Here is the SD log file: Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: Trojan Files Found: C:\WINDOWS\antiv.exe - Deleted C:\WINDOWS\regedit.com - Deleted C:\WINDOWS\system32\autorun.ini - Deleted Folder C:\WINDOWS\bdir - Removed Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Messenger\\MSMSGS.exe"="C:\\Program Files\\Messenger\\MSMSGS.EXE:*:Enabled:Windows Messenger" "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe:*:Enabled:Windowsr NetMeetingr" "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe:*:Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe:*:Enabled:Yahoo! FT Server" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\CAVEDOG\\TOTALA\\totala.exe"="C:\\CAVEDOG\\TOTALA\\totala.exe:*:Enabled:Total Annihilation" "C:\\Program Files\\Kali95\\Kali.exe"="C:\\Program Files\\Kali95\\Kali.exe:*:Enabled:Kali II (Ver 2.613)" "C:\\WINDOWS\\System32\\dplaysvr.exe"="C:\\WINDOWS\\System32\\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper" "C:\\Program Files\\MSN Gaming Zone\\zclient.exe"="C:\\Program Files\\MSN Gaming Zone\\zclient.exe:*:Enabled:Zone Datafile" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"="C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe:*:Enabled:EasyShare" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\Common Files\\AOL\\1174664347\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1174664347\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services" "C:\\Program Files\\AIM95\\aim.exe"="C:\\Program Files\\AIM95\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\MSN Messenger\\MsnMsgr.exe"="C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\MSN Messenger\\msncall.exe"="C:\\Program Files\\MSN Messenger\\msncall.exe:*:Enabled:Windows Live Messenger 8.0 (Phone)" "C:\\Program Files\\AIM95\\aim.exe"="C:\\Program Files\\AIM95\\aim.exe:*:Enabled:AOL Instant Messenger" "C:\\Program Files\\Common Files\\AOL\\1174664347\\ee\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1174664347\\ee\\AOLServiceHost.exe:*:Enabled:AOL Services" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" "C:\\Program Files\\MSN Messenger\\MsnMsgr.exe"="C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe:*:Enabled:Windows Live Messenger 8.1" "C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)" Remaining Files: --------------- File Backups: - C:\DOCUME~1\James\Desktop\sd\SDFix\backups\backups.zip Files with Hidden Attributes: C:\WINDOWS\system32\NTICDMK7.dll C:\WINDOWS\system32\NTIMPEG2.dll C:\WINDOWS\system32\NTIMP3.dll C:\WINDOWS\system32\NTIFCD3.dll C:\WINDOWS\system32\NTIBUN4.dll C:\WINDOWS\SoftwareDistribution\Download\S-1-5-18\05c77e1ed88a1e6e6bd081f27fbe6953\BIT7.tmp Finished! Here is the new Hijack this Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\James\LOCALS~1\Temp\Temporary Directory 2 for HiJackThis.zip\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01?FOR... R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SEENUS/SAOS01?FOR... R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.co... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie... R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FOR... R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.0.1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0e27594b-c8fc-4783-9ec0-f0378362f09b} - C:\WINDOWS\system32\glu3wiz.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.c... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/h... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewo... O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/h... O20 - Winlogon Notify: glu3wiz - C:\WINDOWS\SYSTEM32\glu3wiz.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 6508 bytes

0

Looks as though the rootkit was deleted. Go to this link, VirusTotal copy the following files one at the time into the "upload and scan box", click submit then post the results. C:\WINDOWS\SYSTEM32\glu3wiz.dll

0

Hi, I apologize for the delay. I've been trying to compromise a recent attack on my pc. I did manage to submit that file from my laptop. However, I kept losing my internet connection. A few of the av's did pick something up though. AhnLab-V3 2007.10.15.0 2007.10.15 - AntiVir 7.6.0.23 2007.10.15 TR/Dldr.ConHook.Gen Authentium 4.93.8 2007.10.14 - Avast 4.7.1051.0 2007.10.14 - AVG 7.5.0.488 2007.10.14 - BitDefender 7.2 2007.10.15 Trojan.Downloader.ConHook.AI

0

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\system32\glu3wiz.dll XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Post a new Hijack This log and a new Combofix log please. Alert me when you have made your post.

0

Here is the Combofix log FILE:: C:\WINDOWS\system32\glu3wiz.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\James\Application Data\macromedia\Flash Player\#SharedObjects\E5F9F5V9\www.broadcaster.com C:\Documents and Settings\James\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\Documents and Settings\James\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\Documents and Settings\James\Application Data\PPATCH~1 C:\Documents and Settings\James\My Documents\RACLE~1 C:\Program Files\Common Files\smante~1 C:\Program Files\icroso~1.net C:\WINDOWS\59812.exe C:\WINDOWS\64265.exe C:\WINDOWS\system32\glu3wiz.dll C:\WINDOWS\system32\scurit~1 C:\WINDOWS\system32\taskmgr.com C:\WINDOWS\system32\wnsapisv.exe C:\WINDOWS\system32\wnsapisv.exe . ((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 ))))))))))))))))))))))))))))))) . 2007-10-15 17:27 51,200 --a------ C:\WINDOWS\NirCmd.exe 2007-09-18 11:50 <DIR> d-------- C:\WINDOWS\ERUNT 2007-09-18 11:32 <DIR> d-------- C:\Program Files\Sophos 2007-09-18 11:20 22,112 -ra------ C:\WINDOWS\system32\drivers\COH_Mon.sys 2007-09-17 23:26 <DIR> d-------- C:\Rustbfix 2007-09-17 20:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2007-09-17 18:11 2,504 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-17 18:07 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-17 18:07 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-17 18:07 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-17 18:07 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-17 03:15 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-09-16 18:52 <DIR> d--hs---- C:\FOUND.004 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-09-18 15:20 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF 2007-09-18 15:20 60,800 ----a-w C:\WINDOWS\system32\S32EVNT1.DLL 2007-09-18 15:20 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS 2007-09-18 15:20 10,676 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT 2007-08-27 05:25 --------- d-----w C:\Documents and Settings\James\Application Data\ZoomBrowser EX 2007-08-27 05:18 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser 2007-08-27 05:17 --------- d-----w C:\Program Files\Common Files\Canon 2007-08-27 05:17 --------- d-----w C:\Program Files\Canon 2007-08-22 13:12 96,256 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll 2007-08-22 13:12 658,944 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll 2007-08-22 13:12 615,424 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll 2007-08-22 13:12 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll 2007-08-22 13:12 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2007-08-22 13:12 474,112 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll 2007-08-22 13:12 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll 2007-08-22 13:12 39,424 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll 2007-08-22 13:12 357,888 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2007-08-22 13:12 3,058,176 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll 2007-08-22 13:12 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll 2007-08-22 13:12 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll 2007-08-22 13:12 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2007-08-22 13:12 151,040 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll 2007-08-22 13:12 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll 2007-08-22 13:12 1,494,528 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll 2007-08-22 13:12 1,054,208 ----a-w C:\WINDOWS\system32\dllcache\danim.dll 2007-08-22 13:12 1,022,976 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll 2007-08-21 10:30 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll 2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\dllcache\cdm.dll 2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll 2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll 2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\system32\dllcache\wuapi.dll 2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe 2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\system32\dllcache\wuauclt.exe 2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll 2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll 2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\system32\dllcache\wucltui.dll 2007-07-30 23:19 271,224 ----a-w C:\WINDOWS\system32\mucltui.dll 2007-07-30 23:19 207,736 ----a-w C:\WINDOWS\system32\muweb.dll 2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll 2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\system32\dllcache\wuweb.dll 2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll 2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\system32\dllcache\wuaueng.dll 2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll 2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\system32\dllcache\wups.dll 2006-09-27 19:26 23,739 ----a-w C:\Documents and Settings\James\Application Data\FNTCACHE.BIN 2006-09-27 19:26 1,072 ----a-w C:\Documents and Settings\James\Application Data\perfc012.dat 2006-05-14 20:05 875 ----a-w C:\Documents and Settings\James\Application Data\waver_2.95.dat 2006-04-05 01:38 415,048 ----a-w C:\Documents and Settings\James\Application Data\tizupd.bin 2006-04-05 01:38 280,064 ----a-w C:\Documents and Settings\James\Application Data\tizhook.bin 2006-02-25 04:38 1,308,503 ----a-w C:\Documents and Settings\James\ccsetup127.exe 2006-02-25 04:35 562,768 ----a-w C:\Documents and Settings\James\deldomains_trial.exe 2006-02-25 04:34 10,134,288 ----a-w C:\Documents and Settings\James\mwav.exe 2006-02-25 03:56 10,507,544 ----a-w C:\Documents and Settings\James\setupeng.exe 2006-02-12 14:33 8,715,352 ----a-w C:\Documents and Settings\James\aim59386.exe 2005-10-18 01:24 1,014,477 ----a-w C:\Documents and Settings\James\wrar351.exe 2005-03-02 00:59 2,179,328 ------w C:\Documents and Settings\i386\ntoskrnl.exe 2005-03-02 00:57 2,135,552 ------w C:\Documents and Settings\i386\ntkrnlmp.exe 2005-03-02 00:34 2,056,832 ------w C:\Documents and Settings\i386\ntkrnlpa.exe 2005-03-02 00:34 2,015,232 ------w C:\Documents and Settings\i386\ntkrpamp.exe 2005-01-19 04:26 451,584 ------w C:\Documents and Settings\i386\mrxsmb.sys 2004-10-08 23:48 262,400 ------w C:\Documents and Settings\i386\http.sys 2004-08-04 09:00 92,032 ----a-w C:\Documents and Settings\i386\KSECDD.SYS 2004-08-04 09:00 847,872 ----a-w C:\Documents and Settings\i386\DBGENG.DLL 2004-08-04 09:00 84,939 ----a-w C:\Documents and Settings\i386\WINNT.exe 2004-08-04 09:00 8,192 ----a-w C:\Documents and Settings\i386\KBDHEPT.DLL 2004-08-04 09:00 77,824 ----a-w C:\Documents and Settings\i386\WSDUENG.DLL 2004-08-04 09:00 764,928 ----a-w C:\Documents and Settings\i386\WINNTBBU.DLL 2004-08-04 09:00 763,392 ----a-w C:\Documents and Settings\i386\WINNTBBA.DLL 2004-08-04 09:00 75,264 ----a-w C:\Documents and Settings\i386\TELNET.exe 2004-08-04 09:00 708,096 ----a-w C:\Documents and Settings\i386\NTDLL.DLL 2004-08-04 09:00 7,168 ----a-w C:\Documents and Settings\i386\KBDNEC.DLL 2004-08-04 09:00 7,168 ----a-w C:\Documents and Settings\i386\KBDCZ.DLL 2004-08-04 09:00 69,632 ----a-w C:\Documents and Settings\i386\HWDB.DLL 2004-08-04 09:00 640,000 ----a-w C:\Documents and Settings\i386\DBGHELP.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDYCL.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDSL1.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDSL.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDSG.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDPL.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDLA.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDHU.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDHELA3.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDCZ2.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDCZ1.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDCR.DLL 2004-08-04 09:00 6,656 ----a-w C:\Documents and Settings\i386\KBDAL.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDUSX.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDUSR.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDUSL.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDTUQ.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDTUF.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDTH3.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDTH2.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDSW.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDSP.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDSF.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDPO.DLL 2004-08-04 09:00 6,144 ----a-w C:\Documents and Settings\i386\KBDNO.DLL . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-06-04 22:05] "ALUAlert"="C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe" [2007-01-31 16:11] [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SiSPower] Rundll32.exe SiSPower.dll,ModeAgent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe R1 UBHelper;UBHelper;C:\WINDOWS\system32\drivers\UBHelper.sys R3 DKbFltr;Dritek HotKey Keyboard Filter Driver;C:\WINDOWS\system32\Drivers\DKbFltr.sys R3 HSFHWSIS;HSFHWSIS;C:\WINDOWS\system32\DRIVERS\HSFHWSIS.sys R3 SISNICXP;SiS PCI Fast Ethernet Adapter Driver for NDIS51;C:\WINDOWS\system32\DRIVERS\sisnicxp.sys S3 int15.sys;int15.sys;\??\C:\Program Files\acer\eRecovery\int15.sys S3 MEMSWEEP2;MEMSWEEP2;\??\C:\WINDOWS\system32\12.tmp . Contents of the 'Scheduled Tasks' folder "2007-09-18 00:45:22 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - James.job" "2007-10-15 06:29:06 C:\WINDOWS\Tasks\MP Scheduled Scan.job" . ************************************************************************** catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-10-15 17:34:21 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-10-15 17:36:03 - machine was rebooted . --- E O F ---

0

Here is the Hijack this log Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.exe C:\WINDOWS\system32\spoolsv.exe C:\Acer\eManager\anbmServ.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\James\LOCALS~1\Temp\Temporary Directory 1 for HiJackThis.zip\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://securityresponse.symantec.co... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie... R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SEENUS/SAOS01?FOR... R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = 192.168.0.1 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALuNotify.exe O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by112fd.bay112.hotmail.msn.c... O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls... O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microso... O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Housecall ActiveX 6.5) - http://housecall65.trendmicro.com/h... O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewo... O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/h... O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe -- End of file - 6225 bytes

0

Your java is out of date and can be exploited. Download the latest version of http://java.sun.com/javase/downloads/index.jsp Scroll down to where it says "The J2SE Runtime Environment (JRE) allows end-users to run Java applications". Click the "Download" button to the right. Check the box that says: "Accept License Agreement". The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-1_6_3-windowsi586-p.exe to install the newest version. Run Hijack This, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) Exit Hijack This. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Let us know how the computer is operating.

0

Hello, everything seems to be working up to par. I really appreciate your help and I've also learned some new approaches to take when it comes to troubleshooting malicious programs. Thanks again!

0