\ie7\url.dll + 2008-08-20 05:30:52 619,520 -c--a-w c:\windows\ie7\urlmon.dll + 2008-04-13 19:42:10 851,968 -c--a-w c:\windows\ie7\vgx.dll + 2008-04-13 19:42:10 276,480 -c--a-w c:\windows\ie7\webcheck.dll + 2008-08-20 05:30:51 666,112 -c--a-w c:\windows\ie7\wininet.dll - 2008-04-13 19:41:50 61,440 ----a-w c:\windows\system32\admparse.dll + 2007-08-13 07:39:20 71,680 ----a-w c:\windows\system32\admparse.dll - 2008-04-13 19:41:50 99,840 ----a-w c:\windows\system32\advpack.dll + 2007-08-13 07:39:00 123,904 ----a-w c:\windows\system32\advpack.dll + 2008-11-20 13:24:00 32,768 --sha-w c:\windows\system32\config\systemprofile\Application Data\Microsoft\Internet Explorer\UserData\index.dat - 2008-11-14 23:33:52 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-11-21 00:21:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-11-14 23:33:52 65,536 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-21 00:21:58 327,680 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-21 00:25:28 49,152 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008112120081122\index.dat - 2008-11-14 23:33:55 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-11-21 00:21:58 327,680 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2007-08-13 07:39:20 71,680 -c----w c:\windows\system32\dllcache\admparse.dll + 2007-08-13 07:39:00 123,904 -c----w c:\windows\system32\dllcache\advpack.dll + 2006-09-23 02:12:50 1,022,976 -c----w c:\windows\system32\dllcache\browseui.dll + 2007-08-13 07:42:54 17,408 -c----w c:\windows\system32\dllcache\corpol.dll - 2008-04-13 19:41:52 33,792 -c--a-w c:\windows\system32\dllcache\custsat.dll + 2007-08-13 07:54:10 33,792 -c--a-w c:\windows\system32\dllcache\custsat.dll + 2007-08-13 07:35:46 346,624 -c----w c:\windows\system32\dllcache\dxtmsft.dll + 2007-08-13 07:35:38 214,528 -c----w c:\windows\system32\dllcache\dxtrans.dll + 2007-08-13 07:54:10 131,584 -c----w c:\windows\system32\dllcache\extmgr.dll + 2007-08-13 07:18:02 60,416 -c----w c:\windows\system32\dllcache\hmmapi.dll + 2007-08-13 07:39:06 54,784 -c----w c:\windows\system32\dllcache\ie4uinit.exe + 2007-08-13 07:39:26 152,064 -c----w c:\windows\system32\dllcache\ieakeng.dll + 2007-08-13 07:39:54 229,376 -c----w c:\windows\system32\dllcache\ieaksie.dll - 2003-03-31 12:00:00 221,184 -c--a-w c:\windows\system32\dllcache\ieakui.dll + 2007-08-13 06:56:54 161,792 -c--a-w c:\windows\system32\dllcache\ieakui.dll + 2007-08-13 07:39:50 382,976 -c----w c:\windows\system32\dllcache\iedkcs32.dll + 2007-08-13 07:44:02 69,120 -c----w c:\windows\system32\dllcache\iedw.exe + 2007-08-13 07:45:18 78,336 -c----w c:\windows\system32\dllcache\ieencode.dll + 2007-08-13 07:54:10 191,488 -c----w c:\windows\system32\dllcache\iepeers.dll + 2007-08-13 07:39:10 43,008 -c----w c:\windows\system32\dllcache\iernonce.dll + 2007-08-13 07:39:12 55,296 -c----w c:\windows\system32\dllcache\iesetup.dll + 2007-08-13 07:43:56 622,080 -c----w c:\windows\system32\dllcache\iexplore.exe + 2007-08-13 07:36:06 36,352 -c----w c:\windows\system32\dllcache\imgutil.dll + 2007-08-13 07:39:02 92,672 -c----w c:\windows\system32\dllcache\inseng.dll + 2007-08-13 07:38:04 491,520 -c----w c:\windows\system32\dllcache\jscript.dll + 2007-08-13 07:54:10 27,136 -c----w c:\windows\system32\dllcache\jsproxy.dll + 2007-08-13 07:44:18 40,960 -c----w c:\windows\system32\dllcache\licmgr10.dll + 2007-08-13 07:32:30 45,568 -c----w c:\windows\system32\dllcache\mshta.exe - 2008-08-20 05:30:53 3,067,904 -c--a-w c:\windows\system32\dllcache\mshtml.dll + 2007-08-13 07:54:12 3,578,368 -c--a-w c:\windows\system32\dllcache\mshtml.dll + 2007-08-13 07:54:10 475,648 -c----w c:\windows\system32\dllcache\mshtmled.dll + 2007-08-13 07:01:12 48,128 -c----w c:\windows\system32\dllcache\mshtmler.dll - 2003-03-31 12:00:00 146,432 -c--a-w c:\windows\system32\dllcache\msls31.dll + 2007-08-13 07:54:10 156,160 -c--a-w c:\windows\system32\dllcache\msls31.dll + 2007-08-13 07:44:26 192,000 -c----w c:\windows\system32\dllcache\msrating.dll + 2007-08-13 07:54:10 670,720 -c----w c:\windows\system32\dllcache\mstime.dll + 2007-08-13 07:44:06 101,376 -c----w c:\windows\system32\dllcache\occache.dll + 2007-08-13 07:36:12 44,544 -c----w c:\windows\system32\dllcache\pngfilt.dll + 2006-09-23 02:12:50 474,112 -c----w c:\windows\system32\dllcache\shlwapi.dll + 2007-08-13 07:44:30 105,984 -c----w c:\windows\system32\dllcache\url.dll - 2008-08-20 05:30:52 619,520 -c--a-w c:\windows\system32\dllcache\urlmon.dll + 2007-08-13 07:54:10 1,162,240 -c--a-w c:\windows\system32\dllcache\urlmon.dll + 2007-08-13 07:54:10 413,696 -c----w c:\windows\system32\dllcache\vbscript.dll + 2007-08-13 07:54:10 765,952 -c----w c:\windows\system32\dllcache\VGX.dll + 2007-08-13 07:54:10 231,424 -c----w c:\windows\system32\dllcache\webcheck.dll - 2008-08-20 05:30:51 666,112 -c--a-w c:\windows\system32\dllcache\wininet.dll + 2007-08-13 07:54:10 818,688 -c--a-w c:\windows\system32\dllcache\wininet.dll - 2008-04-13 19:41:54 357,888 ----a-w c:\windows\system32\dxtmsft.dll + 2007-08-13 07:35:46 346,624 ----a-w c:\windows\system32\dxtmsft.dll - 2008-04-13 19:41:54 205,312 ----a-w c:\windows\system32\dxtrans.dll + 2007-08-13 07:35:38 214,528 ----a-w c:\windows\system32\dxtrans.dll - 2008-04-13 19:41:54 55,808 ----a-w c:\windows\system32\extmgr.dll + 2007-08-13 07:54:10 131,584 ----a-w c:\windows\system32\extmgr.dll - 2008-11-14 23:20:25 264,616 ----a-w c:\windows\system32\FNTCACHE.DAT + 2008-11-17 05:49:16 264,616 ----a-w c:\windows\system32\FNTCACHE.DAT + 2007-08-13 07:36:26 61,952 ----a-w c:\windows\system32\icardie.dll - 2008-04-13 19:42:24 34,304 ----a-w c:\windows\system32\ie4uinit.exe + 2007-08-13 07:39:06 63,488 ----a-w c:\windows\system32\ie4uinit.exe - 2008-04-13 19:41:56 143,360 ----a-w c:\windows\system32\ieakeng.dll + 2007-08-13 07:39:26 152,064 ----a-w c:\windows\system32\ieakeng.dll - 2008-04-13 19:41:56 216,576 ----a-w c:\windows\system32\ieaksie.dll + 2007-08-13 07:39:54 229,376 ----a-w c:\windows\system32\ieaksie.dll - 2003-03-31 12:00:00 221,184 ----a-w c:\windows\system32\ieakui.dll + 2007-08-13 06:56:54 161,792 ----a-w c:\windows\system32\ieakui.dll + 2007-02-12 05:10:12 2,451,312 ----a-w c:\windows\system32\ieapfltr.dat + 2007-07-11 01:27:48 383,488 ----a-w c:\windows\system32\ieapfltr.dll - 2008-04-13 19:41:56 323,584 ----a-w c:\windows\system32\iedkcs32.dll + 2007-08-13 07:39:50 382,976 ----a-w c:\windows\system32\iedkcs32.dll + 2007-08-13 07:54:10 6,049,280 ----a-w c:\windows\system32\ieframe.dll - 2008-04-13 19:41:56 251,904 ----a-w c:\windows\system32\iepeers.dll + 2007-08-13 07:54:10 191,488 ----a-w c:\windows\system32\iepeers.dll - 2008-04-13 19:41:56 48,640 ----a-w c:\windows\system32\iernonce.dll + 2007-08-13 07:39:10 43,008 ----a-w c:\windows\system32\iernonce.dll + 2007-08-13 07:34:04 266,752 ----a-w c:\windows\system32\iertutil.dll - 2008-04-13 19:41:56 62,976 ----a-w c:\windows\system32\iesetup.dll + 2007-08-13 07:39:12 55,296 ----a-w c:\windows\system32\iesetup.dll - 2008-08-25 08:38:00 13,824 ----a-w c:\windows\system32\ieudinit.exe + 2007-08-13 07:39:10 22,016 ----a-w c:\windows\system32\ieudinit.exe + 2007-08-13 07:54:10 180,736 ----a-w c:\windows\system32\ieui.dll - 2008-04-13 19:41:56 35,840 ----a-w c:\windows\system32\imgutil.dll + 2007-08-13 07:36:06 36,352 ----a-w c:\windows\system32\imgutil.dll - 2008-04-13 19:41:56 96,256 ----a-w c:\windows\system32\inseng.dll + 2007-08-13 07:39:02 92,672 ----a-w c:\windows\system32\inseng.dll - 2008-04-13 19:41:58 15,872 ----a-w c:\windows\system32\jsproxy.dll + 2007-08-13 07:54:10 27,136 ----a-w c:\windows\system32\jsproxy.dll - 2008-04-13 19:41:58 22,016 ----a-w c:\windows\system32\licmgr10.dll + 2007-08-13 07:44:18 40,960 ----a-w c:\windows\system32\licmgr10.dll + 2007-08-13 07:54:10 458,752 ----a-w c:\windows\system32\msfeeds.dll + 2007-08-13 07:54:10 50,688 ----a-w c:\windows\system32\msfeedsbs.dll + 2007-08-13 07:36:40 20,992 ----a-w c:\windows\system32\msfeedssync.exe - 2008-04-13 19:42:28 37,888 ----a-w c:\windows\system32\mshta.exe + 2007-08-13 07:32:30 54,272 ----a-w c:\windows\system32\mshta.exe - 2008-08-20 05:30:53 3,067,904 ----a-w c:\windows\system32\mshtml.dll + 2007-08-13 07:54:12 3,578,368 ----a-w c:\windows\system32\mshtml.dll - 2008-04-13 19:42:00 449,024 ----a-w c:\windows\system32\mshtmled.dll + 2007-08-13 07:54:10 475,648 ----a-w c:\windows\system32\mshtmled.dll - 2008-04-13 11:56:28 56,832 ----a-w c:\windows\system32\mshtmler.dll + 2007-08-13 07:01:12 48,128 ----a-w c:\windows\system32\mshtmler.dll - 2003-03-31 12:00:00 146,432 ----a-w c:\windows\system32\msls31.dll + 2007-08-13 07:54:10 156,160 ----a-w c:\windows\system32\msls31.dll - 2008-04-13 19:42:02 146,432 ----a-w c:\windows\system32\msrating.dll + 2007-08-13 07:44:26 192,000 ----a-w c:\windows\system32\msrating.dll - 2008-04-13 19:42:02 532,480 ----a-w c:\windows\system32\mstime.dll + 2007-08-13 07:54:10 670,720 ----a-w c:\windows\system32\mstime.dll - 2008-04-13 19:42:04 96,256 ----a-w c:\windows\system32\occache.dll + 2007-08-13 07:44:06 101,376 ----a-w c:\windows\system32\occache.dll - 2008-04-13 19:42:04 39,424 ----a-w c:\windows\system32\pngfilt.dll + 2007-08-13 07:36:12 44,544 ----a-w c:\windows\system32\pngfilt.dll - 2008-11-10 07:43:20 270,584 ----a-w c:\windows\system32\Restore\rstrlog.dat + 2008-11-20 12:18:36 363,188 ----a-w c:\windows\system32\Restore\rstrlog.dat - 2008-04-13 19:42:10 37,888 ----a-w c:\windows\system32\url.dll + 2007-08-13 07:44:30 105,984 ----a-w c:\windows\system32\url.dll - 2008-08-20 05:30:52 619,520 ----a-w c:\windows\system32\urlmon.dll + 2007-08-13 07:54:10 1,162,240 ----a-w c:\windows\system32\urlmon.dll - 2008-04-13 19:42:10 276,480 ----a-w c:\windows\system32\webcheck.dll + 2007-08-13 07:54:10 231,424 ----a-w c:\windows\system32\webcheck.dll + 2007-08-13 07:45:16 215,040 ----a-w c:\windows\system32\WinFXDocObj.exe - 2008-08-20 05:30:51 666,112 ----a-w c:\windows\system32\wininet.dll + 2007-08-13 07:54:10 818,688 ----a-w c:\windows\system32\wininet.dll + 2008-11-21 07:10:26 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_674.dat . -- Snapshot reset to current date -- . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{17872498-72C4-43D3-88ED-AAB13B850F4D}] 2008-11-21 18:16 247296 --a------ c:\windows\system32\ddcCuspQ.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E007A5F-299F-44FC-8B6B-F06B61867A2E}] 2008-11-21 00:09 38400 --a------ c:\windows\system32\geBrOefg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BF95FDC3-8AA3-4480-833F-A5CB31A26602}] 2008-11-20 15:42 245760 --a------ c:\windows\system32\pmnnLEXo.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "reader"="c:\windows\System32\reader.exe" [2008-11-21 31744] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-06 136600] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-28 185872] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "NvSvc"="c:\windows\system32\nvsvc32.exe" [2008-11-19 64512] "System Config Boot"="syscgboot.exe" [2008-11-03 c:\windows\system32\syscgboot.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] "{4E007A5F-299F-44FC-8B6B-F06B61867A2E}"= "c:\windows\system32\geBrOefg.dll" [2008-11-21 38400] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcDUkIy] 2008-11-20 15:36 38400 c:\windows\system32\efcDUkIy.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geBrOefg] 2008-11-21 00:09 38400 c:\windows\system32\geBrOefg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\ddcCuspQ [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^all users^start menu^programs^startup^windows search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^mahamed^start menu^programs^startup^limewire on startup.lnk] path=c:\documents and settings\Mahamed\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-11-07 19:16 342336 c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 06:42 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-10-28 03:43 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\MBAM.EXE"= "c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"= "c:\\WINDOWS\\system32\\nvsvc32.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:WarcraftIII "6112:UDP"= 6112:UDP:WarcraftIII R3 genmcmnusb;USB Scroll Mouse Driver;c:\windows\system32\DRIVERS\gflmouhid.sys [2004-04-19 6656] S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-09-25 33752] . - - - - ORPHANS REMOVED - - - - BHO-{97945ADD-8D6C-4842-B17D-E843D3F6F650} - c:\windows\system32\jkkLBstS.dll HKCU-Run-rs32net - c:\windows\System32\rs32net.exe HKU-Default-Run-rs32net - c:\windows\System32\rs32net.exe . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Mahamed\Application Data\Mozilla\Firefox\Profiles\hv8n2fz6.default\ FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\np_gp.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-21 18:10:36 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... c:\windows\system32\syscgboot.exe [1372] 0x832A2DA0 scanning hidden autostart entries ... scanning hidden files ... c:\windows\system32\svchost(2)(2).exe:ext.exe 25088 bytes executable c:\windows\system32\ddcCuspQ.dll 247296 bytes executable scan completed successfully hidden files: 2 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: c:\windows\system32\winlogon.exe -> c:\windows\system32\geBrOefg.dll -> c:\windows\system32\mlJYsrPh.dll PROCESS: c:\windows\explorer.exe -> c:\windows\system32\ynubdaxm.dll -> c:\windows\system32\ddcCuspQ.dll . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wscntfy.exe c:\windows\system32\RUNDLL32.EXE c:\windows\system32\RUNDLL32.EXE . ************************************************************************** . Completion time: 2008-11-21 18:19:37 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-21 07:19:18 ComboFix2.txt 2008-11-16 00:40:56 ComboFix3.txt 2008-11-15 04:34:58 ComboFix4.txt 2008-11-15 01:30:39 ComboFix5.txt 2008-11-21 06:49:25 Pre-Run: 59,606,605,824 bytes free Post-Run: 59,689,213,952 bytes free 604 --- E O F --- 2008-11-15 13:26:13 Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 21, 2008 Hello 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: file::c:\windows\system32\geBrOefg.dll c:\windows\system32\B.tmp c:\windows\system32\14.tmp c:\windows\system32\geBsSLDw.dll c:\windows\system32\18.tmp c:\windows\system32\1B.tmp c:\windows\system32\3.tmp c:\windows\system32\7.tmp c:\windows\system32\pmnnLEXo.dll c:\windows\system32\efcDUkIy.dll c:\windows\system32\2.tmp c:\windows\system32\5.tmp c:\windows\system32\A2.tmp c:\windows\system32\7B.tmp c:\windows\system32\16.tmp c:\windows\system32\12.tmp c:\windows\system32\67.tmp c:\windows\system32\6A.tmp c:\windows\system32\8.tmp c:\windows\system32\C.tmp c:\windows\system32\20.tmp c:\windows\system32\17.tmp c:\windows\system32\11.tmp c:\windows\system32\10.tmp c:\windows\system32\F.tmp c:\windows\system32\13.tmp c:\windows\system32\DC2.tmp c:\windows\system32\DC5.tmp c:\windows\system32\DC1.tmp c:\windows\system32\81.tmp c:\windows\system32\7E.tmp c:\windows\system32\7D.tmp c:\windows\system32\74.tmp c:\windows\system32\77.tmp c:\windows\system32\70.tmp c:\windows\system32\reader.exe c:\windows\system32\2F.tmp c:\windows\system32\2E.tmp c:\windows\system32\32.tmp c:\windows\system32\syscgboot.exe c:\windows\system32\4E.tmp c:\windows\system32\50.tmp c:\windows\system32\35.tmp c:\windows\system32\37.tmp c:\windows\system32\88.tmp c:\windows\system32\8A.tmp c:\windows\system32\2A.tmp c:\windows\system32\2D.tmp c:\program files\Common Files\ynojysu.ban c:\program files\gapa.ini Folder:: Registry:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 21, 2008 ComboFix 08-11-21.03 - Mahamed 2008-11-22 8:44:00.6 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.158 [GMT 11:00] Running from: c:\documents and settings\Mahamed\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Mahamed\Desktop\CFScript.txt * Created a new restore point FILE :: c:\program files\Common Files\ynojysu.ban c:\program files\gapa.ini c:\windows\system32\10.tmp c:\windows\system32\11.tmp c:\windows\system32\12.tmp c:\windows\system32\13.tmp c:\windows\system32\14.tmp c:\windows\system32\16.tmp c:\windows\system32\17.tmp c:\windows\system32\18.tmp c:\windows\system32\1B.tmp c:\windows\system32\2.tmp c:\windows\system32\20.tmp c:\windows\system32\2A.tmp c:\windows\system32\2D.tmp c:\windows\system32\2E.tmp c:\windows\system32\2F.tmp c:\windows\system32\3.tmp c:\windows\system32\32.tmp c:\windows\system32\35.tmp c:\windows\system32\37.tmp c:\windows\system32\4E.tmp c:\windows\system32\5.tmp c:\windows\system32\50.tmp c:\windows\system32\67.tmp c:\windows\system32\6A.tmp c:\windows\system32\7.tmp c:\windows\system32\70.tmp c:\windows\system32\74.tmp c:\windows\system32\77.tmp c:\windows\system32\7B.tmp c:\windows\system32\7D.tmp c:\windows\system32\7E.tmp c:\windows\system32\8.tmp c:\windows\system32\81.tmp c:\windows\system32\88.tmp c:\windows\system32\8A.tmp c:\windows\system32\A2.tmp c:\windows\system32\B.tmp c:\windows\system32\C.tmp c:\windows\system32\DC1.tmp c:\windows\system32\DC2.tmp c:\windows\system32\DC5.tmp c:\windows\system32\efcDUkIy.dll c:\windows\system32\F.tmp c:\windows\system32\geBrOefg.dll c:\windows\system32\geBsSLDw.dll c:\windows\system32\pmnnLEXo.dll c:\windows\system32\reader.exe c:\windows\system32\syscgboot.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\program files\Common Files\ynojysu.ban c:\program files\gapa.ini c:\windows\system32\__c00935A2.dat c:\windows\system32\10.tmp c:\windows\system32\11.tmp c:\windows\system32\12.tmp c:\windows\system32\13.tmp c:\windows\system32\14.tmp c:\windows\system32\16.tmp c:\windows\system32\17.tmp c:\windows\system32\18.tmp c:\windows\system32\1B.tmp c:\windows\system32\2.tmp c:\windows\system32\20.tmp c:\windows\system32\2A.tmp c:\windows\system32\2D.tmp c:\windows\system32\2E.tmp c:\windows\system32\2F.tmp c:\windows\system32\3.tmp c:\windows\system32\32.tmp c:\windows\system32\35.tmp c:\windows\system32\37.tmp c:\windows\system32\4E.tmp c:\windows\system32\5.tmp c:\windows\system32\50.tmp c:\windows\system32\67.tmp c:\windows\system32\6A.tmp c:\windows\system32\7.tmp c:\windows\system32\70.tmp c:\windows\system32\74.tmp c:\windows\system32\77.tmp c:\windows\system32\7B.tmp c:\windows\system32\7D.tmp c:\windows\system32\7E.tmp c:\windows\system32\8.tmp c:\windows\system32\81.tmp c:\windows\system32\88.tmp c:\windows\system32\8A.tmp c:\windows\system32\A2.tmp c:\windows\system32\adpsshco.dll c:\windows\system32\B.tmp c:\windows\system32\brastk.exe c:\windows\system32\C.tmp c:\windows\system32\DC1.tmp c:\windows\system32\DC2.tmp c:\windows\system32\DC5.tmp c:\windows\system32\ddcCuspQ.dll c:\windows\system32\DelSelf.bat c:\windows\system32\drivers\ntndis.exe c:\windows\system32\drivers\ntndis.sys c:\windows\system32\efcDUkIy.dll c:\windows\system32\F.tmp c:\windows\system32\geBrOefg.dll c:\windows\system32\geBsSLDw.dll c:\windows\system32\jonyyq.dll c:\windows\system32\mlJYsrPh.dll c:\windows\system32\mxadbuny.ini c:\windows\system32\pmnnLEXo.dll c:\windows\system32\QpsuCcdd.ini c:\windows\system32\QpsuCcdd.ini2 c:\windows\system32\reader.exe c:\windows\system32\syscgboot.exe c:\windows\system32\ynubdaxm.dll c:\windows\system32\lsass.exe . . . is infected!! c:\windows\system32\winlogon.exe . . . is infected!! c:\windows\system32\services.exe . . . is infected!! c:\windows\system32\svchost.exe . . . is infected!! c:\windows\system32\spoolsv.exe . . . is infected!! c:\windows\explorer.exe . . . is infected!! . ((((((((((((((((((((((((( Files Created from 2008-10-21 to 2008-11-21 ))))))))))))))))))))))))))))))) . 2008-12-22 15:59 . 2008-12-22 15:59 447,200 --a------ c:\windows\system32\OpenQuicktimeLib.dll 2008-12-22 15:59 . 2008-12-22 15:59 332,512 --a------ c:\windows\system32\3ivxVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\SamsungVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\DivXVfWCodec.dll 2008-12-22 15:58 . 2008-12-22 15:58 1,155,808 --a------ c:\windows\system32\3ivx.dll 2008-12-22 15:52 . 2008-12-22 15:52 66,272 --a------ c:\windows\system32\libfaac.dll 2008-11-21 22:58 . 2008-11-21 22:58 44,032 --a------ c:\windows\system32\B3.tmp 2008-11-21 22:58 . 2008-11-21 22:58 48 --a------ c:\windows\system32\B2.tmp 2008-11-21 22:58 . 2008-11-21 22:58 0 --a------ c:\windows\system32\B4.tmp 2008-11-21 18:22 . 2008-11-21 18:22 51,200 --a------ c:\windows\system32\xjwhlewq.dll 2008-11-19 17:21 . 2008-11-19 17:21 244 --ah----- C:\sqmnoopt07.sqm 2008-11-19 17:21 . 2008-11-19 17:21 232 --ah----- C:\sqmdata07.sqm 2008-11-19 13:50 . 2008-11-19 13:50 64,512 --a------ c:\windows\system32\nvsvc32.exe 2008-11-18 15:44 . 2008-11-20 19:11 32,768 --a------ c:\windows\system32\drivers\ati5imxx(5).sys 2008-11-18 15:44 . 2008-11-20 21:11 32,768 --a------ c:\windows\system32\drivers\ati5imxx(4).sys 2008-11-18 15:44 . 2008-11-20 21:34 32,768 --a------ c:\windows\system32\drivers\ati5imxx(3).sys 2008-11-18 15:44 . 2008-11-20 15:36 32,768 --a------ c:\windows\system32\drivers\ati5imxx(2).sys 2008-11-15 14:19 . 2008-11-15 14:19 207,360 --a--c--- c:\windows\system32\dllcache\ndis.sys 2008-11-15 11:46 . 2008-11-15 11:46 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-15 11:42 . 2008-11-15 11:42 <DIR> d-------- c:\windows\ERUNT 2008-11-15 11:18 . 2008-11-15 12:02 <DIR> d-------- C:\SDFix 2008-11-15 09:29 . 2008-11-15 09:29 <DIR> d-------- C:\_OTMoveIt 2008-11-15 08:35 . 2008-11-15 09:10 <DIR> d-------- C:\Lop SD 2008-11-14 19:54 . 2008-11-14 19:54 <DIR> d-------- c:\program files\Trend Micro 2008-11-12 19:13 . 2008-11-12 19:13 <DIR> d-------- c:\documents and settings\Administrator\DoctorWeb 2008-11-12 18:49 . 2008-11-12 18:49 <DIR> d-------- c:\documents and settings\Mahamed\DoctorWeb 2008-11-12 17:07 . 2008-11-12 18:28 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-12 16:17 . 2008-11-12 16:28 15,083,520 --a------ c:\program files\spybotsd160.exe 2008-11-12 16:00 . 2008-11-12 16:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET 2008-11-12 15:54 . 2008-11-13 17:25 <DIR> d-------- c:\program files\RogueRemover FREE 2008-11-12 15:53 . 2008-09-05 04:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 15:53 . 2008-10-24 22:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 10:57 . 2008-11-12 10:57 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Apple Computer 2008-11-11 20:14 . 2008-11-13 18:35 <DIR> d-------- c:\program files\Lavasoft 2008-11-11 19:37 . 2008-11-11 19:59 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h(2).exe 2008-11-11 17:01 . 2008-11-11 17:17 23,804,784 --a------ c:\program files\aaw2008.exe 2008-11-10 17:56 . 2008-11-10 17:56 <DIR> d-------- c:\program files\Alwil Software 2008-11-09 10:56 . 2008-11-09 10:56 <DIR> d-------- c:\program files\3ivx 2008-11-09 10:04 . 2008-11-09 10:49 <DIR> d-------- c:\windows\system32\quicktime 2008-11-09 09:49 . 2008-11-13 18:20 <DIR> d-------- c:\program files\QuickTime 2008-11-09 09:39 . 2008-11-09 09:40 <DIR> d-------- c:\program files\Service Packs 2008-11-08 11:02 . 2008-11-14 02:15 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\LimeWire 2008-11-08 11:01 . 2008-11-13 13:26 <DIR> d-------- c:\program files\LimeWire 2008-11-07 23:18 . 2008-11-07 23:18 <DIR> d-------- c:\windows\Sun 2008-11-07 19:16 . 2008-11-10 18:45 <DIR> d-------- c:\program files\DNA 2008-11-07 19:16 . 2008-11-10 23:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DNA 2008-11-07 17:54 . 2008-11-07 20:25 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DivX 2008-11-07 17:15 . 2008-11-07 17:17 <DIR> d-------- c:\program files\DivX 2008-11-06 22:31 . 2008-11-06 22:31 <DIR> d-------- c:\program files\Sun 2008-11-06 22:28 . 2008-11-06 22:27 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-06 22:28 . 2008-11-06 22:27 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-06 22:27 . 2008-11-06 22:27 <DIR> d-------- c:\program files\Java 2008-11-04 18:23 . 2008-11-04 18:25 <DIR> d-------- c:\windows\system32\NtmsData 2008-11-04 10:08 . 2008-11-04 10:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-04 10:07 . 2008-11-13 17:23 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-04 10:07 . 2008-11-04 10:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\SUPERAntiSpyware.com 2008-11-04 10:04 . 2008-11-13 18:34 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-03 20:04 . 2008-11-03 20:04 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Search 2008-11-03 18:53 . 2008-11-12 10:42 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Comodo 2008-11-03 15:00 . 2008-11-12 10:42 <DIR> d-------- c:\program files\COMODO 2008-11-03 09:17 . 2008-11-03 09:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\MSN6 2008-11-03 09:12 . 2008-11-20 23:18 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 08:09 . 2008-11-03 09:15 <DIR> d-------- c:\program files\Smart Virus Remover 2008-11-03 01:16 . 2008-11-03 01:16 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\MSN6 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx07.dll 2008-10-29 09:35 . 2008-10-29 09:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll 2008-10-29 09:35 . 2008-10-29 09:35 802,816 --a------ c:\windows\system32\divx_xx11.dll 2008-10-28 03:44 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\xing shared 2008-10-28 03:43 . 2008-10-28 03:43 <DIR> d-------- c:\program files\Real 2008-10-26 22:21 . 2008-10-26 22:21 <DIR> d-------- c:\program files\Real Alternative 2008-10-26 22:21 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\Real 2008-10-25 19:18 . 2008-10-25 19:18 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Desktop Search 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\windows\system32\GroupPolicy 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\program files\Windows Desktop Search 2008-10-25 19:15 . 2008-03-08 04:02 192,000 -----c--- c:\windows\system32\dllcache\offfilt.dll 2008-10-25 19:15 . 2008-03-08 04:02 98,304 -----c--- c:\windows\system32\dllcache\nlhtml.dll 2008-10-25 19:15 . 2008-03-08 04:02 29,696 -----c--- c:\windows\system32\dllcache\mimefilt.dll 2008-10-25 19:14 . 2008-10-25 19:14 <DIR> d-------- c:\program files\CONEXANT 2008-10-25 19:13 . 2008-10-16 03:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-25 17:16 . 2008-10-25 17:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 2008-10-24 21:31 . 2008-04-14 05:42 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-10-24 21:31 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-10-24 21:31 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-10-24 21:31 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-10-22 20:17 . 2008-10-22 20:17 <DIR> d-------- c:\program files\Common Files\InstallShield . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-21 00:21 23,040 ----a-w c:\windows\system32\svchost.exe 2008-11-20 11:37 23,040 ----a-w c:\windows\system32\svchost(2)(2).exe 2008-11-15 04:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-15 03:19 207,360 ----a-w c:\windows\system32\drivers\ndis.sys 2008-11-14 21:20 --------- d-----w c:\program files\Common Files\Adobe 2008-11-12 05:43 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-11-12 05:24 --------- d-----w c:\program files\QuickGamma 2008-11-12 05:24 --------- d-----w c:\program files\Free FLV Converter 2008-11-03 05:58 --------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla! 2008-10-27 16:43 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-10-27 16:43 348,160 ----a-w c:\windows\system32\msvcr71.dll 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-22 05:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 05:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-21 06:31 --------- d-----w c:\documents and settings\Mahamed\Application Data\uTorrent 2008-10-18 03:38 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\o4Patch.exe 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\IEDFix.C.exe 2008-10-03 01:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\Media Player Classic 2008-10-03 00:49 --------- d-----w c:\program files\Combined Community Codec Pack 2008-10-02 07:53 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-10-02 07:53 --------- d-----w c:\program files\AskBarDis 2008-10-01 04:51 98,816 ----a-w c:\windows\system32\VACFix.exe 2008-09-30 05:28 --------- d-----w c:\program files\Xvid 2008-09-25 09:10 --------- d-----w c:\program files\NOS 2008-09-25 09:10 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2008-09-25 08:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2008-09-25 08:11 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 536,576 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-23 02:51 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-09-22 11:00 --------- d-----w c:\program files\Messenger Plus! Live 2008-09-21 02:04 --------- d-----w c:\program files\Windows Live 2008-09-21 02:02 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller 2008-09-21 01:55 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:57 129,784 ----a-w c:\windows\system32\pxafs.dll 2008-09-19 21:57 120,056 ----a-w c:\windows\system32\pxcpyi64.exe 2008-09-19 21:57 118,520 ----a-w c:\windows\system32\pxinsi64.exe 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-12 18:30 278,528 ----a-w c:\windows\system32\TubeFinder.exe 2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-08 12:38 99,840 ----a-w c:\windows\system32\AntiXPVSTFix.exe 2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ------- Sigcheck ------- 2004-08-04 01:56 14336 5de5b5c556f04f26dd6068267644a8ca c:\windows\$NtServicePackUninstall$\svchost.exe 2008-04-14 06:42 23040 06fcb16ca84dcc11302fd1854b6b246c c:\windows\ServicePackFiles\i386\svchost.exe 2004-08-04 18:56 23040 385a7e4e53c27ae4047816c5ec582f5e c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\svchost.exe 2008-11-21 11:21 23040 06fcb16ca84dcc11302fd1854b6b246c c:\windows\system32\svchost.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\$NtServicePackUninstall$\winlogon.exe 2008-04-14 06:42 516608 808f4f0941af51bd295eded8071a286b c:\windows\ServicePackFiles\i386\winlogon.exe 2004-08-04 18:56 510976 8c45beb4d178e0b993ca55ab14ce53fd c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\winlogon.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\system32\winlogon.exe 2004-08-04 00:14 182912 1df7f42665c94b825322fae71721130d c:\windows\$NtServicePackUninstall$\ndis.sys 2008-04-14 01:50 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys 2004-08-04 17:14 182912 1df7f42665c94b825322fae71721130d c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ndis.sys 2008-11-15 14:19 207360 1df7f42665c94b825322fae71721130d c:\windows\system32\dllcache\ndis.sys 2008-11-15 14:19 207360 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys 2004-08-04 01:56 1032192 56195559d22a24d39c0d04b954fb1901 c:\windows\explorer.exe 2004-08-04 01:56 1032192 56195559d22a24d39c0d04b954fb1901 c:\windows\$NtServicePackUninstall$\explorer.exe 2008-04-14 06:42 1042432 8aab8f71347002bc2ac64ae0beb5e905 c:\windows\ServicePackFiles\i386\explorer.exe 2004-08-04 18:56 1040896 0c8ec25cd14642a3cd74d794176645b5 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\$NtServicePackUninstall$\services.exe 2008-04-14 06:42 117248 ef1758444f1504c33b79c26a5926d69b c:\windows\ServicePackFiles\i386\services.exe 2004-08-04 18:56 116736 b83fefe879296a209915092ee67437fa c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\services.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\system32\services.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\$NtServicePackUninstall$\lsass.exe 2008-04-14 06:42 22016 0df2519a636ddbf74e43c73f6db43943 c:\windows\ServicePackFiles\i386\lsass.exe 2004-08-04 18:56 22016 0b6bba57a1bb9998e542d911e27b5bd6 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lsass.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\system32\lsass.exe 2004-08-04 01:56 15360 fe408f07f63eece65f4e3f8ce09030d5 c:\windows\$NtServicePackUninstall$\ctfmon.exe 2008-04-14 06:42 24064 7799f2ecb1713979335e8abc1ec42bcf c:\windows\ServicePackFiles\i386\ctfmon.exe 2004-08-04 18:56 24064 e0e0a63fa6e13fcee9d77d729a14e7b1 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe 2008-04-14 06:42 15360 b61439f0bc14b836101d6387197715e8 c:\windows\system32\CTFMON.EXE 2005-06-11 11:17 57856 8cfa993f4fdf5568aff15d99765c21d6 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 10:53 57856 07763dfe5ea3c14946d4052c56ba377d c:\windows\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 01:56 57856 cb39079b8adca54c691db044351b94bf c:\windows\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 06:42 66560 5a45de4b505cbbc52e4b09706357c050 c:\windows\ServicePackFiles\i386\spoolsv.exe 2004-08-04 18:56 66560 234df4f1361db1af65a3fe7ef06925fe c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe 2005-06-11 11:17 57856 8cfa993f4fdf5568aff15d99765c21d6 c:\windows\system32\spoolsv.exe 2004-08-04 01:56 24576 27f29f65bf97a1dd81d50229b5023745 c:\windows\$NtServicePackUninstall$\userinit.exe 2008-04-14 06:42 34816 f7746144dda31959e03610f052c33d92 c:\windows\ServicePackFiles\i386\userinit.exe 2004-08-04 18:56 33280 215be2b305baa8e049760ba95cb8b6ba c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe 2008-04-14 06:42 26112 31c92b93500c4ee80248b3d67acf4480 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot_2008-11-21_18.17.34.81 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-21 07:03:36 4,475 ----a-w c:\windows\ERDNT\CFUNDO.dat + 2008-11-21 21:55:45 5,370 ----a-w c:\windows\ERDNT\CFUNDO.dat + 2008-10-16 03:09:44 92,696 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\cdm.dll + 2008-10-16 03:12:20 561,688 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuapi.dll + 2008-10-16 03:09:44 51,224 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuauclt.exe + 2008-10-16 03:13:40 1,809,944 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuaueng.dll + 2008-10-16 03:12:22 323,608 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wucltui.dll - 2008-11-21 00:21:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-11-21 22:05:30 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-11-21 00:21:58 327,680 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-21 22:05:30 327,680 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2008-11-21 00:21:58 327,680 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-11-21 22:05:30 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat + 2008-11-21 22:06:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_768.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "reader"="c:\windows\System32\reader.exe" [bU] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-06 136600] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-28 185872] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "NvSvc"="c:\windows\system32\nvsvc32.exe" [2008-11-19 64512] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^all users^start menu^programs^startup^windows search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^mahamed^start menu^programs^startup^limewire on startup.lnk] path=c:\documents and settings\Mahamed\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-11-07 19:16 342336 c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 06:42 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-10-28 03:43 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\MBAM.EXE"= "c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"= "c:\\WINDOWS\\system32\\nvsvc32.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:WarcraftIII "6112:UDP"= 6112:UDP:WarcraftIII R3 genmcmnusb;USB Scroll Mouse Driver;c:\windows\system32\DRIVERS\gflmouhid.sys [2004-04-19 6656] S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-09-25 33752] . - - - - ORPHANS REMOVED - - - - BHO-{2cf32e62-861c-4695-af2c-a828961df8ad} - c:\windows\system32\jonyyq.dll BHO-{BF95FDC3-8AA3-4480-833F-A5CB31A26602} - c:\windows\system32\pmnnLEXo.dll BHO-{ECEC2819-54F6-4F30-ABB8-BD248D6F824A} - c:\windows\system32\ddcCuspQ.dll HKLM-Run-System Config Boot - syscgboot.exe Notify-efcDUkIy - efcDUkIy.dll ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-22 09:06:01 Windows 5.1.2600 Service Pack 3 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... c:\windows\system32\svchost(2)(2).exe:ext.exe 25088 bytes executable scan completed successfully hidden files: 1 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\searchindexer.exe c:\windows\system32\wscntfy.exe c:\windows\system32\SEARCHPROTOCOLHOST.EXE c:\windows\system32\SEARCHFILTERHOST.EXE . ************************************************************************** . Completion time: 2008-11-22 9:10:41 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-21 22:10:24 ComboFix2.txt 2008-11-21 07:19:42 ComboFix3.txt 2008-11-16 00:40:56 ComboFix4.txt 2008-11-15 04:34:58 ComboFix5.txt 2008-11-21 21:42:26 Pre-Run: 59,662,065,664 bytes free Post-Run: 59,643,101,184 bytes free 442 --- E O F --- 2008-11-15 13:26:13 Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 22, 2008 Hello 1. Close any open browsers. 2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. 3. Open notepad and copy/paste the text in the quotebox below into it: file::c:\windows\system32\B3.tmp c:\windows\system32\B2.tmp c:\windows\system32\B4.tmp c:\windows\system32\xjwhlewq.dll Folder:: FCopy:: c:\windows\$NtServicePackUninstall$\lsass.exe | c:\windows\system32\lsass.exe c:\windows\$NtServicePackUninstall$\winlogon.exe | c:\windows\system32\winlogon.exe c:\windows\$NtServicePackUninstall$\services.exe | c:\windows\system32\services.exe c:\windows\$NtServicePackUninstall$\svchost.exe | c:\windows\system32\svchost.exe c:\windows\ServicePackFiles\i386\spoolsv.exe | c:\windows\system32\spoolsv.exe c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe | c:\windows\explorer.exe c:\windows\$NtServicePackUninstall$\ndis.sys | c:\windows\system32\drivers\ndis.sys c:\windows\$NtServicePackUninstall$\userinit.exe | c:\windows\system32\userinit.exe ADS:: c:\windows\system32\svchost(2)(2).exe Registry:: Driver:: Save this as CFScript.txt, in the same location as ComboFix.exe Refering to the picture above, drag CFScript into ComboFix.exe When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 Nothing happens when i drag CFScript.txt in ComboFix.exe and i can't open HijackThis as well. I have the the red circle with the white "X" in my tray too. Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 22, 2008 Can you edit your signature, it is too big for the forums Try this Save the CFScript to your desktop per my instructions in the previous post Then click Start > Run > Copy and past the following in bold ComboFix "c:\documents and settings\Mahamed\Desktop\CFScript.txt" Click Ok and let it run That work ? Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 No luck. Still doesn't work. Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 22, 2008 Do this Download Dr.Web CureIt to the desktop: ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, in the menu, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 I need to get off now. I'll get to it as soon as i'm back. Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 22, 2008 Me too, see you Hope Arsenal lose this weekend United fan >>> Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 (edited) No way lose. van Persie is BACK! zzzz. Computer keeps restarting while downloading drweb.cureit Edited November 22, 2008 by Morphling Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 My computer was restarting continuously so i ran MBAM, since that seemed to fix it temporarily. Here is the MBAM log: Malwarebytes' Anti-Malware 1.30 Database version: 1403 Windows 5.1.2600 Service Pack 3 22/11/2008 10:53:17 PM mbam-log-2008-11-22 (22-53-17).txt Scan type: Quick Scan Objects scanned: 51672 Time elapsed: 6 minute(s), 1 second(s) Memory Processes Infected: 1 Memory Modules Infected: 2 Registry Keys Infected: 10 Registry Values Infected: 3 Registry Data Items Infected: 2 Folders Infected: 0 Files Infected: 17 Memory Processes Infected: C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Unloaded process successfully. Memory Modules Infected: C:\WINDOWS\system32\geBUoNhi.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\qoMEwUkH.dll (Trojan.Vundo.H) -> Delete on reboot. Registry Keys Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4e007a5f-299f-44fc-8b6b-f06b61867a2e} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\qomewukh (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{4e007a5f-299f-44fc-8b6b-f06b61867a2e} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c115bc76-2f4f-4cb8-8ac9-8d807ba6dc55} (Trojan.Vundo.H) -> Delete on reboot. HKEY_CLASSES_ROOT\CLSID\{c115bc76-2f4f-4cb8-8ac9-8d807ba6dc55} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4e007a5f-299f-44fc-8b6b-f06b61867a2e} (Trojan.Vundo.H) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\System Config Boot (Backdoor.Bot) -> Delete on reboot. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\brastk (Trojan.FakeAlert) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\gebuonhi -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\gebuonhi -> Delete on reboot. Folders Infected: (No malicious items detected) Files Infected: C:\WINDOWS\system32\qoMEwUkH.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\geBUoNhi.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\ihNoUBeg.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\ihNoUBeg.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully. C:\WINDOWS\system32\syscgboot.exe (Backdoor.Bot) -> Delete on reboot. C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\awtqpNGV.dll (Trojan.Vundo.H) -> Delete on reboot. C:\WINDOWS\system32\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati5imxx(2).sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati5imxx(3).sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati5imxx(4).sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\ati5imxx(5).sys (Rootkit.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\delself.bat (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.Sys) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vtUommLC.dll (Trojan.vundo) -> Quarantined and deleted successfully. C:\WINDOWS\brastk.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\wini10331.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 22, 2008 Combofix.exe worked after MBAM but after the removal stage my internet wasn't working anymore. I went to the Quarantined folder in Qoobox and extracted the ndis.sys and ntndis.sys to C:/WINDOWS/system32/drivers and my internet works now. Here is the Combofix.exe log : ComboFix 08-11-21.03 - Mahamed 2008-11-22 22:59:55.7 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.165 [GMT 11:00] Running from: c:\documents and settings\Mahamed\Desktop\ComboFix.exe Command switches used :: c:\documents and settings\Mahamed\Desktop\CFScript.txt * Created a new restore point FILE :: c:\windows\system32\B2.tmp c:\windows\system32\B3.tmp c:\windows\system32\B4.tmp c:\windows\system32\xjwhlewq.dll . ADS - svchost(2)(2).exe: deleted 25088 bytes in 1 streams. ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\B2.tmp c:\windows\system32\B3.tmp c:\windows\system32\B4.tmp c:\windows\system32\didxehgv.dll c:\windows\system32\drivers\ndis.sys c:\windows\system32\drivers\ntndis.exe c:\windows\system32\drivers\ntndis.sys c:\windows\system32\vsfddk.dll c:\windows\system32\xjwhlewq.dll c:\windows\system32\lsass.exe . . . is infected!! c:\windows\system32\winlogon.exe . . . is infected!! c:\windows\system32\services.exe . . . is infected!! c:\windows\system32\svchost.exe . . . is infected!! c:\windows\system32\spoolsv.exe . . . is infected!! c:\windows\explorer.exe . . . is infected!! . --------------- FCopy --------------- c:\windows\$NtServicePackUninstall$\lsass.exe --> c:\windows\system32\lsass.exe c:\windows\$NtServicePackUninstall$\winlogon.exe --> c:\windows\system32\winlogon.exe c:\windows\$NtServicePackUninstall$\services.exe --> c:\windows\system32\services.exe c:\windows\$NtServicePackUninstall$\svchost.exe --> c:\windows\system32\svchost.exe c:\windows\ServicePackFiles\i386\spoolsv.exe --> c:\windows\system32\spoolsv.exe c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe --> c:\windows\explorer.exe c:\windows\$NtServicePackUninstall$\userinit.exe --> c:\windows\system32\userinit.exe . ((((((((((((((((((((((((( Files Created from 2008-10-22 to 2008-11-22 ))))))))))))))))))))))))))))))) . 2008-12-22 15:59 . 2008-12-22 15:59 447,200 --a------ c:\windows\system32\OpenQuicktimeLib.dll 2008-12-22 15:59 . 2008-12-22 15:59 332,512 --a------ c:\windows\system32\3ivxVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\SamsungVfWCodec.dll 2008-12-22 15:59 . 2008-12-22 15:59 25,312 --a------ c:\windows\system32\DivXVfWCodec.dll 2008-12-22 15:58 . 2008-12-22 15:58 1,155,808 --a------ c:\windows\system32\3ivx.dll 2008-12-22 15:52 . 2008-12-22 15:52 66,272 --a------ c:\windows\system32\libfaac.dll 2008-11-22 22:59 . <DIR> c:\windows\LastGood.Tmp 2008-11-22 22:36 . 2008-11-22 22:36 48 --a------ c:\windows\system32\3D.tmp 2008-11-22 22:36 . 2008-11-22 22:36 0 --a------ c:\windows\system32\3F.tmp 2008-11-22 21:08 . 2008-11-22 21:08 48 --a------ c:\windows\system32\150.tmp 2008-11-22 21:08 . 2008-11-22 21:08 0 --a------ c:\windows\system32\152.tmp 2008-11-22 15:31 . 2008-11-22 15:31 48 --a------ c:\windows\system32\29.tmp 2008-11-22 15:31 . 2008-11-22 15:31 0 --a------ c:\windows\system32\2B.tmp 2008-11-22 14:23 . 2008-11-22 14:23 0 --a------ c:\windows\system32\A.tmp 2008-11-22 14:22 . 2008-11-22 14:22 48 --a------ c:\windows\system32\8.tmp 2008-11-22 14:04 . 2008-11-22 14:04 48 --a------ c:\windows\system32\4.tmp 2008-11-22 14:04 . 2008-11-22 14:04 0 --a------ c:\windows\system32\6.tmp 2008-11-22 10:38 . 2008-11-22 10:38 48 --a------ c:\windows\system32\2C.tmp 2008-11-22 10:38 . 2008-11-22 10:38 0 --a------ c:\windows\system32\2E.tmp 2008-11-19 17:21 . 2008-11-19 17:21 244 --ah----- C:\sqmnoopt07.sqm 2008-11-19 17:21 . 2008-11-19 17:21 232 --ah----- C:\sqmdata07.sqm 2008-11-19 13:50 . 2008-11-19 13:50 64,512 --a------ c:\windows\system32\nvsvc32.exe 2008-11-15 14:19 . 2008-11-15 14:19 207,360 --a--c--- c:\windows\system32\dllcache\ndis.sys 2008-11-15 11:46 . 2008-11-15 11:46 578,560 --a--c--- c:\windows\system32\dllcache\user32.dll 2008-11-15 11:42 . 2008-11-15 11:42 <DIR> d-------- c:\windows\ERUNT 2008-11-15 11:18 . 2008-11-15 12:02 <DIR> d-------- C:\SDFix 2008-11-15 09:29 . 2008-11-15 09:29 <DIR> d-------- C:\_OTMoveIt 2008-11-15 08:35 . 2008-11-15 09:10 <DIR> d-------- C:\Lop SD 2008-11-14 19:54 . 2008-11-14 19:54 <DIR> d-------- c:\program files\Trend Micro 2008-11-12 19:13 . 2008-11-12 19:13 <DIR> d-------- c:\documents and settings\Administrator\DoctorWeb 2008-11-12 18:49 . 2008-11-12 18:49 <DIR> d-------- c:\documents and settings\Mahamed\DoctorWeb 2008-11-12 17:07 . 2008-11-12 18:28 <DIR> d-------- c:\program files\Enigma Software Group 2008-11-12 16:17 . 2008-11-12 16:28 15,083,520 --a------ c:\program files\spybotsd160.exe 2008-11-12 16:00 . 2008-11-12 16:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET 2008-11-12 15:54 . 2008-11-13 17:25 <DIR> d-------- c:\program files\RogueRemover FREE 2008-11-12 15:53 . 2008-09-05 04:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-12 15:53 . 2008-10-24 22:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 10:57 . 2008-11-12 10:57 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Apple Computer 2008-11-11 20:14 . 2008-11-13 18:35 <DIR> d-------- c:\program files\Lavasoft 2008-11-11 19:37 . 2008-11-11 19:59 25,129,080 --a------ c:\program files\antivir_workstation_winu_en_h(2).exe 2008-11-11 17:01 . 2008-11-11 17:17 23,804,784 --a------ c:\program files\aaw2008.exe 2008-11-10 17:56 . 2008-11-10 17:56 <DIR> d-------- c:\program files\Alwil Software 2008-11-09 10:56 . 2008-11-09 10:56 <DIR> d-------- c:\program files\3ivx 2008-11-09 10:04 . 2008-11-09 10:49 <DIR> d-------- c:\windows\system32\quicktime 2008-11-09 09:49 . 2008-11-13 18:20 <DIR> d-------- c:\program files\QuickTime 2008-11-09 09:39 . 2008-11-09 09:40 <DIR> d-------- c:\program files\Service Packs 2008-11-08 11:02 . 2008-11-22 19:06 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\LimeWire 2008-11-08 11:01 . 2008-11-13 13:26 <DIR> d-------- c:\program files\LimeWire 2008-11-07 23:18 . 2008-11-07 23:18 <DIR> d-------- c:\windows\Sun 2008-11-07 19:16 . 2008-11-10 18:45 <DIR> d-------- c:\program files\DNA 2008-11-07 19:16 . 2008-11-10 23:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DNA 2008-11-07 17:54 . 2008-11-07 20:25 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\DivX 2008-11-07 17:15 . 2008-11-07 17:17 <DIR> d-------- c:\program files\DivX 2008-11-06 22:31 . 2008-11-06 22:31 <DIR> d-------- c:\program files\Sun 2008-11-06 22:28 . 2008-11-06 22:27 410,976 --a------ c:\windows\system32\deploytk.dll 2008-11-06 22:28 . 2008-11-06 22:27 73,728 --a------ c:\windows\system32\javacpl.cpl 2008-11-06 22:27 . 2008-11-06 22:27 <DIR> d-------- c:\program files\Java 2008-11-04 18:23 . 2008-11-04 18:25 <DIR> d-------- c:\windows\system32\NtmsData 2008-11-04 10:08 . 2008-11-04 10:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-04 10:07 . 2008-11-13 17:23 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-04 10:07 . 2008-11-04 10:07 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\SUPERAntiSpyware.com 2008-11-04 10:04 . 2008-11-13 18:34 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-03 20:04 . 2008-11-03 20:04 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Search 2008-11-03 18:53 . 2008-11-12 10:42 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Comodo 2008-11-03 15:00 . 2008-11-12 10:42 <DIR> d-------- c:\program files\COMODO 2008-11-03 09:17 . 2008-11-03 09:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\MSN6 2008-11-03 09:12 . 2008-11-20 23:18 <DIR> d-------- c:\documents and settings\Administrator 2008-11-03 08:09 . 2008-11-03 09:15 <DIR> d-------- c:\program files\Smart Virus Remover 2008-11-03 01:16 . 2008-11-03 01:16 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\MSN6 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx0c.dll 2008-10-29 09:36 . 2008-10-29 09:36 823,296 --a------ c:\windows\system32\divx_xx07.dll 2008-10-29 09:35 . 2008-10-29 09:35 815,104 --a------ c:\windows\system32\divx_xx0a.dll 2008-10-29 09:35 . 2008-10-29 09:35 802,816 --a------ c:\windows\system32\divx_xx11.dll 2008-10-28 03:44 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\xing shared 2008-10-28 03:43 . 2008-10-28 03:43 <DIR> d-------- c:\program files\Real 2008-10-26 22:21 . 2008-10-26 22:21 <DIR> d-------- c:\program files\Real Alternative 2008-10-26 22:21 . 2008-10-28 03:44 <DIR> d-------- c:\program files\Common Files\Real 2008-10-25 19:18 . 2008-10-25 19:18 <DIR> d-------- c:\documents and settings\Mahamed\Application Data\Windows Desktop Search 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\windows\system32\GroupPolicy 2008-10-25 19:16 . 2008-10-25 19:16 <DIR> d-------- c:\program files\Windows Desktop Search 2008-10-25 19:15 . 2008-03-08 04:02 192,000 -----c--- c:\windows\system32\dllcache\offfilt.dll 2008-10-25 19:15 . 2008-03-08 04:02 98,304 -----c--- c:\windows\system32\dllcache\nlhtml.dll 2008-10-25 19:15 . 2008-03-08 04:02 29,696 -----c--- c:\windows\system32\dllcache\mimefilt.dll 2008-10-25 19:14 . 2008-10-25 19:14 <DIR> d-------- c:\program files\CONEXANT 2008-10-25 19:13 . 2008-10-16 03:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll 2008-10-25 17:16 . 2008-10-25 17:16 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8 2008-10-24 21:31 . 2008-04-14 05:42 159,232 --a------ c:\windows\system32\ptpusd.dll 2008-10-24 21:31 . 2008-04-14 00:15 15,104 --a------ c:\windows\system32\drivers\usbscan.sys 2008-10-24 21:31 . 2008-04-14 00:15 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys 2008-10-24 21:31 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll 2008-10-22 20:17 . 2008-10-22 20:17 <DIR> d-------- c:\program files\Common Files\InstallShield . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-20 11:37 23,040 ----a-w c:\windows\system32\svchost(2)(2).exe 2008-11-15 04:52 --------- d-----w c:\program files\Malwarebytes' Anti-Malware 2008-11-14 21:20 --------- d-----w c:\program files\Common Files\Adobe 2008-11-12 05:43 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help 2008-11-12 05:24 --------- d-----w c:\program files\QuickGamma 2008-11-12 05:24 --------- d-----w c:\program files\Free FLV Converter 2008-11-03 05:58 --------- d-----w c:\documents and settings\All Users\Application Data\STOPzilla! 2008-10-27 16:43 499,712 ----a-w c:\windows\system32\msvcp71.dll 2008-10-27 16:43 348,160 ----a-w c:\windows\system32\msvcr71.dll 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-22 05:10 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys 2008-10-22 05:10 15,504 ----a-w c:\windows\system32\drivers\mbam.sys 2008-10-21 06:31 --------- d-----w c:\documents and settings\Mahamed\Application Data\uTorrent 2008-10-18 03:38 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\o4Patch.exe 2008-10-09 21:58 94,208 ----a-w c:\windows\system32\IEDFix.C.exe 2008-10-03 01:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\Media Player Classic 2008-10-03 00:49 --------- d-----w c:\program files\Combined Community Codec Pack 2008-10-02 07:53 --------- d-----w c:\program files\Common Files\DVDVideoSoft 2008-10-02 07:53 --------- d-----w c:\program files\AskBarDis 2008-10-01 04:51 98,816 ----a-w c:\windows\system32\VACFix.exe 2008-09-30 05:28 --------- d-----w c:\program files\Xvid 2008-09-25 09:10 --------- d-----w c:\program files\NOS 2008-09-25 09:10 --------- d-----w c:\documents and settings\All Users\Application Data\NOS 2008-09-25 08:13 --------- d-----w c:\documents and settings\Mahamed\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2008-09-25 08:11 --------- d-----w c:\program files\Common Files\Adobe AIR 2008-09-25 08:03 81,920 ----a-w c:\windows\system32\dpl100.dll 2008-09-25 08:03 593,920 ----a-w c:\windows\system32\dpuGUI11.dll 2008-09-25 08:03 57,344 ----a-w c:\windows\system32\dpv11.dll 2008-09-25 08:03 536,576 ----a-w c:\windows\system32\DivXsm.exe 2008-09-25 08:03 53,248 ----a-w c:\windows\system32\dpuGUI10.dll 2008-09-25 08:03 344,064 ----a-w c:\windows\system32\dpus11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu11.dll 2008-09-25 08:03 294,912 ----a-w c:\windows\system32\dpu10.dll 2008-09-25 08:03 196,608 ----a-w c:\windows\system32\dtu100.dll 2008-09-25 08:03 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-09-23 02:51 --------- d-----w c:\documents and settings\All Users\Application Data\Messenger Plus! 2008-09-22 11:00 --------- d-----w c:\program files\Messenger Plus! Live 2008-09-19 21:57 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-09-19 21:57 129,784 ----a-w c:\windows\system32\pxafs.dll 2008-09-19 21:57 120,056 ----a-w c:\windows\system32\pxcpyi64.exe 2008-09-19 21:57 118,520 ----a-w c:\windows\system32\pxinsi64.exe 2008-09-19 21:55 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-09-19 21:55 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-09-19 21:54 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys 2008-09-12 18:30 278,528 ----a-w c:\windows\system32\TubeFinder.exe 2008-09-10 01:14 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-08 12:38 99,840 ----a-w c:\windows\system32\AntiXPVSTFix.exe 2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll . ------- Sigcheck ------- 2004-08-04 01:56 14336 5de5b5c556f04f26dd6068267644a8ca c:\windows\$NtServicePackUninstall$\svchost.exe 2008-04-14 06:42 23040 06fcb16ca84dcc11302fd1854b6b246c c:\windows\ServicePackFiles\i386\svchost.exe 2004-08-04 18:56 23040 385a7e4e53c27ae4047816c5ec582f5e c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\svchost.exe 2004-08-04 01:56 14336 5de5b5c556f04f26dd6068267644a8ca c:\windows\system32\svchost.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\$NtServicePackUninstall$\winlogon.exe 2008-04-14 06:42 516608 808f4f0941af51bd295eded8071a286b c:\windows\ServicePackFiles\i386\winlogon.exe 2004-08-04 18:56 510976 8c45beb4d178e0b993ca55ab14ce53fd c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\winlogon.exe 2004-08-04 01:56 502272 19f92aaf6870b66d25b351e230abc6ea c:\windows\system32\winlogon.exe 2004-08-04 18:56 1040896 0c8ec25cd14642a3cd74d794176645b5 c:\windows\explorer.exe 2004-08-04 01:56 1032192 56195559d22a24d39c0d04b954fb1901 c:\windows\$NtServicePackUninstall$\explorer.exe 2008-04-14 06:42 1042432 8aab8f71347002bc2ac64ae0beb5e905 c:\windows\ServicePackFiles\i386\explorer.exe 2004-08-04 18:56 1040896 0c8ec25cd14642a3cd74d794176645b5 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\$NtServicePackUninstall$\services.exe 2008-04-14 06:42 117248 ef1758444f1504c33b79c26a5926d69b c:\windows\ServicePackFiles\i386\services.exe 2004-08-04 18:56 116736 b83fefe879296a209915092ee67437fa c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\services.exe 2004-08-04 01:56 108032 1800469178c252c5977f711b468c00a1 c:\windows\system32\services.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\$NtServicePackUninstall$\lsass.exe md5deep: c:\windows\LastGood.Tmp\system32\lsass.exe: No such file or directory 2008-04-14 06:42 22016 0df2519a636ddbf74e43c73f6db43943 c:\windows\ServicePackFiles\i386\lsass.exe 2004-08-04 18:56 22016 0b6bba57a1bb9998e542d911e27b5bd6 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\lsass.exe 2004-08-04 01:56 13312 5877be9b08f740e5bd64e7c86608a93f c:\windows\system32\lsass.exe 2004-08-04 01:56 15360 fe408f07f63eece65f4e3f8ce09030d5 c:\windows\$NtServicePackUninstall$\ctfmon.exe 2008-04-14 06:42 24064 7799f2ecb1713979335e8abc1ec42bcf c:\windows\ServicePackFiles\i386\ctfmon.exe 2004-08-04 18:56 24064 e0e0a63fa6e13fcee9d77d729a14e7b1 c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ctfmon.exe 2008-04-14 06:42 15360 b61439f0bc14b836101d6387197715e8 c:\windows\system32\CTFMON.EXE 2005-06-11 11:17 57856 8cfa993f4fdf5568aff15d99765c21d6 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2005-06-11 10:53 57856 07763dfe5ea3c14946d4052c56ba377d c:\windows\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 01:56 57856 cb39079b8adca54c691db044351b94bf c:\windows\$NtUninstallKB896423$\spoolsv.exe 2008-04-14 06:42 66560 5a45de4b505cbbc52e4b09706357c050 c:\windows\ServicePackFiles\i386\spoolsv.exe 2004-08-04 18:56 66560 234df4f1361db1af65a3fe7ef06925fe c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\spoolsv.exe 2008-04-14 06:42 66560 5a45de4b505cbbc52e4b09706357c050 c:\windows\system32\spoolsv.exe 2004-08-04 01:56 24576 27f29f65bf97a1dd81d50229b5023745 c:\windows\$NtServicePackUninstall$\userinit.exe md5deep: c:\windows\LastGood.Tmp\system32\userinit.exe: No such file or directory 2008-04-14 06:42 34816 f7746144dda31959e03610f052c33d92 c:\windows\ServicePackFiles\i386\userinit.exe 2004-08-04 18:56 33280 215be2b305baa8e049760ba95cb8b6ba c:\windows\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\userinit.exe 2004-08-04 01:56 24576 27f29f65bf97a1dd81d50229b5023745 c:\windows\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot_2008-11-21_18.17.34.81 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-21 07:03:36 4,475 ----a-w c:\windows\ERDNT\CFUNDO.dat + 2008-11-22 12:04:37 6,265 ----a-w c:\windows\ERDNT\CFUNDO.dat - 2005-10-20 09:02:28 175,616 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-20 09:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE + 2004-08-03 14:56:52 13,312 ----a-w c:\windows\LastGood.Tmp\system32\lsass.exe + 2004-08-03 14:56:58 24,576 ----a-w c:\windows\LastGood.Tmp\system32\userinit.exe + 2008-10-16 03:09:44 92,696 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\cdm.dll + 2008-10-16 03:12:20 561,688 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuapi.dll + 2008-10-16 03:09:44 51,224 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuauclt.exe + 2008-10-16 03:13:40 1,809,944 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wuaueng.dll + 2008-10-16 03:12:22 323,608 ------w c:\windows\SoftwareDistribution\SelfUpdate\Default\wucltui.dll - 2000-08-30 21:00:00 171,008 ----a-w c:\windows\SWREG.exe + 2000-08-30 21:00:00 161,792 ----a-w c:\windows\SWREG.exe - 2008-11-21 00:21:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2008-11-22 11:45:13 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-11-21 00:21:58 327,680 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat + 2008-11-22 11:45:13 327,680 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat - 2007-08-13 07:39:10 22,016 ----a-w c:\windows\system32\ieudinit.exe + 2007-08-13 07:39:10 13,312 ----a-w c:\windows\system32\ieudinit.exe + 2008-11-22 12:12:05 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_670.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] "{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser] "{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-08-26 279944] [HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}] [HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-06 136600] "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-28 185872] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792] "MSConfig"="c:\windows\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2008-04-14 169984] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll "vidc.3IV2"= 3ivxVfWCodec.dll "vidc.SEDG"= SamsungVfWCodec.dll "vidc.DX50"= DivXVfWCodec.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WG111v2 Smart Wizard Wireless Setting.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\WG111v2 Smart Wizard Wireless Setting.lnk backup=c:\windows\pss\WG111v2 Smart Wizard Wireless Setting.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^all users^start menu^programs^startup^windows search.lnk] path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk backup=c:\windows\pss\Windows Search.lnkCommon Startup [HKLM\~\startupfolder\c:^documents and settings^mahamed^start menu^programs^startup^limewire on startup.lnk] path=c:\documents and settings\Mahamed\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA] --a------ 2008-11-07 19:16 342336 c:\program files\DNA\btdna.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2008-04-14 06:42 15360 c:\windows\system32\CTFMON.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2008-04-14 06:42 1695232 c:\program files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvSvc] --a------ 2008-11-19 13:50 64512 c:\windows\system32\nvsvc32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] --a------ 2008-10-28 03:43 185872 c:\program files\Common Files\Real\Update_OB\realsched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brastk] brastk.exe [bU] [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Messenger\\msmsgs.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\DNA\\btdna.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\Malwarebytes' Anti-Malware\\MBAM.EXE"= "c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"= "c:\\WINDOWS\\system32\\nvsvc32.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "6112:TCP"= 6112:TCP:WarcraftIII "6112:UDP"= 6112:UDP:WarcraftIII R3 genmcmnusb;USB Scroll Mouse Driver;c:\windows\system32\DRIVERS\gflmouhid.sys [2004-04-19 6656] S3 getPlus® Helper;getPlus® Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2008-09-25 33752] . - - - - ORPHANS REMOVED - - - - MSConfigStartUp-reader - c:\windows\System32\reader.exe MSConfigStartUp-System Config Boot - syscgboot.exe ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-22 23:11:53 Windows 5.1.2600 Service Pack 3 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\program files\Lavasoft\Ad-Aware\aawservice.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\searchindexer.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Completion time: 2008-11-22 23:16:04 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-22 12:15:36 ComboFix2.txt 2008-11-21 22:10:43 ComboFix3.txt 2008-11-21 07:19:42 ComboFix4.txt 2008-11-16 00:40:56 ComboFix5.txt 2008-11-22 11:58:30 Pre-Run: 59,642,281,984 bytes free Post-Run: 59,679,846,400 bytes free 357 --- E O F --- 2008-11-15 13:26:13 Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 23, 2008 I have decided to reformat my computer. I will post a new HJT Log after reformatting. I have the same virus on every USB. Here is a MBAM Log that detected it. Malwarebytes' Anti-Malware 1.30 Database version: 1403 Windows 5.1.2600 Service Pack 3 23/11/2008 11:54:27 AM mbam-log-2008-11-23 (11-54-27).txt Scan type: Quick Scan Objects scanned: 55 Time elapsed: 12 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 1 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: f:\RECYCLER\S-1-6-21-4564564512-1075880115-910321303-3161\fileaccess.exe (Backdoor.Bot) -> Quarantined and deleted successfully. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 23, 2008 Here is the new HJT LOG : Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:44:54 PM, on 23/11/2008 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\ctfmon.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm -- End of file - 1581 bytes Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 23, 2008 That log looks fine Whatever infection you had on your PC is one of the worst I have seen in a long time For your flash drives do this on the PC 1 - Flash Drive DisinfectorDownload Flash_Disinfector.exe by sUBs from >here< and save it to your desktop. Double-click Flash_Disinfector.exe to run it and follow any prompts that may appear. The utility may ask you to insert your flash drive and/or other removable drives including your mobile phone. Please do so and allow the utility to clean up those drives as well. Wait until it has finished scanning and then exit the program. Reboot your computer when done. Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection. Below I have included a number of recommendations for how to protect your computer against malware infections. * Keep Windows updated by regularly checking their website at : http://windowsupdate.microsoft.com/ This will ensure your computer has always the latest security updates available installed on your computer. * To reduce re-infection for malware in the future, I strongly recommend installing these free programs: SpywareBlaster protects against bad ActiveX IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all Have a look at this tutorial for IE-Spyad here * SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict. Make Internet Explorer more secure Click Start > Run Type Inetcpl.cpl & click OK Click on the Security tab Click Reset all zones to default level Make sure the Internet Zone is selected & Click Custom level In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable". Next Click OK, then Apply button and then OK to exit the Internet Properties page. *ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. *NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points. *Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions. * MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future. * Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here * Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place' Here Thank you for your patience, and performing all of the procedures requested. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 23, 2008 If i do everything u recommended me. Would i be safe without an anti-virus software, because most of them slow down my old comp. Can't believe we got thrashed by man city. Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 23, 2008 I wouldn't recommend running a PC without an AV in real-time, but with the suggestions above you could get away with it if you were careful SpywareGuard is essential though, its extremely low on resources so you wont notice it Having a good firewall will help as well As long as you are careful online you should be fine. Share this post Link to post Share on other sites
Morphling 0 Report post Posted November 23, 2008 I have rs32net.exe running in my task manager again. Is it safe? Share this post Link to post Share on other sites
Rorschach112 0 Report post Posted November 23, 2008 You must have reinfected yourself somehow I think you have a rootkit, do this Please download Gmer: http://www.gmer.net/gmer.zip Now let's perform a Gmer rootkit scan: Double-click Gmer.exe to run the program. When the program opens, click the >>> Tab On the right-side, check all the items to be scanned, but leave "Show All" unchecked Select all drives that are connected to your system to be scanned Click the Scan button When the scan is finished, click Copy to save the scan log to the Windows clipboard Open Notepad or a similar text editor Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V Save the gmer scan log and post it in your next reply. Close Gmer Open a command prompt (Start | run |type cmd and hit Enter) Type or paste the following to unload the Gmer driver: net stop gmer [*]Hit Enter [*]Exit the command prompt. Share this post Link to post Share on other sites
