Go to the following link: http://virusscan.jotti.org/ Then use the browse button to locate this file: Once located click submit then post the results. Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX File:: C:\WINDOWS\Installer\{f55bb8d4-0538-4ffd-a3b2-e48854f7dffb}\AvpSrv.dll Folder:: C:\WINDOWS\Installer\{f55bb8d4-0538-4ffd-a3b2-e48854f7dffb} Registry:: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "AvpSrv"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run". Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download CCleaner from the following link: http://filehippo.com/download_ccleaner/ After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items. Run an online scan with Kaspersky from the following link: Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component. (Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.) The program launches and downloads the latest definition files. Once the files are downloaded click on Next Click on Scan Settings and configure as follows: Scan using the following Anti-Virus database: Extended Scan Options: Scan Archives Scan Mail Base Click OK and, under select a target to scan, select My Computer When the scan is done, in the Scan is completed window (below), any infection is displayed. There is no option to clean/disinfect, however, we need to analyze the information on the report. To obtain the report: Click on: Save Report As (above - red blinking arrow) Next, in the Save as prompt, Save in area, select: Desktop In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select: Text file [*.txt] Then, click: Save Please post the Kaspersky Online Scanner Report in your reply. Post a new Combofix log ans a new Hijack This log please.

0

You posted: "Go to the following link: http://virusscan.jotti.org/ Then use the browse button to locate this file: Once located click submit then post the results." Could you tell me which file you want me to download and run, because the name of file was omitted? I ran Kaspersky online scan a few days back and had a number of Trojans, so I installed the trial version of Kaspersky and removed them. I was worried because I thought you'd abandoned me, sorry. All the logs are below, Kaspersky from a few days ago and the rest are up to date with the exception of the file that I don't know the name of. --------------------- KASPERSKY ONLINE SCANNER REPORT Thursday, March 06, 2008 11:28:38 PM Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600) Kaspersky Online Scanner version: 5.0.98.0 Kaspersky Anti-Virus database last update: 6/03/2008 Kaspersky Anti-Virus database records: 606355 --------------------- Scan Settings: Scan using the following antivirus database: extended Scan Archives: true Scan Mail Bases: true Scan Target - My Computer: C:\ D:\ E:\ F:\ G:\ Z:\ Scan Statistics: Total number of scanned objects: 59202 Number of viruses found: 6 Number of infected objects: 14 Number of suspicious objects: 0 Duration of the scan process: 00:49:23 Infected Object Name / Virus Name / Last Action C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.158.Crwl Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\GatherLogs\SystemIndex\SystemIndex.158.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSS.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\MSStmp.log Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.ci Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010002.wsb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010008.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010013.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010014.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010016.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010017.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\00010018.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\0001001A.wid Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\INDEX.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\CiPT0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\PropMap\Used0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SecStore\CiST0000.000 Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk1.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.chk2.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\SystemIndex.Ntfy82.gthr Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\tmp.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Applications\Windows\Windows.edb Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf1.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Ntf2.tmp Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Search\Data\Temp\usgthrsvc\Perflib_Perfdata_5d8.dat Object is locked skipped C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-10012007-010502.log Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Cookies\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\Local Settings\temp\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\AppLogs\SUPERANTISPYWARE-3-6-2008( 8-26-53 ).LOG Object is locked skipped C:\Documents and Settings\Phil\Cookies\index.dat Object is locked skipped C:\Documents and Settings\Phil\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Desktop Search\Logs\OTFSMonLog.txt Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{40570545-8532-468C-AB60-358D1E5936F1} Object is locked skipped C:\Documents and Settings\Phil\Local Settings\History\History.IE5\index.dat Object is locked skipped C:\Documents and Settings\Phil\Local Settings\History\History.IE5\MSHist012008030620080307\index.dat Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\Content.IE5\JURHHR6A\2250bkpazoow[1].exe Infected: Trojan-Downloader.Win32.Delf.ezu skipped C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\Content.IE5\YMLM17ZL\2[1].htm Infected: Trojan.HTML.Agent.e skipped C:\Documents and Settings\Phil\NTUSER.DAT Object is locked skipped C:\Documents and Settings\Phil\ntuser.dat.LOG Object is locked skipped C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped C:\System Volume Information\_restore{7EC48376-EEB9-4B89-8AFB-8DA80A469838}\RP5\change.log Object is locked skipped C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped C:\WINDOWS\Installer\{5eb79114-c46c-4929-8ec7-0a914328479a}\DrvService.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped C:\WINDOWS\Installer\{e38b414a-e622-4463-a386-1f1d6f01a40e}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped C:\WINDOWS\Installer\{f26b05f9-dbde-467d-ab9d-7702222a063d}\zip.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped C:\WINDOWS\Installer\{f55bb8d4-0538-4ffd-a3b2-e48854f7dffb}\AvpSrv.dll Infected: Trojan-Dropper.Win32.Agent.eya skipped C:\WINDOWS\SchedLgU.Txt Object is locked skipped C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\default Object is locked skipped C:\WINDOWS\system32\config\default.LOG Object is locked skipped C:\WINDOWS\system32\config\Internet.evt Object is locked skipped C:\WINDOWS\system32\config\ODiag.evt Object is locked skipped C:\WINDOWS\system32\config\OSession.evt Object is locked skipped C:\WINDOWS\system32\config\SAM Object is locked skipped C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\SECURITY Object is locked skipped C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped C:\WINDOWS\system32\config\software Object is locked skipped C:\WINDOWS\system32\config\software.LOG Object is locked skipped C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped C:\WINDOWS\system32\config\system Object is locked skipped C:\WINDOWS\system32\config\system.LOG Object is locked skipped C:\WINDOWS\system32\h323log.txt Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped C:\WINDOWS\WindowsUpdate.log Object is locked skipped D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped E:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped E:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped E:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped E:\Program Files\Quicknation\Youtube-Download-Convert-Firefox.dll Infected: not-a-virus:AdWare.Win32.Mostofate.bc skipped E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped E:\System Volume Information\_restore{7EC48376-EEB9-4B89-8AFB-8DA80A469838}\RP5\change.log Object is locked skipped F:\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped F:\SmitfraudFix.zip ZIP: infected - 1 skipped F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped F:\YoutubeDownloadAndConvert-Firefox.exe/stream/data0003 Infected: not-a-virus:AdWare.Win32.Mostofate.bt skipped F:\YoutubeDownloadAndConvert-Firefox.exe/stream/data0006 Infected: not-a-virus:AdWare.Win32.Mostofate.bc skipped F:\YoutubeDownloadAndConvert-Firefox.exe/stream Infected: not-a-virus:AdWare.Win32.Mostofate.bc skipped F:\YoutubeDownloadAndConvert-Firefox.exe NSIS: infected - 3 skipped G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped G:\TEMP\Perflib_Perfdata_694.dat Object is locked skipped G:\TEMP\~DF2E73.tmp Object is locked skipped G:\TEMP\~DF2E7B.tmp Object is locked skipped Scan process completed. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:07:02, on 09/03/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16608) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe E:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe E:\Program Files\PyroSim 2007\fds\smpd.exe E:\Program Files\Spyware Terminator\sp_rsser.exe C:\WINDOWS\system32\SearchIndexer.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Elantech\ktp3.exe E:\Program Files\Windows Defender\MSASCui.exe E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe E:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\WINDOWS\SOUNDMAN.exe C:\WINDOWS\system32\ctfmon.exe E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe E:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe E:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://192.168.2.1/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin... O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp3.exe O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.exe TWEAKUI.CPL,TweakMeUp O4 - HKLM\..\Run: [Windows Defender] "E:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] "E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [SpywareTerminator] "E:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" O4 - HKLM\..\Run: [AVP] "E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SUPERAntiSpyware] E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - Global Startup: Windows Desktop Search.lnk = E:\Program Files\Windows Desktop Search\WindowsSearch.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {047C3241-279D-438A-BC34-9AD1C1910FC0} (DrsDnld Control) - http://www.mathcentre.ac.uk/resourc... O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/pa... O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/re... O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win... O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g... O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driver... O20 - AppInit_DLLs: E:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll O20 - Winlogon Notify: !SASWinLogon - E:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - E:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Crypkey License - CrypKey (Canada) Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: Imapi Helper - Alex Feinman - E:\Program Files\Alex Feinman\ISO Recorder\ImapiHelper.exe O23 - Service: MPICH2 Process Manager, Argonne National Lab (mpich2_smpd) - Unknown owner - E:\Program Files\PyroSim 2007\fds\smpd.exe O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - E:\Program Files\Spyware Terminator\sp_rsser.exe -- End of file - 5957 bytes ComboFix 08-03-01.3 - Phil 2008-03-09 6:57:40.6 - NTFSx86 Running from: C:\Documents and Settings\Phil\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color] . ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 ))))))))))))))))))))))))))))))) . 2008-03-08 21:40 . 2008-03-08 21:40 <DIR> d-------- E:\Program Files\CCleaner 2008-03-07 12:51 . 2008-03-07 12:46 49,152 --a------ C:\WINDOWS\system32\ChCfg.exe 2008-03-07 12:48 . 2008-03-07 12:48 <DIR> d-------- E:\Program Files\Realtek AC97 2008-03-07 12:48 . 2008-03-07 12:46 315,392 --a------ C:\WINDOWS\alcupd.exe 2008-03-07 12:48 . 2008-03-07 12:46 217,088 --a------ C:\WINDOWS\Alcrmv.exe 2008-03-07 06:37 . 2008-03-07 06:37 91,700 --a------ C:\WINDOWS\system32\drivers\klin.dat 2008-03-07 06:37 . 2008-03-07 06:37 85,860 --a------ C:\WINDOWS\system32\drivers\klick.dat 2008-03-07 06:34 . 2008-03-07 06:34 <DIR> d-------- E:\Program Files\Kaspersky Lab 2008-03-07 06:34 . 2008-03-09 07:03 2,929,952 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-03-07 06:34 . 2008-03-08 22:28 47,144 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-03-07 06:34 . 2008-03-09 07:03 44,320 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat 2008-03-07 06:34 . 2008-03-08 22:28 10,256 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx 2008-03-06 22:26 . 2008-03-06 22:26 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-03-06 22:26 . 2008-03-09 06:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2008-03-02 07:07 . 2008-03-02 07:07 275 --a------ C:\WINDOWS\wininit.ini 2008-03-01 20:22 . 2008-03-01 20:24 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\EngMaths 2008-03-01 20:20 . 2008-03-01 20:24 <DIR> d-------- E:\Program Files\Engineering Mathematics 2008-03-01 18:49 . 2008-03-01 18:54 <DIR> d-------- E:\Program Files\Windows Live Safety Center 2008-03-01 18:19 . 2008-03-03 18:50 <DIR> d-------- E:\Program Files\RegScrubXP 2008-03-01 16:12 . 2008-03-05 11:29 <DIR> d-------- E:\Program Files\WinClamAVShield 2008-03-01 16:07 . 2008-03-01 16:07 138,752 --a------ C:\WINDOWS\system32\drivers\sp_rsdrv2.sys 2008-03-01 16:06 . 2008-03-01 16:06 <DIR> d-------- E:\Program Files\SUPERAntiSpyware 2008-03-01 16:06 . 2008-03-08 11:08 <DIR> d-------- E:\Program Files\Spyware Terminator 2008-03-01 16:06 . 2008-03-01 16:06 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com 2008-03-01 16:06 . 2008-03-08 11:01 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Spyware Terminator 2008-03-01 16:06 . 2008-03-01 16:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-03-01 16:06 . 2008-03-08 11:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spyware Terminator 2008-03-01 16:03 . 2008-03-01 16:03 <DIR> d-------- E:\Program Files\Spybot - Search & Destroy 2008-03-01 16:03 . 2008-03-01 16:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-03-01 15:59 . 2008-03-03 19:11 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP 2008-03-01 15:58 . 2008-03-03 19:11 <DIR> d-------- E:\Program Files\SpywareBlaster 2008-03-01 14:04 . 2008-03-01 14:04 <DIR> d-------- E:\Program Files\Alwil Software 2008-03-01 14:04 . 2003-03-18 20:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll 2008-03-01 13:47 . 2008-03-01 13:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7 2008-03-01 11:15 . 2004-08-03 23:56 388,608 --a------ C:\CF19599.exe 2008-03-01 10:52 . 2008-03-01 10:52 <DIR> d-------- E:\Program Files\Trend Micro 2008-03-01 08:05 . 2008-03-01 08:05 <DIR> d-------- C:\Documents and Settings\Phil\Temporary Internet Files 2008-02-29 19:21 . 2008-02-29 19:21 <DIR> d-------- E:\Program Files\Lavasoft 2008-02-29 19:21 . 2008-02-29 19:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft 2008-02-29 17:21 . 2008-03-03 05:03 2,140 --a------ C:\WINDOWS\system32\tmp.reg 2008-02-29 16:22 . 2008-02-29 16:22 <DIR> d-------- E:\Program Files\Enigma Software Group 2008-02-24 18:21 . 2008-02-24 18:21 <DIR> d-------- C:\Documents and Settings\All Users\CrypKey 2008-02-24 18:07 . 2008-02-25 06:48 4,480 --a------ C:\WINDOWS\system32\esnecil.nlp 2008-02-24 18:07 . 2008-03-08 11:49 4,480 --a------ C:\WINDOWS\system32\esnecil.ind 2008-02-24 18:07 . 2008-03-08 11:49 4 --a------ C:\WINDOWS\vx86036.dat 2008-02-24 10:49 . 2008-03-08 11:50 <DIR> d-------- E:\Program Files\PyroSim 2007 2008-02-24 10:49 . 2008-02-24 10:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PyroSim 2008-02-24 10:48 . 2008-02-25 17:09 <DIR> d-------- E:\Program Files\PyroSim 2008-02-24 10:48 . 1999-06-18 21:49 165,888 --a------ C:\WINDOWS\Ckconfig.exe 2008-02-24 10:48 . 2007-05-23 18:29 122,880 --a------ C:\WINDOWS\system32\Crypserv.exe 2008-02-24 10:48 . 1996-05-03 17:21 27,648 -ra------ C:\WINDOWS\Setup_ck.exe 2008-02-24 10:48 . 1996-05-03 15:36 18,432 --a------ C:\WINDOWS\Setup_ck.dll 2008-02-24 10:48 . 2007-05-01 21:15 16,896 --a------ C:\WINDOWS\system32\Ckldrv.sys 2008-02-24 10:48 . 1995-07-04 18:33 11,776 --a------ C:\WINDOWS\Ckrfresh.exe 2008-02-24 10:48 . 2008-02-24 10:50 78 --a------ C:\WINDOWS\Crypkey.ini 2008-02-14 00:58 . 2008-02-14 00:58 <DIR> d-------- E:\Program Files\CFAST6 2008-02-13 07:06 . 2008-02-13 07:06 <DIR> d-------- E:\Program Files\Microsoft Silverlight 2008-02-10 09:14 . 2008-03-02 09:10 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-02-10 09:14 . 2008-02-10 09:14 1,409 --a------ C:\WINDOWS\QTFont.for 2008-02-10 09:09 . 2008-02-10 09:09 <DIR> d-------- E:\Program Files\Apple Software Update 2008-02-10 09:09 . 2008-02-10 09:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-03-08 19:46 --------- d-----w C:\Documents and Settings\Phil\Application Data\EndNote 2008-03-08 15:57 --------- d-----w E:\Program Files\FPETool 2008-03-07 12:48 --------- d--h--w E:\Program Files\InstallShield Installation Information 2008-03-07 12:46 577,536 ----a-w C:\WINDOWS\soundman.exe 2008-03-07 12:46 147,456 ----a-w C:\WINDOWS\system32\RtlCPAPI.dll 2008-03-07 12:46 10,528,768 ----a-w C:\WINDOWS\system32\RTLCPL.exe 2008-03-07 06:52 --------- d-----w E:\Program Files\Quicknation 2008-03-02 09:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help 2008-03-01 16:05 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard 2008-02-11 18:09 --------- d-----w C:\Program Files\Common Files\Adobe 2008-02-10 09:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer 2008-02-08 18:37 219,664 ----a-w C:\WINDOWS\system32\klogon.dll 2008-02-08 18:35 23,604 ----a-w C:\WINDOWS\system32\drivers\klopp.dat 2008-01-24 16:36 4,127,488 ----a-r C:\WINDOWS\system32\drivers\alcxwdm.sys 2007-12-14 11:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe 2007-10-09 16:41 952 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:56 15360] "SUPERAntiSpyware"="E:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AGRSMMSG"="AGRSMMSG.exe" [2003-09-23 16:06 88363 C:\WINDOWS\AGRSMMSG.exe] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 08:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe] "KTPWare"="C:\Program Files\Elantech\ktp3.exe" [2003-11-27 10:33 258048] "Tweak UI"="TWEAKUI.CPL" [2000-06-18 13:03 106544 C:\WINDOWS\system32\TWEAKUI.CPL] "Windows Defender"="E:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584] "SunJavaUpdateSched"="E:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "SpywareTerminator"="E:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe" [2008-03-01 16:07 2957824] "AVP"="E:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" [2008-02-08 18:36 227856] "SoundMan"="SOUNDMAN.EXE" [2008-03-07 12:46 577536 C:\WINDOWS\soundman.exe] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Windows Desktop Search.lnk - E:\Program Files\Windows Desktop Search\WindowsSearch.exe [2007-02-05 14:40:46 118784] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"= E:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2007-02-05 14:39 294400] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= E:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] E:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 E:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=E:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "E:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.exe"= "E:\\Program Files\\PyroSim 2007\\fds\\smpd.exe"= R0 rmedia;Ricoh MediaCard Driver;C:\WINDOWS\system32\DRIVERS\rmedia.sys [2003-10-20 18:09] R1 sp_rsdrv2;Spyware Terminator Driver 2;C:\WINDOWS\system32\drivers\sp_rsdrv2.sys [2008-03-01 16:07] R2 mpich2_smpd;MPICH2 Process Manager, Argonne National Lab;E:\Program Files\PyroSim 2007\fds\smpd.exe [2008-01-23 21:01] R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28] R3 Ktp3;Elantech TouchPad(KTP3);C:\WINDOWS\system32\DRIVERS\Ktp3.sys [2004-03-03 08:20] S3 sea3bus;Sony Ericsson Device 0A3 driver (WDM);C:\WINDOWS\system32\DRIVERS\sea3bus.sys [2007-01-26 20:05] S3 sea3mdfl;Sony Ericsson Device 0A3 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\sea3mdfl.sys [2007-01-26 20:06] S3 sea3mdm;Sony Ericsson Device 0A3 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\sea3mdm.sys [2007-01-26 20:06] . Contents of the 'Scheduled Tasks' folder "2008-03-08 10:41:25 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job" - E:\Program Files\Apple Software Update\SoftwareUpdate.exe "2008-03-09 06:44:22 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - E:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-03-09 07:03:23 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... folder error: C:\WINDOWS ************************************************************************** . Completion time: 2008-03-09 7:04:53 ComboFix2.txt 2008-03-08 21:53:02 ComboFix3.txt 2008-03-03 05:01:53 ComboFix4.txt 2008-03-03 04:57:11 ComboFix5.txt 2008-03-01 11:19:40 . 2008-03-07 06:54:03 --- E O F ---

0