Looks like a chinese rootkit. Go to the following link, download and install AVG AntiRootkit Run it on the infected computer, delete all that it finds, then post a new Hijack this log. The combofix log would be helpful also. This may take a little effort to get rid of so hang in there.

0

Hi Jabuck, Have managed to run combofix, and here is the output. "foocw" - 07-03-30 23:19:15 Service Pack 2 ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Administrator.IBM-970317R\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\drivers\mqdrc.sys C:\WINDOWS\system32\dllcache\c_10013.n1s C:\WINDOWS\system32\dllcache\c_10093.n1s C:\20GB harddisk\US 2003\USA\USA\Aladdin problem.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Income Travel Insurance.html ... disinfected C:\20GB harddisk\US 2003\USA\USA\LA confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Las Vegas Aladdin confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Los Angeles confirmation.cgi.html ... disinfected C:\20GB harddisk\US 2003\USA\USA\Monterey and Carnel Tour.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Muir Woods and golden bridge tour.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\San Francisco Hotel Confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Yosemite National Park Tour.htm ... disinfected C:\Drivers\1RGU80WW\TP4SCROL.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_DK.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_FI.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_FR.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_GR.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_IT.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_JP.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_NL.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_NO.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_SE.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_SP.HTM ... disinfected C:\Drivers\77GU04WW\TP4SCROL.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_DK.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_FI.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_FR.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_GR.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_IT.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_JP.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_NL.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_NO.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_SE.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_SP.HTM ... disinfected C:\Drivers\77GU08WW\TP4SCROL.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_DK.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_FI.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_FR.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_GR.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_IT.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_JP.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_NL.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_NO.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_SE.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_SP.HTM ... disinfected C:\Drivers\Access Thinkpad\program files\IBM\Access IBM\index_t.html ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\ARABIC\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\BRAZIL\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\DANISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\DUTCH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\ENGLISH\SMAXFAQ.HTM ... disinfected C:\sdwork\ctm5010cen.html ... disinfected C:\sdwork\dla40950en.html ... disinfected C:\sdwork\dsd41021en.html ... disinfected C:\sdwork\dsd41124en.html ... disinfected C:\sdwork\dst100xpen.html ... disinfected C:\sdwork\dto500sfen.html ... disinfected C:\sdwork\eea10200en.html ... disinfected C:\sdwork\eea10300en.html ... disinfected C:\sdwork\eos70200en.html ... disinfected C:\sdwork\eos80000en.html ... disinfected C:\sdwork\eos90000en.html ... disinfected C:\sdwork\esd7000aen.html ... disinfected C:\sdwork\esd8000aen.html ... disinfected C:\sdwork\esd90000en.html ... disinfected C:\sdwork\extdesc1.htm ... disinfected C:\sdwork\extdesc10.htm ... disinfected C:\sdwork\extdesc11.htm ... disinfected C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm ... disinfected C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm ... disinfected C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Headlines.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\HomePage__DESKTOP.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\about_support.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\Favorites.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\ftshelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\History.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\Index.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\isupport.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\keywordhelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\options.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\searchblurb.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\searchtips.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\tools.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\windows_newsgroups.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\AboutCompat.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatMode.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\dvdupgrd.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\badurl.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\connection.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\indexfirstlevel.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\notfound.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\dglogs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\dglogshelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\AdvSearch.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Channels.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Favorites.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\History.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Index.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Options.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Search.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Subsite.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\rc\rcRequest.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\helpeeaccept.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\RAStartPage.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\rcBuddy.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\ConnIssue.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\msinfo.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\RSoP.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysComponentInfo.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\AboutWU.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\activ.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\activsvc.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\actlan.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\actshell.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\adeskerr.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\autoupdt.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\au_plcy.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\dtsgnup.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\ics.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\msobshel.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\netmeet.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\neweula.htm ... disinfected C:\WINDOWS\system32\Adobe\SVG Viewer\ReadMe.html ... disinfected C:\WINDOWS\system32\Adobe\SVG Viewer\SVGHelp.html ... disinfected C:\WINDOWS\system32\oobe\actshell.htm ... disinfected C:\WINDOWS\system32\oobe\dtsgnup.htm ... disinfected C:\WINDOWS\system32\oobe\msobshel.htm ... disinfected C:\WINDOWS\system32\oobe\updshell.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actconn.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actdone.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activ.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activerr.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activsvc.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actlan.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\adeskerr.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\adrdyreg.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\apolicy.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aprvcyms.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\areg1.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aregdial.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aregdone.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\ausrinfo.htm ... disinfected C:\WINDOWS\system32\oobe\error\cnncterr.htm ... disinfected C:\WINDOWS\system32\oobe\error\dialtone.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dslmain.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dsl_a.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dsl_b.htm ... disinfected C:\WINDOWS\system32\oobe\html\iconnect\icntlast.htm ... disinfected C:\WINDOWS\system32\oobe\html\iconnect\iconnect.htm ... disinfected C:\WINDOWS\system32\oobe\html\isptype\isptype.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_a.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_b.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_c.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_d.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_e.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_f.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_g.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_h.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_i.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_j.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_k.htm ... disinfected C:\WINDOWS\system32\oobe\html\sconnect\scntlast.htm ... disinfected C:\WINDOWS\system32\oobe\html\sconnect\sconnect.htm ... disinfected C:\WINDOWS\system32\oobe\icserror\icsdc.htm ... disinfected C:\WINDOWS\system32\oobe\isperror\ispcnerr.htm ... disinfected C:\WINDOWS\system32\oobe\isperror\ispdtone.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rcnterr.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rdtone.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rhndshk.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rnoansw.htm ... disinfected C:\WINDOWS\system32\oobe\setup\acterror.htm ... disinfected C:\WINDOWS\system32\oobe\setup\activate.htm ... disinfected C:\WINDOWS\system32\oobe\setup\act_plcy.htm ... disinfected C:\WINDOWS\system32\oobe\setup\autoupdt.htm ... disinfected C:\WINDOWS\system32\oobe\setup\au_plcy.htm ... disinfected C:\WINDOWS\system32\oobe\setup\badeula.htm ... disinfected C:\WINDOWS\system32\oobe\setup\badpkey.htm ... disinfected C:\WINDOWS\system32\oobe\setup\compname.htm ... disinfected C:\WINDOWS\system32\oobe\setup\dialup.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyisp.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdymig.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyoem.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyref.htm ... disinfected ((((((((((((((((((((((((((((((( Files Created from 2007-02-28 to 2007-03-30 )))))))))))))))))))))))))))))))))) 2007-03-30 15:36 111,904 --a------ C:\WINDOWS\system32\drivers\ad203.exe 2007-03-30 07:59 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-03-30 00:13 29 --a------ C:\WINDOWS\system32\Msf3sf.sys 2007-03-30 00:05 <DIR> d-------- C:\WINDOWS\system32\ekzdiq65 2007-03-30 00:04 <DIR> d-------- C:\WINDOWS\system32\ddvlpj33 2007-03-30 00:03 84,660 --a------ C:\WINDOWS\system32\xtnzic82\xtnzic82.exe 2007-03-30 00:03 <DIR> d-------- C:\WINDOWS\system32\xtnzic82 2007-03-30 00:02 <DIR> d-------- C:\Program Files\ixxu 2007-03-30 00:01 50,661 --a------ C:\WINDOWS\system32\DiskFree_mt01.2.exe 2007-03-30 00:01 24,558 --a------ C:\WINDOWS\system32\LocalSetup_ASM_4620.exe 2007-03-30 00:01 223,744 ---h----- C:\WINDOWS\system32\wiasoervc.dll 2007-03-30 00:00 86,399 --a------ C:\WINDOWS\system32\A677FFBC.DLL 2007-03-30 00:00 148,718 --a------ C:\WINDOWS\system32\A677FFBC.exe 2007-03-29 22:16 <DIR> d-------- C:\!KillBox 2007-03-29 08:58 <DIR> d-------- C:\WINDOWS\pss 2007-03-28 10:52 45,568 --a------ C:\WINDOWS\system32\drivers\cb02.exe 2007-03-28 03:39 <DIR> d-------- C:\WINDOWS\system32\rsndrq16 2007-03-28 00:34 <DIR> d-------- C:\WINDOWS\system32\ffepwe83 2007-03-28 00:31 88,064 --a------ C:\WINDOWS\system32\wang.exe 2007-03-27 23:25 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-03-27 22:19 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-03-27 22:15 <DIR> d-------- C:\Program Files\vodafone 2007-03-27 22:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1.IBM\APPLIC~1\Simply Super Software 2007-03-26 00:59 67,584 ---h----- C:\WINDOWS\WGSJy1.exe 2007-03-26 00:59 138 --a------ C:\WINDOWS\systemst.dll 2007-03-26 00:59 <DIR> d-------- C:\Program Files\Common Files\ixxu 2007-03-26 00:46 67,584 ---h----- C:\WINDOWS\WGSJy.exe 2007-03-26 00:45 1 --a------ C:\WINDOWS\msnlive.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-03-30 23:04 -------- d-------- C:\Program Files\symantec antivirus 2007-03-30 00:23 49152 --a------ C:\WINDOWS\system32\rwwcgv01.dll 2007-03-30 00:01 445440 --a------ C:\WINDOWS\system32\setup.exe 2007-03-27 22:15 -------- d-------- C:\Program Files\Common Files\wise installation wizard 2007-03-27 03:42 30 --a------ C:\AUTOEXEC.BAT 2007-03-27 03:42 0 --a------ C:\CONFIG.SYS 2007-03-26 21:10 -------- d-------- C:\Program Files\mobile master 2007-03-26 20:23 -------- d-------- C:\Program Files\desktop2mobiledb 2007-03-25 23:51 -------- d-------- C:\Program Files\wst 2007-01-31 21:33 5632 --a------ C:\WINDOWS\system32\drivers\avgarkt.sys (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "C4EBReg"="\"C:\\progra~1\\c4ebreg\\c4ebreg.exe\" /q" "ISSI EZUpdate Service"="\"c:\\sdwork\\issimsvc.exe\"" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.exe" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe /tray" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.exe" "BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor" "BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog" "AGRSMMSG"="AGRSMMSG.exe" "ISAMTray"="\"C:\\progra~1\\c4ebreg\\isamtray.exe\"" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\Integrity Client\\iclient.exe\"" "BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "TPKMAPHELPER"="C:\\Program Files\\ThinkPad\\Utilities\\TpKmapAp.exe -helper" "defergui"="c:\\sdwork\\defergui.exe" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "ACTray"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACTray.exe" "ACWLIcon"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACWLIcon.exe" "TVT Scheduler Proxy"="C:\\Program Files\\Common Files\\Lenovo\\Scheduler\\scheduler_proxy.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "configmsi"="cmd /c \"rmdir /q C:\\config.msi\"" "supportdir"="cmd /c \"rmdir /q /s \"C:\\WINDOWS\\TEMP\\{BF90215F-2D7B-4C84-8A24-A03BC41B95DD}\"\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" @="" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "Nokia Tray Application"="C:\\Program Files\\Common Files\\Nokia\\Tools\\NclTray.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" "{90BC520C-9175-470E-94B8-10FD869D170B}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoClose"=dword:00000000 "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WmdmPWD REG_MULTI_SZ WmdmPWD\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c5dfa94-dc6d-11db-82ce-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62c647f1-dc77-11db-82cf-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e718fff8-de04-11d9-81f0-00028a20e42e}] Shell\AutoRun\command D:\Player.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f333e640-5780-11db-82be-00042348136d}] Shell\Auto\command E:\WGSJy.exe Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL WGSJy.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\BMMTask.job C:\WINDOWS\tasks\eNjrewTCNnNsTFAMVZnAYibundKQSR.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-03-30 23:44:08 Also run a Hijack after running combofix, here is the log: Logfile of HijackThis v1.99.1 Scan saved at 11:50:12 PM, on 03/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://caiyi8.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3-1.ibm.com/download/standa... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {8728D167-41A6-4561-969C-CD75049F83AB} - C:\WINDOWS\system32\wiasoervc.dll O4 - HKLM\..\Run: [C4EBReg] "C:\progra~1\c4ebreg\c4ebreg.exe" /q O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.exe O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [ISAMTray] "C:\progra~1\c4ebreg\isamtray.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\Integrity Client\iclient.exe" O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [defergui] c:\sdwork\defergui.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com O16 - DPF: Sametime MRC 651FP1 - http://snappshare.webahead.ibm.com/... O16 - DPF: {5F30F398-64B6-4D5B-AF59-164FB61F56A6} (One Force Compplanner) - https://comp.ap.workscape.com/oneforce/compplanner/master.cab O16 - DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} (JNILoader Control) - http://snappshare.webahead.ibm.com/... O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - http://w3.ibm.com/bluepages/scripts... O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\Software\..\Telephony: DomainName = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ibm.com O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: IBM Mobility Client DHCP Control (artdhcp) - Unknown owner - C:\Program Files\IBM\Mobility Client\artdhcp.exe O23 - Service: Mobility Client (ArtourService) - Unknown owner - C:\Program Files\IBM\Mobility Client\artsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: IBM Standard Asset Manager Service (ISAMSvc) - IBM Global Services - C:\progra~1\c4ebreg\c4ebreg.exe O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe It seems like AVg anti-spyware has stopped complaining, However, I am getting services.exe exception error now and then,

0

Hi Jabuck, Also forgot to mention, could not find anything with AVG rootkit. CW

0

Hi Jabuck, I run a scan with AVG Anti-spy, it reports existance of Adware.Alexa and Adware.agent And the following exception keep poping up after the machine is running for several mins. "Services.exe-Application error The exception unknow software exception (0x0eedfade) occurred in the application at location 0x7c81eb33 CW

0

I'm studing the reports.

0

The following will help determine which files are bad. Go to this link, http://www.virustotal.com/en/indexf.html and use the "browse" button to locate these files: C:\WINDOWS\system32\drivers\ad203.exe C:\WINDOWS\system32\xtnzic82\xtnzic82.exe C:\WINDOWS\system32\A677FFBC.DLL C:\WINDOWS\system32\DiskFree_mt01.2.exe C:\WINDOWS\system32\LocalSetup_ASM_4620.exe C:\WINDOWS\system32\wiasoervc.dll C:\WINDOWS\system32\A677FFBC.DLL C:\WINDOWS\system32\A677FFBC.exe C:\WINDOWS\system32\drivers\cb02.exe C:\WINDOWS\system32\wang.exe C:\WINDOWS\WGSJy1.exe C:\WINDOWS\WGSJy.exe C:\WINDOWS\systemst.dll Then double click the first file to enter it into the "upload and scan box", click send then post the results. Continue untill you have checked all the files and posted the results.You may have to scroll to the right to see the "send" button.

0

Hi Jabuck, I could not successfully run scan at www.virustotal.com because halfway through the scan, My computer will be rebooted due the services.exe exception. CW

0

Sorry for the delay, my satelite crapped out them my computer crashed. Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok. Then do a search for "services.exe" and let us know how many you find and their full patch such as "C:\Windows\services.exe".

0

I found the followings: c:\WINDOWS\system32\Services.exe c:\WINDOES\ServicePackFiles\i386\Services.exe CW

0

Hi Jabuck, Sorry, typo, should be: c:\WINDOWS\ServicePackFiles\i386\Services.exe CW

0

Reboot into safe mode and run killbox: Please double-click Killbox.exe to run it. Select: Delete on Reboot then Click on the All Files button. Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\drivers\ad203.exe C:\WINDOWS\system32\xtnzic82\xtnzic82.exe C:\WINDOWS\system32\A677FFBC.DLL C:\WINDOWS\system32\wiasoervc.dll C:\WINDOWS\system32\A677FFBC.DLL C:\WINDOWS\system32\A677FFBC.exe C:\WINDOWS\system32\drivers\cb02.exe C:\WINDOWS\system32\wang.exe C:\WINDOWS\WGSJy1.exe C:\WINDOWS\WGSJy.exe C:\WINDOWS\systemst.dll Return to Killbox, go to the File menu, and choose Paste from Clipboard. Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!). If your computer does not restart automatically, please restart it manually. If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again. Then navigate to and delete this folder. C:\WINDOWS\system32\xtnzic82 Post a new Hijack This log and a new combofix log please.

0

Hi Jabuck, I did not see the message "PendingFileRenameOperations prompt" Here is the latest Hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 10:17:25 PM, on 04/03/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3-1.ibm.com/download/standa... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {8728D167-41A6-4561-969C-CD75049F83AB} - C:\WINDOWS\system32\wiasoervc.dll (file missing) O4 - HKLM\..\Run: [C4EBReg] "C:\progra~1\c4ebreg\c4ebreg.exe" /q O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.exe O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [ISAMTray] "C:\progra~1\c4ebreg\isamtray.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\Integrity Client\iclient.exe" O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [defergui] c:\sdwork\defergui.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com O16 - DPF: Sametime MRC 651FP1 - http://snappshare.webahead.ibm.com/... O16 - DPF: {5F30F398-64B6-4D5B-AF59-164FB61F56A6} (One Force Compplanner) - https://comp.ap.workscape.com/oneforce/compplanner/master.cab O16 - DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} (JNILoader Control) - http://snappshare.webahead.ibm.com/... O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - http://w3.ibm.com/bluepages/scripts... O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\Software\..\Telephony: DomainName = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ibm.com O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: IBM Mobility Client DHCP Control (artdhcp) - Unknown owner - C:\Program Files\IBM\Mobility Client\artdhcp.exe O23 - Service: Mobility Client (ArtourService) - Unknown owner - C:\Program Files\IBM\Mobility Client\artsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: IBM Standard Asset Manager Service (ISAMSvc) - IBM Global Services - C:\progra~1\c4ebreg\c4ebreg.exe O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe And the latest combofix log: "foocw" - 07-04-03 22:18:23 Service Pack 2 ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Administrator.IBM-970317R\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\10.tmp C:\WINDOWS\12.tmp C:\WINDOWS\system32\wsunca.dll C:\WINDOWS\system32\drivers\mqdrc.sys C:\WINDOWS\system32\dllcache\c_10013.n1s C:\WINDOWS\system32\dllcache\c_10093.n1s C:\20GB harddisk\US 2003\USA\USA\Aladdin problem.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Income Travel Insurance.html ... disinfected C:\20GB harddisk\US 2003\USA\USA\LA confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Las Vegas Aladdin confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Los Angeles confirmation.cgi.html ... disinfected C:\20GB harddisk\US 2003\USA\USA\Monterey and Carnel Tour.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Muir Woods and golden bridge tour.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\San Francisco Hotel Confirmation.htm ... disinfected C:\20GB harddisk\US 2003\USA\USA\Yosemite National Park Tour.htm ... disinfected C:\Drivers\1RGU80WW\TP4SCROL.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_DK.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_FI.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_FR.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_GR.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_IT.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_JP.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_NL.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_NO.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_SE.HTM ... disinfected C:\Drivers\1RGU80WW\TP4SC_SP.HTM ... disinfected C:\Drivers\77GU04WW\TP4SCROL.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_DK.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_FI.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_FR.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_GR.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_IT.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_JP.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_NL.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_NO.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_SE.HTM ... disinfected C:\Drivers\77GU04WW\TP4SC_SP.HTM ... disinfected C:\Drivers\77GU08WW\TP4SCROL.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_DK.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_FI.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_FR.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_GR.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_IT.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_JP.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_NL.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_NO.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_SE.HTM ... disinfected C:\Drivers\77GU08WW\TP4SC_SP.HTM ... disinfected C:\Drivers\Access Thinkpad\program files\IBM\Access IBM\index_t.html ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\ARABIC\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\BRAZIL\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\DANISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\DUTCH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\ENGLISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\FINNISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\FRENCH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\GERMAN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\HEBREW\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\ITALIAN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\JAPANESE\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\KOREAN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\NORWEGAN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\RUSSIAN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\SIMPCHIN\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\SPANISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\SWEDISH\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\THAI\SMAXFAQ.HTM ... disinfected C:\Drivers\Audio\SM_PANEL\SYS\TRADCHIN\SMAXFAQ.HTM ... disinfected C:\Drivers\UltraNav\TP4SCROL.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_DK.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_FI.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_FR.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_GR.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_IT.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_JP.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_NL.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_NO.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_SE.HTM ... disinfected C:\Drivers\UltraNav\TP4SC_SP.HTM ... disinfected C:\i387\readme.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\1033\feedback.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\1033\ofread10.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\1033\olread10.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\1033\ppread10.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\broadcst\default.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\broadcst\event.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\broadcst\fdback0.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\broadcst\feedback.htm ... disinfected C:\i387\files\pfiles\msoffice\office10\html\context.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\clconweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\faqsweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\lfcolweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\prsnlweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\rtcolweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\simplweb.htm ... disinfected C:\i387\files\pfiles\msoffice\template\1033\tocweb.htm ... disinfected C:\juliet\PayPal - Payment Completed 7nov05 mao stamps.htm ... disinfected C:\sdwork\acn30000en.html ... disinfected C:\sdwork\adf08024en.html ... disinfected C:\sdwork\ado80000en.html ... disinfected C:\sdwork\agd10000en.html ... disinfected C:\sdwork\agp5092sen.html ... disinfected C:\sdwork\agp592w1en.html ... disinfected C:\sdwork\agp592w2en.html ... disinfected C:\sdwork\amcsav90en.html ... disinfected C:\sdwork\ayu1049aen.html ... disinfected C:\sdwork\bmr20001en.html ... disinfected C:\sdwork\cga0300aen.html ... disinfected C:\sdwork\crf4000aen.html ... disinfected C:\sdwork\crf50000en.html ... disinfected C:\sdwork\ctm5010cen.html ... disinfected C:\sdwork\dla40950en.html ... disinfected C:\sdwork\dsd41021en.html ... disinfected C:\sdwork\dsd41124en.html ... disinfected C:\sdwork\dst100xpen.html ... disinfected C:\sdwork\dto500sfen.html ... disinfected C:\sdwork\eea10200en.html ... disinfected C:\sdwork\eea10300en.html ... disinfected C:\sdwork\eos70200en.html ... disinfected C:\sdwork\eos80000en.html ... disinfected C:\sdwork\eos90000en.html ... disinfected C:\sdwork\esd7000aen.html ... disinfected C:\sdwork\esd8000aen.html ... disinfected C:\sdwork\esd90000en.html ... disinfected C:\sdwork\extdesc1.htm ... disinfected C:\sdwork\extdesc10.htm ... disinfected C:\sdwork\extdesc11.htm ... disinfected C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Audio\snd.htm ... disinfected C:\WINDOWS\Help\Tours\WindowsMediaPlayer\Cnt\contents.htm ... disinfected C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\repairRedist.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Headlines.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\HomePage__DESKTOP.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\about_support.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\Favorites.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\ftshelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\History.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\Index.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\isupport.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\keywordhelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\options.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\searchblurb.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\searchtips.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\tools.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\blurbs\windows_newsgroups.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\AboutCompat.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\CompatCtr\CompatMode.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\DVDUpgrd\dvdupgrd.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\badurl.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\connection.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\indexfirstlevel.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\errors\notfound.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\dglogs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\NetDiag\dglogshelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\AdvSearch.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Channels.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Favorites.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\History.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Index.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Options.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Search.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\panels\subpanels\Subsite.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\rc\rcRequest.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\helpeeaccept.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\RAStartPage.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\rcBuddy.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Common\ConnIssue.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\ErrorMsgs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\RCFileXfer.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\voicefirewallmsg.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\Remote Assistance\Interaction\Common\VOIPMsgs.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\msinfo.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\RSoP.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\sysinfo\sysComponentInfo.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\System\UpdateCtr\AboutWU.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\confirm.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\rcstatus.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Common\ConnIssue.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcConnection.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen1.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Common\rcscreen2.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\escalationhelp.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcDetails.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcInviteStatus.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen4.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen5.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Email\rcscreen6.htm ... disinfected C:\WINDOWS\PCHealth\HelpCtr\Vendors\CN=Microsoft Corporation,L=Redmond,S=Washington,C=US\Remote Assistance\Escalation\Unsolicited\UnSolicitedRCUI.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\activ.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\activsvc.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\actlan.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\actshell.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\adeskerr.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\autoupdt.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\au_plcy.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\dtsgnup.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\ics.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\msobshel.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\netmeet.htm ... disinfected C:\WINDOWS\ServicePackFiles\i386\neweula.htm ... disinfected C:\WINDOWS\system32\Adobe\SVG Viewer\ReadMe.html ... disinfected C:\WINDOWS\system32\Adobe\SVG Viewer\SVGHelp.html ... disinfected C:\WINDOWS\system32\oobe\actshell.htm ... disinfected C:\WINDOWS\system32\oobe\dtsgnup.htm ... disinfected C:\WINDOWS\system32\oobe\msobshel.htm ... disinfected C:\WINDOWS\system32\oobe\updshell.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actconn.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actdone.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activ.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activerr.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\activsvc.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\actlan.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\adeskerr.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\adrdyreg.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\apolicy.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aprvcyms.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\areg1.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aregdial.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\aregdone.htm ... disinfected C:\WINDOWS\system32\oobe\actsetup\ausrinfo.htm ... disinfected C:\WINDOWS\system32\oobe\error\cnncterr.htm ... disinfected C:\WINDOWS\system32\oobe\error\dialtone.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dslmain.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dsl_a.htm ... disinfected C:\WINDOWS\system32\oobe\html\dslmain\dsl_b.htm ... disinfected C:\WINDOWS\system32\oobe\html\iconnect\icntlast.htm ... disinfected C:\WINDOWS\system32\oobe\html\iconnect\iconnect.htm ... disinfected C:\WINDOWS\system32\oobe\html\isptype\isptype.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_a.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_b.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_c.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_d.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_e.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_f.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_g.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_h.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_i.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_j.htm ... disinfected C:\WINDOWS\system32\oobe\html\mouse\mouse_k.htm ... disinfected C:\WINDOWS\system32\oobe\html\sconnect\scntlast.htm ... disinfected C:\WINDOWS\system32\oobe\html\sconnect\sconnect.htm ... disinfected C:\WINDOWS\system32\oobe\icserror\icsdc.htm ... disinfected C:\WINDOWS\system32\oobe\isperror\ispcnerr.htm ... disinfected C:\WINDOWS\system32\oobe\isperror\ispdtone.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rcnterr.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rdtone.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rhndshk.htm ... disinfected C:\WINDOWS\system32\oobe\regerror\rnoansw.htm ... disinfected C:\WINDOWS\system32\oobe\setup\acterror.htm ... disinfected C:\WINDOWS\system32\oobe\setup\activate.htm ... disinfected C:\WINDOWS\system32\oobe\setup\act_plcy.htm ... disinfected C:\WINDOWS\system32\oobe\setup\autoupdt.htm ... disinfected C:\WINDOWS\system32\oobe\setup\au_plcy.htm ... disinfected C:\WINDOWS\system32\oobe\setup\badeula.htm ... disinfected C:\WINDOWS\system32\oobe\setup\badpkey.htm ... disinfected C:\WINDOWS\system32\oobe\setup\compname.htm ... disinfected C:\WINDOWS\system32\oobe\setup\dialup.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyisp.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdymig.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyoem.htm ... disinfected C:\WINDOWS\system32\oobe\setup\drdyref.htm ... disinfected ((((((((((((((((((((((((((((((( Files Created from 2007-03-03 to 2007-04-03 )))))))))))))))))))))))))))))))))) 2007-03-30 07:59 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-03-30 00:13 29 --a------ C:\WINDOWS\system32\Msf3sf.sys 2007-03-30 00:05 <DIR> d-------- C:\WINDOWS\system32\ekzdiq65 2007-03-30 00:04 <DIR> d-------- C:\WINDOWS\system32\ddvlpj33 2007-03-30 00:02 <DIR> d-------- C:\Program Files\ixxu 2007-03-30 00:01 50,661 --a------ C:\WINDOWS\system32\DiskFree_mt01.2.exe 2007-03-30 00:01 24,558 --a------ C:\WINDOWS\system32\LocalSetup_ASM_4620.exe 2007-03-29 22:16 <DIR> d-------- C:\!KillBox 2007-03-29 08:58 <DIR> d-------- C:\WINDOWS\pss 2007-03-28 03:39 <DIR> d-------- C:\WINDOWS\system32\rsndrq16 2007-03-28 00:34 <DIR> d-------- C:\WINDOWS\system32\ffepwe83 2007-03-27 23:25 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-03-27 22:19 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-03-27 22:15 <DIR> d-------- C:\Program Files\vodafone 2007-03-27 22:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1.IBM\APPLIC~1\Simply Super Software 2007-03-26 00:59 <DIR> d-------- C:\Program Files\Common Files\ixxu 2007-03-26 00:45 1 --a------ C:\WINDOWS\msnlive.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-03 22:32 -------- d-------- C:\Program Files\symantec antivirus 2007-03-30 00:23 49152 --a------ C:\WINDOWS\system32\rwwcgv01.dll 2007-03-30 00:01 445440 --a------ C:\WINDOWS\system32\setup.exe 2007-03-27 22:15 -------- d-------- C:\Program Files\Common Files\wise installation wizard 2007-03-27 03:42 30 --a------ C:\AUTOEXEC.BAT 2007-03-27 03:42 0 --a------ C:\CONFIG.SYS 2007-03-26 21:10 -------- d-------- C:\Program Files\mobile master 2007-03-26 20:23 -------- d-------- C:\Program Files\desktop2mobiledb 2007-03-25 23:51 -------- d-------- C:\Program Files\wst (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "C4EBReg"="\"C:\\progra~1\\c4ebreg\\c4ebreg.exe\" /q" "ISSI EZUpdate Service"="\"c:\\sdwork\\issimsvc.exe\"" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.exe" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe /tray" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.exe" "BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor" "BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog" "AGRSMMSG"="AGRSMMSG.exe" "ISAMTray"="\"C:\\progra~1\\c4ebreg\\isamtray.exe\"" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\Integrity Client\\iclient.exe\"" "BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "TPKMAPHELPER"="C:\\Program Files\\ThinkPad\\Utilities\\TpKmapAp.exe -helper" "defergui"="c:\\sdwork\\defergui.exe" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "ACTray"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACTray.exe" "ACWLIcon"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACWLIcon.exe" "TVT Scheduler Proxy"="C:\\Program Files\\Common Files\\Lenovo\\Scheduler\\scheduler_proxy.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "configmsi"="cmd /c \"rmdir /q C:\\config.msi\"" "supportdir"="cmd /c \"rmdir /q /s \"C:\\WINDOWS\\TEMP\\{BF90215F-2D7B-4C84-8A24-A03BC41B95DD}\"\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" @="" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "Nokia Tray Application"="C:\\Program Files\\Common Files\\Nokia\\Tools\\NclTray.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" "{90BC520C-9175-470E-94B8-10FD869D170B}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoClose"=dword:00000000 "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WmdmPWD REG_MULTI_SZ WmdmPWD\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c5dfa94-dc6d-11db-82ce-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62c647f1-dc77-11db-82cf-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e718fff8-de04-11d9-81f0-00028a20e42e}] Shell\AutoRun\command D:\Player.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f333e640-5780-11db-82be-00042348136d}] Shell\Auto\command E:\WGSJy.exe Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL WGSJy.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\BMMTask.job C:\WINDOWS\tasks\eNjrewTCNnNsTFAMVZnAYibundKQSR.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-03 22:49:07 C:\ComboFix2.txt ... 07-03-30 23:44

0

Run this rootkit scan please. Download F-Secure BlackLight Click no to viewing unsecure pages if asked then accept the agreement. Click download (Download Blacklight Beta graphical user interface version ) and download it to your desktop. Double click blbeta.exe> click run> accept licence agreement> next. Click Scan> Next. After the scan you'll see a list of all items found. Please click Next and then Exit. Do NOT choose rename for any items yet! I need to see the log first, because legitimate items can also be present there. A log will be created on your desktop with the name fsbl.xxxxxxx.log (the xxxxxxx are numbers) Please post the contents of the log in your next reply. Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe Doubleclick the drweb-cureit.exe file and Allow to run the express scan. This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan. Once the short scan has finished, mark the drives that you want to scan. Select all drives. A red dot shows which drives have been chosen. Click the green arrow at the right, and the scan will start. Click 'Yes to all' if it asks if you want to cure/move the file. When the scan has finished, look if you can click next icon next to the files found: If so, click it and then click the next icon right below and select Move incurable. This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples) After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list Save the report to your desktop. The report will be called DrWeb.csv Close Dr.Web Cureit. Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot. After reboot, post the contents of the log on your desktop.

0

Hi Jabuck, Here is the log from F-Secure 04/05/07 00:31:03 [Info]: BlackLight Engine 1.0.61 initialized 04/05/07 00:31:03 [Info]: OS: 5.1 build 2600 (Service Pack 2) 04/05/07 00:31:03 [Note]: 7019 4 04/05/07 00:31:03 [Note]: 7005 0 04/05/07 00:31:06 [Note]: 7006 0 04/05/07 00:31:06 [Note]: 7011 752 04/05/07 00:31:07 [Note]: 7026 0 04/05/07 00:31:07 [Note]: 7026 0 04/05/07 00:31:09 [Note]: FSRAW library version 1.7.1021 04/05/07 00:45:49 [Note]: 2000 1012 04/05/07 00:45:49 [Note]: 2000 1012 04/05/07 00:45:49 [Note]: 2000 1012 04/05/07 00:45:49 [Note]: 2000 1012 04/05/07 00:46:08 [Note]: 7007 0 The Scan from Dr Web is still running. CW

0

Hi Jabuck. Here is the log from Dr Web c4ebreg.exe;c:\program files\c4ebreg;Probably DLOADER.Trojan;; issimsvc.exe;c:\sdwork;Probably DLOADER.Trojan;; A677FFBC.DLL;C:\!KillBox;Trojan.Popwin;Deleted.; A677FFBC.DLL( 1);C:\!KillBox;Trojan.Popwin;Deleted.; A677FFBC.DLL( 2);C:\!KillBox;Trojan.Popwin;Deleted.; A677FFBC.EXE;C:\!KillBox;Trojan.Popwin;Deleted.; cb02.exe;C:\!KillBox;Trojan.DownLoader.19852;Deleted.; IEHelper.dll;C:\!KillBox;Adware.Zhong;; IEHelper.dll( 2);C:\!KillBox;Adware.Zhong;; internet.exe;C:\!KillBox;Adware.Msearch;; internet.exe( 1);C:\!KillBox;Adware.Msearch;; MyFavor32.dll;C:\!KillBox;Adware.Newweb;; MyFavor64.dll;C:\!KillBox;Adware.Newweb;; c4ebreg.exe;C:\Program Files\C4ebreg;Probably DLOADER.Trojan;; c4ebregu.exe;C:\Program Files\C4ebreg;Probably DLOADER.Trojan;; backup-20070329-082502-154.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-082502-784.dll;C:\Program Files\Hijackthis\backups;Adware.Newweb;; backup-20070329-222443-890.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-222621-106.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-222659-639.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-230250-385.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-230320-228.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-230344-440.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; backup-20070329-235133-713.dll;C:\Program Files\Hijackthis\backups;Adware.Zhong;; wstdump.exe;C:\Program Files\wst;Tool.Lsadump;; admin2.exe;C:\sdwork;Win32.HLLC.Winatch;Incurable.Moved.; ADMINCHG.EXE;C:\sdwork;Win32.HLLC.Winatch;Incurable.Moved.; CBPDONE.EXE;C:\sdwork;Win32.HLLC.Winatch;Incurable.Moved.; delRRU.exe;C:\sdwork;Win32.HLLC.Winatch;Incurable.Moved.; issimsvc.exe;C:\sdwork;Probably DLOADER.Trojan;; rwwcgv01.dll;C:\WINDOWS\system32;Adware.Newweb;; setup.exe;C:\WINDOWS\system32;Adware.Cdn;; ibqzlj23.sys.ren;C:\WINDOWS\system32\drivers;Adware.Newweb;; rsndrq16.dll;C:\WINDOWS\system32\rsndrq16;Adware.Baidu;; windrq16.dll;C:\WINDOWS\system32\rsndrq16;Adware.Baidu;; CW

0

Looking better. Download haxfix.exe. Save it to your desktop. Double click on haxfix.exe to install haxfix. (standard installation path is c:\program Files\haxfix) Checkmark "Create a desktop icon". Click "Next". When the installation is completed, make sure that the checkmark "Launch HaxFix" is placed. Click "Finish". Double click on fix.bat desktop icon (Haxfix) Close all other open windows since this step requires a reboot. Select option 2. Run auto fix by typing 2, and then pressing Enter. If an infection is found, you'll get a message to close all other open windows. Close them, except the red dos window from haxfix and then press Enter. The computer will reboot. After reboot a logfile will open. Post the contents of that logfile.

0

Hi Jabuck, My machine did not reboot and hence I did not get the log file. The HAXFIX run finished with a msg saying "No Haxdoor or Goldun infection found." and returned to the main menu. CW

0

Hi Jabuck, I further selected "Option 1-Make a log file" for HAXFIX and have attached it here. HAXFIX logfile - by Marckie version 4.39 04/06/2007 9:18:39.98 --- Checking for Haxdoor --- checking for a3d files a3d files not found checking for matching notify keys no matching notify keys found checking for matching services matching services found CmBatt checking for matching safeboot services no matching safeboot services found checking for other Haxdoor-files no other Haxdoor-files found --- Checking for Goldun --- checking for SSODL keys no ssodl keys found checking for notify keys no notify keys found checking for services no services found checking for other Goldun-files no other Goldun-files found checking iexplore.exe iexplore.exe is not infected Finished! CW

0

Ok, lets try it manaully again; Reboot into safe mode then run killbox and delete these files. C:\WINDOWS\system32\ekzdiq65.dll C:\WINDOWS\system32\ddvlpj33.dll C:\WINDOWS\system32\rsndrq16.dll C:\WINDOWS\system32\ffepwe83.dll C:\WINDOWS\system32\windrq16.dll C:\WINDOWS\system32\setup.exe C:\Program Files\wst\wstdump.exe C:\WINDOWS\system32\rwwcgv01.dll C:\WINDOWS\system32\ibqzlj23.sys.ren C:\WINDOWS\system32\ibqzlj23.sys C:\WINDOWS\system32\LocalSetup_ASM_4620.exe DiskFree_mt01.2.exe C:\WINDOWS\TEMP\{BF90215F-2D7B-4C84-8A24-A03BC41B95DD} Next whilw still in safe mode navigate to and delete this folder: C:\Program Files\wst Next reboot to normal mode. Open notepad (Start Menu > Run > Type notepad and press "ok". Copy and paste everything into notepad between the x's making regedit4 the top line. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX REGEDIT4 [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "configmsi"=- "supportdir"= XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop. Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes. Post a new combofix log. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install AVG Anti-Spyware We will need this later in safe mode Be sure to update AVG Anti- Spyware Next reboot into safe mode again. Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Post the AVG report and a hijack This log if possible.

0

Hi Jabuck, I could not find: C:\WINDOWS\system32\ddvlpj33.dll But found empty dir ddvlp33.dll C:\WINDOWS\system32\rsndrq16.dll But found dir rsndrq16 which contain the file rsndrq16.dll and windrq16.dll, do I delete both files with killbox? C:\WINDOWS\system32\ekzdiq65.dll but found empty dir ekzdiq65.dll C:\WINDOWS\system32\ffepwe83.dll but found empty dir ffepwe83 C:\WINDOWS\system32\windrq16.dll but found windrq16.dll in dir rsndrq16 C:\WINDOWS\system32\rwwcgv01.dll but found C:\WINDOWS\System32\rwwcgv01.ini, delete? C:\WINDOWS\system32\ibqzlj23.sys.ren and C:\WINDOWS\system32\ibqzlj23.sys But found C:\WINDOWS\system32\ibqzlj23.ini C:\WINDOWS\TEMP\{BF90215F-2D7B-4C84-8A24-A03BC41B95DD} Found the followings and deleted using Killbox- standard File Kill C:\WINDOWS\system32\setup.exe C:\Program Files\wst\wstdump.exe C:\WINDOWS\system32\LocalSetup_ASM_4620.exe C:\WINDOWS\system32\DiskFree_mt01.2.exe Do i proceed with the rest of the steps? CW

0

Delete all instances of the files and continue with the process.

0

Hi Jabuck, Here is the AVG log: AVG Anti-Spyware - Scan Report + Created at: 11:48:47 PM 04/09/2007 + Scan result: C:\!KillBox\IEHelper.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\!KillBox\IEHelper.dll( 2) -> Adware.Agent : Cleaned with backup (quarantined). C:\!KillBox\internet.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\!KillBox\internet.exe( 1) -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-082502-154.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-222443-890.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-222621-106.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-222659-639.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-230250-385.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-230320-228.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-230344-440.dll -> Adware.Agent : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-235133-713.dll -> Adware.Agent : Cleaned with backup (quarantined). HKU\S-1-5-21-972506294-1754454779-3683679437-500\Software\Alexa Internet -> Adware.Alexa : Cleaned with backup (quarantined). C:\!KillBox\rsndrq16\rsndrq16.dll -> Adware.Baidu : Cleaned with backup (quarantined). C:\!KillBox\rsndrq16\windrq16.dll -> Adware.Baidu : Cleaned with backup (quarantined). C:\!KillBox\ad203.exe -> Adware.BHO : Cleaned with backup (quarantined). C:\!KillBox\setup.exe -> Adware.Cdnup : Cleaned with backup (quarantined). C:\!KillBox\wiasoervc.dll -> Adware.Delf : Cleaned with backup (quarantined). C:\!KillBox\MyFavor32.dll -> Adware.NewWeb : Cleaned with backup (quarantined). C:\!KillBox\MyFavor64.dll -> Adware.NewWeb : Cleaned with backup (quarantined). C:\!KillBox\xtnzic82.exe -> Adware.NewWeb : Cleaned with backup (quarantined). C:\Program Files\Hijackthis\backups\backup-20070329-082502-784.dll -> Adware.NewWeb : Cleaned with backup (quarantined). C:\WINDOWS\system32\drivers\ibqzlj23.sys.ren -> Adware.NewWeb : Cleaned with backup (quarantined). :mozilla.419:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Connextra : Cleaned. :mozilla.392:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.393:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.394:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Dealtime : Cleaned. :mozilla.104:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.105:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.387:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.388:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.389:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Msn : Cleaned. :mozilla.349:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Paypal : Cleaned. :mozilla.133:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.134:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.135:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Real : Cleaned. :mozilla.81:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.82:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.83:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.84:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.31:C:\Documents and Settings\Administrator.IBM-970317R\Application Data\Mozilla\Firefox\Profiles\zcfq942y.default\cookies.txt -> TrackingCookie.Skype : Cleaned. C:\Program Files\Common Files\Microsoft Shared\MSInfo\system42.rar -> Trojan.Delf.qc : Cleaned with backup (quarantined). ::Report end Here is the hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 11:50:59 PM, on 04/09/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\Program Files\Hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://w3.ibm.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://w3-1.ibm.com/download/standa... R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = ;<local> O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {8728D167-41A6-4561-969C-CD75049F83AB} - C:\WINDOWS\system32\wiasoervc.dll (file missing) O4 - HKLM\..\Run: [C4EBReg] "C:\progra~1\c4ebreg\c4ebreg.exe" /q O4 - HKLM\..\Run: [ISSI EZUpdate Service] "c:\sdwork\issimsvc.exe" O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.exe O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor O4 - HKLM\..\Run: [BLOG] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatLogEx.DLL,StartBattLog O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [ISAMTray] "C:\progra~1\c4ebreg\isamtray.exe" O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\Integrity Client\iclient.exe" O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper O4 - HKLM\..\Run: [defergui] c:\sdwork\defergui.exe O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup O4 - HKLM\..\Run: [ACTray] C:\Program Files\ThinkPad\ConnectUtilities\ACTray.exe O4 - HKLM\..\Run: [ACWLIcon] C:\Program Files\ThinkPad\ConnectUtilities\ACWLIcon.exe O4 - HKLM\..\Run: [TVT Scheduler Proxy] C:\Program Files\Common Files\Lenovo\Scheduler\scheduler_proxy.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra button: Software Installer - {D1A4DEBD-C2EE-449f-B9FB-E8409F9A0BC5} - C:\Program Files\ThinkPad\PkgMgr\\PkgMgr.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O14 - IERESET.INF: START_PAGE_URL=http://w3.ibm.com O16 - DPF: Sametime MRC 651FP1 - http://snappshare.webahead.ibm.com/... O16 - DPF: {5F30F398-64B6-4D5B-AF59-164FB61F56A6} (One Force Compplanner) - https://comp.ap.workscape.com/oneforce/compplanner/master.cab O16 - DPF: {8F0DF9DB-AA5A-4ED0-9176-1C4A9C762C59} (JNILoader Control) - http://snappshare.webahead.ibm.com/... O16 - DPF: {9519B2A2-6592-4E41-8290-D0298459270C} (LNWebAssist Class) - http://w3.ibm.com/bluepages/scripts... O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\Software\..\Telephony: DomainName = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = sg.ibm.com O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ibm.com O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ibm.com O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL O20 - Winlogon Notify: NavLogon - C:\WINDOWS\System32\NavLogon.dll O20 - Winlogon Notify: tpfnf2 - C:\WINDOWS\SYSTEM32\notifyf2.dll O20 - Winlogon Notify: tphotkey - C:\WINDOWS\SYSTEM32\tphklock.dll O23 - Service: Ac Profile Manager Service (AcPrfMgrSvc) - Unknown owner - C:\Program Files\ThinkPad\ConnectUtilities\AcPrfMgrSvc.exe O23 - Service: Access Connections Main Service (AcSvc) - Lenovo - C:\Program Files\ThinkPad\ConnectUtilities\AcSvc.exe O23 - Service: IBM Mobility Client DHCP Control (artdhcp) - Unknown owner - C:\Program Files\IBM\Mobility Client\artdhcp.exe O23 - Service: Mobility Client (ArtourService) - Unknown owner - C:\Program Files\IBM\Mobility Client\artsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: IBM Standard Asset Manager Service (ISAMSvc) - IBM Global Services - C:\progra~1\c4ebreg\c4ebreg.exe O23 - Service: ISSI EZUpdate (ISSIMon) - IBM Global Services - c:\sdwork\issimsvc.exe O23 - Service: License Management Service ESD - Unknown owner - C:\Program Files\Common Files\element5 Shared\Service\Licence Manager ESD.exe O23 - Service: Network Configuration Service (NetCfgSvr) - AT&T - C:\PROGRA~1\AT&TNE~1\NetCfgSv.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\system32\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\system32\S24EvMon.exe O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: System Update (SUService) - - c:\program files\lenovo\system update\suservice.exe O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe O23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

0

Hi Jabuck, Combofix log: "foocw" - 07-04-10 0:05:31 Service Pack 2 ComboFix 07-03-27.4.2 - Running from: "C:\Documents and Settings\Administrator.IBM-970317R\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\10.tmp C:\WINDOWS\12.tmp ((((((((((((((((((((((((((((((( Files Created from 2007-03-10 to 2007-04-10 )))))))))))))))))))))))))))))))))) 2007-04-06 00:28 90,112 --a------ C:\WINDOWS\system32\RegDACL.exe 2007-04-06 00:28 8,234 --a------ C:\clean.bat 2007-04-06 00:28 53,248 --a------ C:\WINDOWS\system32\process.exe 2007-04-06 00:28 40,960 --a------ C:\WINDOWS\system32\swsc.exe 2007-04-06 00:28 4,096 --a------ C:\WINDOWS\system32\reboot.exe 2007-04-06 00:28 38,400 --a------ C:\WINDOWS\system32\moveex.exe 2007-04-05 00:47 <DIR> d-------- C:\DOCUME~1\ADMINI~1.IBM\DoctorWeb 2007-03-30 07:59 3,968 --a------ C:\WINDOWS\system32\drivers\AvgArCln.sys 2007-03-30 00:13 29 --a------ C:\WINDOWS\system32\Msf3sf.sys 2007-03-30 00:02 <DIR> d-------- C:\Program Files\ixxu 2007-03-29 22:16 <DIR> d-------- C:\!KillBox 2007-03-29 08:58 <DIR> d-------- C:\WINDOWS\pss 2007-03-27 23:25 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2007-03-27 22:19 <DIR> d-a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\TEMP 2007-03-27 22:15 <DIR> d-------- C:\Program Files\vodafone 2007-03-27 22:13 <DIR> d-------- C:\DOCUME~1\ADMINI~1.IBM\APPLIC~1\Simply Super Software 2007-03-26 00:59 <DIR> d-------- C:\Program Files\Common Files\ixxu 2007-03-26 00:45 1 --a------ C:\WINDOWS\msnlive.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-04-10 00:05 -------- d-------- C:\Program Files\symantec antivirus 2007-03-27 22:15 -------- d-------- C:\Program Files\Common Files\wise installation wizard 2007-03-27 03:42 30 --a------ C:\AUTOEXEC.BAT 2007-03-27 03:42 0 --a------ C:\CONFIG.SYS 2007-03-26 21:10 -------- d-------- C:\Program Files\mobile master 2007-03-26 20:23 -------- d-------- C:\Program Files\desktop2mobiledb (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "C4EBReg"="\"C:\\progra~1\\c4ebreg\\c4ebreg.exe\" /q" "ISSI EZUpdate Service"="\"c:\\sdwork\\issimsvc.exe\"" "EZEJMNAP"="C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\EzEjMnAp.exe" "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe /tray" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "vptray"="C:\\PROGRA~1\\SYMANT~1\\VPTray.exe" "BMMLREF"="C:\\Program Files\\ThinkPad\\Utilities\\BMMLREF.exe" "BMMMONWND"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatInfEx.dll,BMMAutonomicMonitor" "BLOG"="rundll32.exe C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\BatLogEx.DLL,StartBattLog" "AGRSMMSG"="AGRSMMSG.exe" "ISAMTray"="\"C:\\progra~1\\c4ebreg\\isamtray.exe\"" "Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\Integrity Client\\iclient.exe\"" "BMMGAG"="RunDll32 C:\\PROGRA~1\\ThinkPad\\UTILIT~1\\pwrmonit.dll,StartPwrMonitor" "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "TPKMAPHELPER"="C:\\Program Files\\ThinkPad\\Utilities\\TpKmapAp.exe -helper" "defergui"="c:\\sdwork\\defergui.exe" "Google Desktop Search"="\"C:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe\" /startup" "ACTray"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACTray.exe" "ACWLIcon"="C:\\Program Files\\ThinkPad\\ConnectUtilities\\ACWLIcon.exe" "TVT Scheduler Proxy"="C:\\Program Files\\Common Files\\Lenovo\\Scheduler\\scheduler_proxy.exe" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce] "supportdir"="cmd /c \"rmdir /q /s \"C:\\WINDOWS\\TEMP\\{BF90215F-2D7B-4C84-8A24-A03BC41B95DD}\"\"" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "TPHOTKEY"="C:\\PROGRA~1\\ThinkPad\\PkgMgr\\HOTKEY\\TPHKMGR.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe" "SynTPLpr"="C:\\Program Files\\Synaptics\\SynTP\\SynTPLpr.exe" @="" "DataLayer"="C:\\Program Files\\Common Files\\PCSuite\\DataLayer\\DataLayer.exe" "Nokia Tray Application"="C:\\Program Files\\Common Files\\Nokia\\Tools\\NclTray.exe" [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "appinit_dlls"="C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" "{90BC520C-9175-470E-94B8-10FD869D170B}"="" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 "NoCDBurning"=dword:00000000 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoClose"=dword:00000000 "NoUserNameInStartMenu"=dword:00000001 "NoRecentDocsHistory"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2 HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 WmdmPWD REG_MULTI_SZ WmdmPWD\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4c5dfa94-dc6d-11db-82ce-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{62c647f1-dc77-11db-82cf-00042348136d}] Shell\AutoRun\command E:\VMC_PBStarter.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e718fff8-de04-11d9-81f0-00028a20e42e}] Shell\AutoRun\command D:\Player.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f333e640-5780-11db-82be-00042348136d}] Shell\Auto\command E:\WGSJy.exe Shell\AutoRun\command C:\WINDOWS\system32\RunDLL32.exe Shell32.DLL,ShellExec_RunDLL WGSJy.exe Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\BMMTask.job C:\WINDOWS\tasks\eNjrewTCNnNsTFAMVZnAYibundKQSR.job ******************************************************************** catchme 0.2 W2K/XP/Vista - userland rootkit detector by Gmer, 17 October 2006 http://www.gmer.net scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 ******************************************************************** Completion time: 07-04-10 0:17:18 C:\ComboFix2.txt ... 07-04-03 22:49 C:\ComboFix3.txt ... 07-03-30 23:44

0

Hi Jabuck, Wonder if you have any further recommendations. CW

0