|
| Computing.Net: Over 1,000,000 posts about all things technology related! Over 90% answered within 24 hours! Click here to sign up now, it's free! |
Win32/Zonebac.gen!F Problem
|
Original Message
|
Name: EDoggM
Date: March 12, 2008 at 01:19:41 Pacific
Subject: Win32/Zonebac.gen!F ProblemOS: XP Pro w/Media CenterCPU/Ram: 4.0 |
Comment: MS Windows Malicious Software Removal Tool warned me about a Backdoor:Wind32/Zonebac.gen!F I have installed HiJackThis, SmitFraudFix & FindAWF. I have the Logs ready, let me know when to post them. Thanks!
Report Offensive Message For Removal
|
|
Response Number 2
|
Name: EDoggM
Date: March 13, 2008 at 00:15:24 Pacific
|
Reply: (edit)HiJackThis Log Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:13:56 PM, on 3/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: IE - {D83A7B12-A4D4-4984-8F72-D41C6B4C1E6E} - C:\Program Files\eSoftware\studio.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/1503...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupd...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe --
End of file - 6759 bytes
 Report Offensive Follow Up For Removal
|
|
Response Number 3
|
Name: EDoggM
Date: March 13, 2008 at 00:17:15 Pacific
|
Reply: (edit)SmitFraudFix Log: SmitFraudFix v2.301 Scan done at 12:15:41.06, Wed 03/12/2008
Run from C:\Documents and Settings\Eric\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Stardock\Object Desktop\ThemeManager\wbload.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts
»»»»»»»»»»»»»»»»»»»»»»»» C:\
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32
»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Eric
»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Eric\Application Data
»»»»»»»»»»»»»»»»»»»»»»»» Start Menu
»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Eric\FAVORI~1
»»»»»»»»»»»»»»»»»»»»»»»» Desktop
»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files
»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys
»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!! IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
!!!Attention, following keys are not inevitably infected!!!
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wbsys.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Rustock
»»»»»»»»»»»»»»»»»»»»»»»» DNS Description: NVIDIA nForce Networking Controller - Packet Scheduler Miniport
DNS Server Search Order: 68.105.28.11
DNS Server Search Order: 68.105.29.11
DNS Server Search Order: 68.105.28.12 HKLM\SYSTEM\CCS\Services\Tcpip\..\{B9AA21E3-D3F9-43CD-B3D9-18388540C9DB}: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
HKLM\SYSTEM\CS1\Services\Tcpip\..\{B9AA21E3-D3F9-43CD-B3D9-18388540C9DB}: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
HKLM\SYSTEM\CS2\Services\Tcpip\..\{B9AA21E3-D3F9-43CD-B3D9-18388540C9DB}: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=68.105.28.11 68.105.29.11 68.105.28.12
»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection
»»»»»»»»»»»»»»»»»»»»»»»» End
Report Offensive Follow Up For Removal
|
|
Response Number 4
|
Name: EDoggM
Date: March 13, 2008 at 00:20:52 Pacific
|
Reply: (edit)Thanks jabuck! FindAWF Log:
Find AWF report by noahdfear ©2006
Version 1.40
The current date is: Wed 03/12/2008
The current time is: 12:18:15.06
bak folders found
~~~~~~~~~~~
Directory of C:\WINDOWS\BAK
05/11/2000 02:00 AM 90,112 UpdReg.EXE
1 File(s) 90,112 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 06/29/2007 06:24 AM 286,720 qttask.exe
1 File(s) 286,720 bytes Directory of C:\PROGRA~1\REGSHAVE\BAK 02/04/2002 10:32 PM 53,248 REGSHAVE.EXE
1 File(s) 53,248 bytes Directory of C:\PROGRA~1\STEAM\BAK 11/29/2007 07:05 PM 1,266,936 Steam.exe
1 File(s) 1,266,936 bytes Directory of C:\PROGRA~1\WDC\BAK 04/28/2004 02:02 PM 42,496 SetIcon.exe
1 File(s) 42,496 bytes Directory of C:\PROGRA~1\WIFD1F~1\BAK 11/03/2006 08:20 PM 866,584 MSASCui.exe
1 File(s) 866,584 bytes Directory of C:\PROGRA~1\WINDOW~3\BAK 10/18/2006 08:05 PM 204,288 WMPNSCFG.exe
1 File(s) 204,288 bytes Directory of C:\WINDOWS\EHOME\BAK 08/05/2005 01:56 PM 64,512 ehtray.exe
1 File(s) 64,512 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 07/09/2001 03:50 AM 155,648 NeroCheck.exe
1 File(s) 155,648 bytes Directory of C:\PROGRA~1\ALWILS~1\AVAST4\BAK 12/04/2007 06:00 AM 79,224 ashDisp.exe
1 File(s) 79,224 bytes Directory of C:\PROGRA~1\AMD\DUAL-C~1\BAK 07/23/2007 12:06 PM 77,824 amd_dc_opt.exe
1 File(s) 77,824 bytes Directory of C:\PROGRA~1\LOGITECH\G-SERI~1\BAK 03/06/2006 08:14 AM 497,152 LCDMon.exe
03/06/2006 08:31 AM 1,122,304 LGDCore.exe
2 File(s) 1,619,456 bytes Directory of C:\PROGRA~1\LOGITECH\GAMING~1\BAK 09/25/2007 04:03 PM 93,208 LWEMon.exe
1 File(s) 93,208 bytes Directory of C:\PROGRA~1\SCANSOFT\OMNIPA~1.0\BAK 10/11/2006 12:45 PM 75,304 OpwareSE4.exe
1 File(s) 75,304 bytes Directory of C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK 10/10/2007 08:51 PM 39,792 Reader_sl.exe
1 File(s) 39,792 bytes Directory of C:\PROGRA~1\COMMON~1\SCANSO~1\SSBKGD~1\BAK 09/28/2006 01:16 PM 185,896 SSBkgdupdate.exe
1 File(s) 185,896 bytes Directory of C:\PROGRA~1\CREATIVE\MEDIAS~1\GO\BAK 12/12/2005 09:36 AM 143,360 CTCMSGoU.exe
1 File(s) 143,360 bytes Directory of C:\PROGRA~1\CREATIVE\SOUNDB~1\VOLUME~1\BAK 07/13/2006 02:11 PM 122,880 VolPanlu.exe
1 File(s) 122,880 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 09/25/2007 01:11 AM 132,496 jusched.exe
1 File(s) 132,496 bytes Directory of C:\PROGRA~1\LOGITECH\GAMEPA~1\G-SERI~1\BAK 12/13/2007 06:57 PM 2,095,640 LGDCore.exe
1 File(s) 2,095,640 bytes Directory of C:\PROGRA~1\LOGITECH\GAMEPA~1\LCDMAN~1\BAK 12/13/2007 06:43 PM 2,051,096 LCDMon.exe
1 File(s) 2,051,096 bytes Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK 03/09/2005 04:00 AM 98,304 E_FATIAIA.EXE
1 File(s) 98,304 bytes
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
90112 May 11 2000 "C:\WINDOWS\UpdReg.EXE"
90112 May 11 2000 "C:\WINDOWS\bak\UpdReg.EXE"
286720 Jun 29 2007 "C:\Program Files\QuickTime\qttask.exe"
286720 Jun 29 2007 "C:\Program Files\QuickTime\bak\qttask.exe"
53248 Feb 4 2002 "C:\Program Files\REGSHAVE\REGSHAVE.EXE"
53248 Feb 4 2002 "C:\Program Files\REGSHAVE\bak\REGSHAVE.EXE"
1266936 Nov 29 2007 "C:\Program Files\Steam\Steam.exe"
1266936 Nov 29 2007 "C:\Program Files\Steam\bak\Steam.exe"
42496 Apr 28 2004 "C:\Program Files\WDC\SetIcon.exe"
42496 Apr 28 2004 "C:\Program Files\WDC\bak\SetIcon.exe"
866584 Nov 3 2006 "C:\Program Files\Windows Defender\MSASCui.exe"
866584 Nov 3 2006 "C:\Program Files\Windows Defender\bak\MSASCui.exe"
204288 Oct 18 2006 "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
204288 Oct 18 2006 "C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe"
59392 Aug 10 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe"
64512 Aug 5 2005 "C:\WINDOWS\ehome\ehtray.exe"
64512 Aug 5 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\NeroCheck.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
79224 Dec 4 2007 "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
79224 Dec 4 2007 "C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe"
77824 Jul 23 2007 "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe"
77824 Jul 23 2007 "C:\Program Files\AMD\Dual-Core Optimizer\bak\amd_dc_opt.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LGDCore.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
93208 Sep 25 2007 "C:\Program Files\Logitech\Gaming Software\LWEMon.exe"
93208 Sep 25 2007 "C:\Program Files\Logitech\Gaming Software\bak\LWEMon.exe"
73728 Apr 18 2005 "C:\Program Files\Common Files\Logitech\LGS460Inst\Profiler\LWEMon.exe"
75304 Oct 11 2006 "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
75304 Oct 11 2006 "C:\Program Files\ScanSoft\OmniPageSE4.0\bak\OpwareSE4.exe"
39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
185896 Sep 28 2006 "C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate.exe"
185896 Sep 28 2006 "C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe"
143360 Dec 12 2005 "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe"
143360 Dec 12 2005 "C:\Program Files\Creative\MediaSource5\Go\bak\CTCMSGoU.exe"
122880 Jul 13 2006 "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe"
122880 Jul 13 2006 "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\bak\VolPanlu.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
144784 Feb 22 2008 "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LGDCore.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_photo_r2a5c1\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_FATIAIA.EXE"
end of report
Report Offensive Follow Up For Removal
|
|
Response Number 5
|
Name: EDoggM
Date: March 13, 2008 at 00:28:45 Pacific
|
Reply: (edit)Hi jabuck, After reading a previous thread, you recommended SpywareBlaster as one of my Anti-Virus arsenal, so I did that last night. I also have Avast and Ad-Aware, neither detected anything. I also ran Windows Defender. Any other programs that you would recommend? I'm not sure what may have caused this virus, but I also read it may have been related to Java and it not being updated. I started to use Firefox as my web browser instead of IE too. I was told to turn of Scripts, is this the same as Java Scripts? Thank you,
EDoggM
Report Offensive Follow Up For Removal
|
|
Response Number 6
|
Name: jabuck
Date: March 13, 2008 at 17:23:20 Pacific
|
Reply: (edit)Your java is updated to the newest version 1.6.0_05. But you need to unistall the older version. Go to start> control panel> add/remove programs and unistall all versions except Java(TM)6 update5. The script in IE is java script for the most part but you will see that java is added to the list once installed. I just us the default setting but for tighter security close those items will not hurt anything. If you end up not being able to read web pages undo whatever you checked. Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 2 then Enter to restore files from bak folders
A text file opens called: files.txt
Copy/paste the following list of bolded files to be restored:
"C:\WINDOWS\bak\UpdReg.EXE"
"C:\Program Files\QuickTime\bak\qttask.exe"
"C:\Program Files\REGSHAVE\bak\REGSHAVE.EXE"
"C:\Program Files\Steam\bak\Steam.exe"
"C:\Program Files\WDC\bak\SetIcon.exe"
"C:\Program Files\Windows Defender\bak\MSASCui.exe"
"C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe"
"C:\WINDOWS\ehome\bak\ehtray.exe"
"C:\WINDOWS\system32\bak\NeroCheck.exe"
"C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe"
"C:\Program Files\AMD\Dual-Core Optimizer\bak\amd_dc_opt.exe"
"C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
"C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
"C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
"C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
"C:\Program Files\Logitech\Gaming Software\bak\LWEMon.exe"
"C:\Program Files\ScanSoft\OmniPageSE4.0\bak\OpwareSE4.exe"
"C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
"C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe"
"C:\Program Files\Creative\MediaSource5\Go\bak\CTCMSGoU.exe"
"C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\bak\VolPanlu.exe"
"C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe"
"C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
"C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
"C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
"C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
"C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_FATIAIA.EXE"
Next, close and click Yes to save the changes.
Once files.txt is saved, FindAWF does the following:
-It attempts to terminate the process represented by each filename on the list, if running
-Deletes the rogue file from the parent folder, if present
-Copies the original file to the parent folder
When done with the above, it automatically runs a new scan and opens a new log.
Please provide the new FindAWF log in your reply.
Report Offensive Follow Up For Removal
|
|
Response Number 7
|
Name: EDoggM
Date: March 13, 2008 at 21:08:32 Pacific
|
Reply: (edit)I have all previous version of Java removed. Here is the latest log from FindAWF
Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully
The current date is: Thu 03/13/2008
The current time is: 9:03:01.59
bak folders found
~~~~~~~~~~~
Directory of C:\WINDOWS\BAK
05/11/2000 02:00 AM 90,112 UpdReg.EXE
1 File(s) 90,112 bytes Directory of C:\PROGRA~1\MESSEN~1\BAK 0 File(s) 0 bytes Directory of C:\PROGRA~1\QUICKT~1\BAK 06/29/2007 06:24 AM 286,720 qttask.exe
1 File(s) 286,720 bytes Directory of C:\PROGRA~1\REGSHAVE\BAK 02/04/2002 10:32 PM 53,248 REGSHAVE.EXE
1 File(s) 53,248 bytes Directory of C:\PROGRA~1\STEAM\BAK 11/29/2007 07:05 PM 1,266,936 Steam.exe
1 File(s) 1,266,936 bytes Directory of C:\PROGRA~1\WDC\BAK 04/28/2004 02:02 PM 42,496 SetIcon.exe
1 File(s) 42,496 bytes Directory of C:\PROGRA~1\WIFD1F~1\BAK 11/03/2006 08:20 PM 866,584 MSASCui.exe
1 File(s) 866,584 bytes Directory of C:\PROGRA~1\WINDOW~3\BAK 10/18/2006 08:05 PM 204,288 WMPNSCFG.exe
1 File(s) 204,288 bytes Directory of C:\WINDOWS\EHOME\BAK 08/05/2005 01:56 PM 64,512 ehtray.exe
1 File(s) 64,512 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 07/09/2001 03:50 AM 155,648 NeroCheck.exe
1 File(s) 155,648 bytes Directory of C:\PROGRA~1\ALWILS~1\AVAST4\BAK 12/04/2007 06:00 AM 79,224 ashDisp.exe
1 File(s) 79,224 bytes Directory of C:\PROGRA~1\AMD\DUAL-C~1\BAK 07/23/2007 12:06 PM 77,824 amd_dc_opt.exe
1 File(s) 77,824 bytes Directory of C:\PROGRA~1\LOGITECH\G-SERI~1\BAK 03/06/2006 08:14 AM 497,152 LCDMon.exe
03/06/2006 08:31 AM 1,122,304 LGDCore.exe
2 File(s) 1,619,456 bytes Directory of C:\PROGRA~1\LOGITECH\GAMING~1\BAK 09/25/2007 04:03 PM 93,208 LWEMon.exe
1 File(s) 93,208 bytes Directory of C:\PROGRA~1\SCANSOFT\OMNIPA~1.0\BAK 10/11/2006 12:45 PM 75,304 OpwareSE4.exe
1 File(s) 75,304 bytes Directory of C:\PROGRA~1\ADOBE\READER~1.0\READER\BAK 10/10/2007 08:51 PM 39,792 Reader_sl.exe
1 File(s) 39,792 bytes Directory of C:\PROGRA~1\COMMON~1\SCANSO~1\SSBKGD~1\BAK 09/28/2006 01:16 PM 185,896 SSBkgdupdate.exe
1 File(s) 185,896 bytes Directory of C:\PROGRA~1\CREATIVE\MEDIAS~1\GO\BAK 12/12/2005 09:36 AM 143,360 CTCMSGoU.exe
1 File(s) 143,360 bytes Directory of C:\PROGRA~1\CREATIVE\SOUNDB~1\VOLUME~1\BAK 07/13/2006 02:11 PM 122,880 VolPanlu.exe
1 File(s) 122,880 bytes Directory of C:\PROGRA~1\JAVA\JRE16~1.0_0\BIN\BAK 09/25/2007 01:11 AM 132,496 jusched.exe
1 File(s) 132,496 bytes Directory of C:\PROGRA~1\LOGITECH\GAMEPA~1\G-SERI~1\BAK 12/13/2007 06:57 PM 2,095,640 LGDCore.exe
1 File(s) 2,095,640 bytes Directory of C:\PROGRA~1\LOGITECH\GAMEPA~1\LCDMAN~1\BAK 12/13/2007 06:43 PM 2,051,096 LCDMon.exe
1 File(s) 2,051,096 bytes Directory of C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\BAK 03/09/2005 04:00 AM 98,304 E_FATIAIA.EXE
1 File(s) 98,304 bytes
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
90112 May 11 2000 "C:\WINDOWS\UpdReg.EXE"
90112 May 11 2000 "C:\WINDOWS\bak\UpdReg.EXE"
286720 Jun 29 2007 "C:\Program Files\QuickTime\qttask.exe"
286720 Jun 29 2007 "C:\Program Files\QuickTime\bak\qttask.exe"
53248 Feb 4 2002 "C:\Program Files\REGSHAVE\REGSHAVE.EXE"
53248 Feb 4 2002 "C:\Program Files\REGSHAVE\bak\REGSHAVE.EXE"
1266936 Nov 29 2007 "C:\Program Files\Steam\Steam.exe"
1266936 Nov 29 2007 "C:\Program Files\Steam\bak\Steam.exe"
42496 Apr 28 2004 "C:\Program Files\WDC\SetIcon.exe"
42496 Apr 28 2004 "C:\Program Files\WDC\bak\SetIcon.exe"
866584 Nov 3 2006 "C:\Program Files\Windows Defender\MSASCui.exe"
866584 Nov 3 2006 "C:\Program Files\Windows Defender\bak\MSASCui.exe"
204288 Oct 18 2006 "C:\Program Files\Windows Media Player\WMPNSCFG.exe"
204288 Oct 18 2006 "C:\Program Files\Windows Media Player\bak\WMPNSCFG.exe"
59392 Aug 10 2004 "C:\WINDOWS\$NtUninstallKB900325$\ehtray.exe"
64512 Aug 5 2005 "C:\WINDOWS\ehome\ehtray.exe"
64512 Aug 5 2005 "C:\WINDOWS\ehome\bak\ehtray.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\NeroCheck.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
79224 Dec 4 2007 "C:\Program Files\Alwil Software\Avast4\ashDisp.exe"
79224 Dec 4 2007 "C:\Program Files\Alwil Software\Avast4\bak\ashDisp.exe"
77824 Jul 23 2007 "C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe"
77824 Jul 23 2007 "C:\Program Files\AMD\Dual-Core Optimizer\bak\amd_dc_opt.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LGDCore.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
93208 Sep 25 2007 "C:\Program Files\Logitech\Gaming Software\LWEMon.exe"
93208 Sep 25 2007 "C:\Program Files\Logitech\Gaming Software\bak\LWEMon.exe"
73728 Apr 18 2005 "C:\Program Files\Common Files\Logitech\LGS460Inst\Profiler\LWEMon.exe"
75304 Oct 11 2006 "C:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
75304 Oct 11 2006 "C:\Program Files\ScanSoft\OmniPageSE4.0\bak\OpwareSE4.exe"
39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
39792 Oct 10 2007 "C:\Program Files\Adobe\Reader 8.0\Reader\bak\Reader_sl.exe"
185896 Sep 28 2006 "C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate.exe"
185896 Sep 28 2006 "C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\bak\SSBkgdupdate.exe"
143360 Dec 12 2005 "C:\Program Files\Creative\MediaSource5\Go\CTCMSGoU.exe"
143360 Dec 12 2005 "C:\Program Files\Creative\MediaSource5\Go\bak\CTCMSGoU.exe"
122880 Jul 13 2006 "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe"
122880 Jul 13 2006 "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\bak\VolPanlu.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
144784 Feb 22 2008 "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
132496 Sep 25 2007 "C:\Program Files\Java\jre1.6.0_03\bin\bak\jusched.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LGDCore.exe"
1122304 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe"
2095640 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\G-series Software\bak\LGDCore.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
497152 Mar 6 2006 "C:\Program Files\Logitech\G-series Software\bak\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
2051096 Dec 13 2007 "C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak\LCDMon.exe"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\3\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\epsonstylus_photo_r2a5c1\E_FATIAIA.EXE"
98304 Mar 9 2005 "C:\WINDOWS\system32\spool\drivers\w32x86\3\bak\E_FATIAIA.EXE"
end of report
Report Offensive Follow Up For Removal
|
|
Response Number 8
|
Name: jabuck
Date: March 14, 2008 at 03:28:40 Pacific
|
Reply: (edit)Double-click the FindAWF icon once again
If a Security Alert shows, allow the program to run.
As instructed, press any key to continue.
Use the following option: Press 3 then Enter to remove bak folders
A text file opens called: folders.txt
Copy /paste the following list of bolded folders to be removed:
C:\WINDOWS\bak
C:\Program Files\QuickTime\bak
C:\Program Files\REGSHAVE\bak
C:\Program Files\Steam\bak
C:\Program Files\WDC\bak
C:\Program Files\Windows Defender\bak
C:\Program Files\Windows Media Player\bak
C:\WINDOWS\ehome\bak
C:\WINDOWS\system32\bak
C:\Program Files\Alwil Software\Avast4\bak
C:\Program Files\AMD\Dual-Core Optimizer\bak
C:\Program Files\Logitech\G-series Software\bak
C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak
C:\Program Files\Logitech\G-series Software\bak
C:\Program Files\Logitech\GamePanel Software\G-series Software\bak
C:\Program Files\Logitech\Gaming Software\bak
C:\Program Files\ScanSoft\OmniPageSE4.0\bak
C:\Program Files\Adobe\Reader 8.0\Reader\bak
C:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\bak
C:\Program Files\Creative\MediaSource5\Go\bak
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\bak
C:\Program Files\Java\jre1.6.0_03\bin\bak
C:\Program Files\Logitech\G-series Software\bak
C:\Program Files\Logitech\GamePanel Software\G-series Software\bak
C:\Program Files\Logitech\G-series Software\bak
C:\Program Files\Logitech\GamePanel Software\LCD Manager\bak
C:\WINDOWS\system32\spool\drivers\w32x86\3\bak
Next, close and click Yes to save the changes.
Once folders.txt is saved, FindAWF does the following:
-It deletes the contents of the bak folders
-Removes the bak folders
When done with the above, it automatically runs a new scan and opens a new log.
Please provide the new FindAWF log in your reply.
Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3
Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.
Report Offensive Follow Up For Removal
|
|
Response Number 9
|
Name: EDoggM
Date: March 14, 2008 at 18:39:01 Pacific
|
Reply: (edit)FindAWF Log:
Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully
The current date is: Fri 03/14/2008
The current time is: 6:29:52.84
bak folders found
~~~~~~~~~~~
Directory of C:\PROGRA~1\MESSEN~1\BAK
0 File(s) 0 bytes Directory of C:\WINDOWS\SYSTEM32\BAK 07/09/2001 03:50 AM 155,648 NeroCheck.exe
1 File(s) 155,648 bytes
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~
155648 Jul 9 2001 "C:\WINDOWS\system32\NeroCheck.exe"
155648 Jul 9 2001 "C:\WINDOWS\system32\bak\NeroCheck.exe"
end of report
Report Offensive Follow Up For Removal
|
|
Response Number 10
|
Name: EDoggM
Date: March 14, 2008 at 18:41:13 Pacific
|
Reply: (edit)ComboFix Log: ComboFix 08-03-14.4 - Eric 2008-03-14 6:33:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2978 [GMT -7:00]
Running from: C:\Documents and Settings\Eric\Desktop\ComboFix.exe
* Created a new restore point [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
. ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
. C:\Program Files\WinBudget
C:\Program Files\WinBudget\bin\matrix.dat
C:\Program Files\WinBudget\bin\matrix.dll
C:\WINDOWS\system32\uninstall.exe
E:\Autorun.inf .
((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
. 2008-03-13 09:03 . 2001-07-09 03:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-11 13:32 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-11 13:31 . 2008-03-11 13:31 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-11 13:01 . 2008-03-11 13:01 1,167 --a------ C:\WINDOWS\mozver.dat
2008-03-11 12:48 . 2008-03-11 12:59 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-11 12:48 . 2008-03-12 12:36 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-11 12:48 . 2005-04-15 19:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-03-11 12:48 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-03-11 12:48 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-11 12:34 . 2008-03-12 12:15 3,686 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-11 12:23 . 2008-03-11 12:23 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-11 12:07 . 2008-03-11 12:07 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-11 12:06 . 2008-03-11 12:06 4,659 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-10 09:07 . 2008-03-10 11:08 <DIR> d-------- C:\Program Files\eSoftware
2008-03-09 04:21 . 2008-03-13 09:18 64,900 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-13 09:18 54,524 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-13 09:18 54,524 --a------ C:\WINDOWS\system32\BMXState-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-13 09:18 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-03-09 04:21 . 2008-03-13 09:18 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-03-09 04:10 . 2000-05-11 02:00 90,112 --a------ C:\WINDOWS\UpdReg.EXE
2008-03-09 04:09 . 2006-08-17 11:59 87,403 --a------ C:\WINDOWS\system32\instwdm.ini
2008-03-09 04:09 . 2006-08-17 11:31 10,240 --a------ C:\WINDOWS\CTDCRES.DLL
2008-03-09 04:09 . 2005-02-07 17:45 3,128 --a------ C:\WINDOWS\system32\XFi.bmp
2008-03-09 04:09 . 2005-02-07 17:45 766 --a------ C:\WINDOWS\system32\SBXFi.ico
2008-03-09 04:09 . 2006-08-17 10:55 191 --a------ C:\WINDOWS\system32\ctzapxx.ini
2008-03-09 04:08 . 2006-05-03 10:07 29,705,938 --------- C:\WINDOWS\system32\28MBGM.sf2
2008-03-09 04:08 . 2000-12-13 03:21 7,572,224 --------- C:\WINDOWS\system32\CT8MGM.SF2
2008-03-09 04:08 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
2008-02-22 08:28 . 2008-02-22 08:28 8 --a------ C:\WINDOWS\system32\nvModes.dat .
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 13:29 --------- d-----w C:\Program Files\Windows Defender
2008-03-14 13:29 --------- d-----w C:\Program Files\WDC
2008-03-14 13:29 --------- d-----w C:\Program Files\Steam
2008-03-14 13:29 --------- d-----w C:\Program Files\REGSHAVE
2008-03-14 13:29 --------- d-----w C:\Program Files\QuickTime
2008-03-14 13:24 --------- d-----w C:\Documents and Settings\Eric\Application Data\OpenOffice.org2
2008-03-11 20:32 --------- d-----w C:\Program Files\Java
2008-03-09 11:27 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-09 11:27 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-09 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-09 11:19 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-03-09 11:19 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-09 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-03-09 11:07 --------- d-----w C:\Program Files\Creative
2008-03-09 09:13 --------- d-----w C:\Documents and Settings\Eric\Application Data\Creative
2008-03-03 16:15 --------- d-----w C:\Program Files\Common Files\Logitech
2008-03-03 16:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-03 16:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-12 20:20 --------- d-----w C:\Program Files\Stardock
2008-02-12 20:20 --------- d-----w C:\Program Files\Common Files\Stardock
2008-02-08 15:15 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-08 13:48 --------- d-----w C:\Program Files\Atari
2008-02-07 14:26 --------- d-----w C:\Program Files\Logitech
2008-02-07 14:20 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-02-07 14:20 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-02-07 14:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
2008-02-07 14:19 --------- d-----w C:\Program Files\Common Files\Logishrd
2008-02-07 14:17 --------- d-----w C:\Program Files\AMD
2008-02-03 15:25 --------- d-----w C:\Program Files\Futuremark
2008-02-03 13:10 --------- d-----w C:\Program Files\World of Warcraft
2008-02-03 13:01 --------- d-----w C:\Documents and Settings\Eric\Application Data\IrfanView
2008-01-31 01:38 --------- d-----w C:\Documents and Settings\Eric\Application Data\IDS_COMPANY
2008-01-30 05:51 --------- d-----w C:\Documents and Settings\Eric\Application Data\IGN_DLM
2008-01-30 04:51 --------- d-----w C:\Program Files\directx
2008-01-30 04:44 --------- d-----w C:\Program Files\Konami
2008-01-24 23:14 --------- d-----w C:\Program Files\Apple Software Update
2008-01-24 23:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-01-23 11:16 --------- d-----w C:\Program Files\FinePixViewer
2008-01-23 11:16 --------- d-----w C:\Program Files\DivX
2008-01-23 02:46 --------- d-----w C:\Documents and Settings\Eric\Application Data\Move Networks
2008-01-20 23:06 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-19 03:41 --------- d-----w C:\Documents and Settings\Eric\Application Data\NewSoft
2008-01-19 03:39 --------- d-----w C:\Documents and Settings\Eric\Application Data\Canon
2008-01-17 08:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-16 04:44 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-01-09 20:28 76,304 ----a-w C:\WINDOWS\system32\KemXML.dll
2008-01-09 20:28 141,840 ----a-w C:\WINDOWS\system32\KemUtil.dll
2008-01-09 20:28 117,264 ----a-w C:\WINDOWS\system32\KemWnd.dll
2008-01-09 20:27 170,512 ----a-w C:\WINDOWS\system32\kemutb.dll
2008-01-09 20:26 301,656 ----a-w C:\WINDOWS\system32\BtCoreIf.dll
2007-11-08 03:28 22,328 ----a-w C:\Documents and Settings\Eric\Application Data\PnkBstrK.sys
. ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D83A7B12-A4D4-4984-8F72-D41C6B4C1E6E}]
2008-03-10 09:07 282636 --a------ C:\Program Files\eSoftware\studio.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]
"SetDefaultMIDI"="MIDIDef.exe" [2006-08-17 11:10 25600 C:\WINDOWS\MIDIDEF.EXE] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 13:56 64512]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 03:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"SkyTel"="SkyTel.EXE" [2006-05-16 03:04 2879488 C:\WINDOWS\SkyTel.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 02:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 02:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 06:00 79224]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"WD Button Manager"="WDBtnMgr.exe" [2007-09-15 13:14 335872 C:\WINDOWS\system32\WDBtnMgr.exe]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 18:07 49152]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20 866584]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 02:41 81920]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-11-29 03:17 55824 C:\WINDOWS\KHALMNPR.Exe]
"Launch LCDMon"="C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-12-13 18:43 2051096]
"Launch LGDCore"="C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-12-13 18:57 2095640]
"Start WingMan Profiler"="C:\Program Files\Logitech\Gaming Software\LWEMon.exe" [2007-09-25 16:03 93208]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 14:11 122880]
"CTHelper"="CTHELPER.EXE" [2006-08-17 11:32 17920 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2006-08-17 11:32 18944 C:\WINDOWS\system32\CTXFIHLP.EXE]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112] C:\Documents and Settings\Eric\Start Menu\Programs\Startup\
OpenOffice.org 2.3.lnk - C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 23:57:56 393216] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Exif Launcher.lnk - C:\Program Files\FinePixViewer\QuickDCF.exe [2007-11-01 21:47:19 200704]
Extender Resource Monitor.lnk - C:\WINDOWS\ehome\RMSysTry.exe [2005-10-20 19:55:40 18432]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2008-02-07 07:19:33 789008] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
c:\program files\common files\logitech\bluetooth\LBTWlgn.dll 2008-01-09 13:30 72208 c:\Program Files\Common Files\Logitech\Bluetooth\LBTWLgn.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll 2001-12-21 00:34 24576 C:\Program Files\Stardock\Object Desktop\ThemeManager\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Steam\\Steam.exe"=
"C:\\Program Files\\Steam\\steamapps\\edoggm\\counter-strike source\\hl2.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
"C:\\Program Files\\Flagship Studios\\Hellgate London Demo\\Launcher.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"=
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6881:TCP"= 6881:TCP:Blizzard Downloader
"6882:TCP"= 6882:TCP:Blizzard Downloader
"6883:TCP"= 6883:TCP:Blizzard Downloader
"6884:TCP"= 6884:TCP:Blizzard Downloader
"6885:TCP"= 6885:TCP:Blizzard Downloader
"6886:TCP"= 6886:TCP:Blizzard Downloader
"6887:TCP"= 6887:TCP:Blizzard Downloader
"6888:TCP"= 6888:TCP:Blizzard Downloader
"6889:TCP"= 6889:TCP:Blizzard Downloader
"6890:TCP"= 6890:TCP:Blizzard Downloader
"6891:TCP"= 6891:TCP:Blizzard Downloader
"6892:TCP"= 6892:TCP:Blizzard Downloader
"6893:TCP"= 6893:TCP:Blizzard Downloader
"6894:TCP"= 6894:TCP:Blizzard Downloader
"6895:TCP"= 6895:TCP:Blizzard Downloader
"6896:TCP"= 6896:TCP:Blizzard Downloader
"6897:TCP"= 6897:TCP:Blizzard Downloader
"6898:TCP"= 6898:TCP:Blizzard Downloader
"6899:TCP"= 6899:TCP:Blizzard Downloader
"6900:TCP"= 6900:TCP:Blizzard Downloader
"6901:TCP"= 6901:TCP:Blizzard Downloader
"6902:TCP"= 6902:TCP:Blizzard Downloader
"6903:TCP"= 6903:TCP:Blizzard Downloader
"6904:TCP"= 6904:TCP:Blizzard Downloader
"6905:TCP"= 6905:TCP:Blizzard Downloader
"6906:TCP"= 6906:TCP:Blizzard Downloader
"6907:TCP"= 6907:TCP:Blizzard Downloader
"6908:TCP"= 6908:TCP:Blizzard Downloader
"6909:TCP"= 6909:TCP:Blizzard Downloader
"6910:TCP"= 6910:TCP:Blizzard Downloader
"6911:TCP"= 6911:TCP:Blizzard Downloader
"6912:TCP"= 6912:TCP:Blizzard Downloader
"6913:TCP"= 6913:TCP:Blizzard Downloader
"6914:TCP"= 6914:TCP:Blizzard Downloader
"6915:TCP"= 6915:TCP:Blizzard Downloader
"6916:TCP"= 6916:TCP:Blizzard Downloader
"6917:TCP"= 6917:TCP:Blizzard Downloader
"6918:TCP"= 6918:TCP:Blizzard Downloader
"6919:TCP"= 6919:TCP:Blizzard Downloader
"6920:TCP"= 6920:TCP:Blizzard Downloader
"6921:TCP"= 6921:TCP:Blizzard Downloader
"6922:TCP"= 6922:TCP:Blizzard Downloader
"6923:TCP"= 6923:TCP:Blizzard Downloader
"6924:TCP"= 6924:TCP:Blizzard Downloader
"6925:TCP"= 6925:TCP:Blizzard Downloader
"6926:TCP"= 6926:TCP:Blizzard Downloader
"6927:TCP"= 6927:TCP:Blizzard Downloader
"6928:TCP"= 6928:TCP:Blizzard Downloader
"6929:TCP"= 6929:TCP:Blizzard Downloader
"6930:TCP"= 6930:TCP:Blizzard Downloader
"6931:TCP"= 6931:TCP:Blizzard Downloader
"6932:TCP"= 6932:TCP:Blizzard Downloader
"6933:TCP"= 6933:TCP:Blizzard Downloader
"6934:TCP"= 6934:TCP:Blizzard Downloader
"6935:TCP"= 6935:TCP:Blizzard Downloader
"6937:TCP"= 6937:TCP:Blizzard Downloader
"6938:TCP"= 6938:TCP:Blizzard Downloader
"6939:TCP"= 6939:TCP:Blizzard Downloader
"6940:TCP"= 6940:TCP:Blizzard Downloader
"6941:TCP"= 6941:TCP:Blizzard Downloader
"6942:TCP"= 6942:TCP:Blizzard Downloader
"6943:TCP"= 6943:TCP:Blizzard Downloader
"6944:TCP"= 6944:TCP:Blizzard Downloader
"6945:TCP"= 6945:TCP:Blizzard Downloader
"6946:TCP"= 6946:TCP:Blizzard Downloader
"6947:TCP"= 6947:TCP:Blizzard Downloader
"6948:TCP"= 6948:TCP:Blizzard Downloader
"6949:TCP"= 6949:TCP:Blizzard Downloader
"6950:TCP"= 6950:TCP:Blizzard Downloader
"6951:TCP"= 6951:TCP:Blizzard Downloader
"6952:TCP"= 6952:TCP:Blizzard Downloader
"6953:TCP"= 6953:TCP:Blizzard Downloader
"6954:TCP"= 6954:TCP:Blizzard Downloader
"6955:TCP"= 6955:TCP:Blizzard Downloader
"6956:TCP"= 6956:TCP:Blizzard Downloader
"6957:TCP"= 6957:TCP:Blizzard Downloader
"6958:TCP"= 6958:TCP:Blizzard Downloader
"6959:TCP"= 6959:TCP:Blizzard Downloader
"6960:TCP"= 6960:TCP:Blizzard Downloader
"6961:TCP"= 6961:TCP:Blizzard Downloader
"6962:TCP"= 6962:TCP:Blizzard Downloaderf
"6963:TCP"= 6963:TCP:Blizzard Downloader
"6964:TCP"= 6964:TCP:Blizzard Downloader
"6965:TCP"= 6965:TCP:Blizzard Downloader
"6967:TCP"= 6967:TCP:Blizzard Downloader
"6968:TCP"= 6968:TCP:Blizzard Downloader
"6969:TCP"= 6969:TCP:Blizzard Downloader
"6970:TCP"= 6970:TCP:Blizzard Downloader
"6971:TCP"= 6971:TCP:Blizzard Downloader
"6972:TCP"= 6972:TCP:Blizzard Downloader
"6973:TCP"= 6973:TCP:Blizzard Downloader
"6974:TCP"= 6974:TCP:Blizzard Downloader
"6975:TCP"= 6975:TCP:Blizzard Downloader
"6976:TCP"= 6976:TCP:Blizzard Downloader
"6977:TCP"= 6977:TCP:Blizzard Downloader
"6978:TCP"= 6978:TCP:Blizzard Downloader
"6979:TCP"= 6979:TCP:Blizzard Downloader
"6980:TCP"= 6980:TCP:Blizzard Downloader
"6981:TCP"= 6981:TCP:Blizzard Downloader
"6982:TCP"= 6982:TCP:Blizzard Downloader
"6983:TCP"= 6983:TCP:Blizzard Downloader
"6984:TCP"= 6984:TCP:Blizzard Downloader
"6985:TCP"= 6985:TCP:Blizzard Downloader
"6986:TCP"= 6986:TCP:Blizzard Downloader
"6987:TCP"= 6987:TCP:Blizzard Downloader
"6988:TCP"= 6988:TCP:Blizzard Downloader
"6989:TCP"= 6989:TCP:Blizzard Downloader
"6990:TCP"= 6990:TCP:Blizzard Downloader
"6991:TCP"= 6991:TCP:Blizzard Downloader
"6992:TCP"= 6992:TCP:Blizzard Downloader
"6993:TCP"= 6993:TCP:Blizzard Downloader
"6994:TCP"= 6994:TCP:Blizzard Downloader
"6995:TCP"= 6995:TCP:Blizzard Downloader
"6996:TCP"= 6996:TCP:Blizzard Downloader
"6997:TCP"= 6997:TCP:Blizzard Downloader
"6998:TCP"= 6998:TCP:Blizzard Downloader
"6999:TCP"= 6999:TCP:Blizzard Downloader
"3776:UDP"= 3776:UDP:Media Center Extender Service
"3390:TCP"= 3390:TCP:Remote Media Center Experience R2 RMSvc;Media Center Extender Resource Monitor;C:\WINDOWS\ehome\RMSvc.exe [2005-10-20 19:55]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-08-17 11:16]
R3 inibtmgr;WD Bridge Controller Driver;C:\WINDOWS\system32\DRIVERS\inibtmgr.sys [2003-12-07 08:53]
S1 amdtools;AMD Special Tools Driver;C:\WINDOWS\system32\DRIVERS\amdtools.sys []
S3 gdrv;gdrv;C:\WINDOWS\gdrv.sys [2007-09-06 19:29]
S3 QWAVE;QWAVE service;C:\WINDOWS\system32\svchost.exe [2006-03-15 05:00]
S3 uisp;Motorola USB ICP driver;C:\WINDOWS\system32\Drivers\usbicp.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
QWAVE REG_MULTI_SZ QWAVE [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{46afe4f5-5d27-11dc-a442-806d6172696f}]
\Shell\AutoRun\command - D:\Run.exe .
Contents of the 'Scheduled Tasks' folder
"2008-02-19 15:07:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-03-14 13:25:55 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
************************************************************************** catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-14 06:33:52
Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully
hidden files: 0 **************************************************************************
.
Completion time: 2008-03-14 6:34:30
ComboFix-quarantined-files.txt 2008-03-14 13:34:23
.
2008-03-13 16:00:57 --- E O F ---
Report Offensive Follow Up For Removal
|
|
Response Number 11
|
Name: jabuck
Date: March 14, 2008 at 19:06:53 Pacific
|
Reply: (edit)Looks much better. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download CCleaner from the following link: http://filehippo.com/download_ccleaner/ After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items. Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Base
Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.
Report Offensive Follow Up For Removal
|
|
Response Number 12
|
Name: EDoggM
Date: March 14, 2008 at 21:22:14 Pacific
|
Reply: (edit)Kaspersky Log: ---------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, March 14, 2008 9:18:44 AM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 15/03/2008
Kaspersky Anti-Virus database records: 630642
--------------------- Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true Scan Target - My Computer:
A:\
C:\
D:\
E:\ Scan Statistics:
Total number of scanned objects: 100774
Number of viruses found: 1
Number of infected objects: 3
Number of suspicious objects: 0
Duration of the scan process: 01:07:40 Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\eHome\logs\ehRecvr.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Windows Defender\Support\MPLog-11122007-224759.log Object is locked skipped
C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp Object is locked skipped
C:\Documents and Settings\All Users\DRM\drmstore.hds Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\cert8.db Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\history.dat Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\key3.db Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\parent.lock Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\search.sqlite Object is locked skipped
C:\Documents and Settings\Eric\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\Eric\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\Eric\Desktop\SmitfraudFix\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Eric\Desktop\SmitfraudFix.zip/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\Eric\Desktop\SmitfraudFix.zip ZIP: infected - 1 skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Media Player\CurrentDatabase_360.wmdb Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Microsoft\Windows Defender\FileTracker\{65EDFD4D-031A-4705-AC0A-F10AB442DB62} Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Application Data\Mozilla\Firefox\Profiles\qsy01fea.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Eric\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\Eric\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\Eric\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\System Volume Information\_restore{B5634A46-964E-450B-9A80-35BD6A61C48A}\RP224\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{2B84B457-05DD-4282-B57A-A8EE0880C22E}.crmlog Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Media Ce.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_57c.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_c4.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
E:\System Volume Information\_restore{B5634A46-964E-450B-9A80-35BD6A61C48A}\RP224\change.log Object is locked skipped Scan process completed.
Report Offensive Follow Up For Removal
|
|
Response Number 13
|
Name: jabuck
Date: March 15, 2008 at 05:02:08 Pacific
|
Reply: (edit)Your log is clean. Go to start> run type in combofix /u (there must be a space after combofix). This will uninstall combofix. Go to start> control panel> add/remove programs and uninstall these programs if found:
Hijack This
Kaspersky
FindAWF
Smitfraudfix
Delete the FindAWF and Smitfraudfix icons on the desktop.
Navigate to and delete these folders if found:
C:\Programs Files\FindfAWF
C:\Program Files\Smitfraudfix
How is the computer operating?
Report Offensive Follow Up For Removal
|
|
Response Number 14
|
Name: EDoggM
Date: March 15, 2008 at 12:14:05 Pacific
|
Reply: (edit)I'm so happy the the log is clean! When I go to Start > Run and then type combofix /u , I get a pop-up error window saying "Windows cannot find 'combofix'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search. I'm currently having issues trying go to get to my Control Panel and Ad/Remove Programs. The first time I tried I was in Control Panel and after I double-clicked Ad/Remove Programs, nothing happened. Now each time I go to Start > Control Panel my screen blinks and my desktop disappears, Icons, Toolbar, except for my desktop picture, for a few seconds and comes back on again. I haven't really got a chance to use it, I mainly use this computer for Internet Browsing, which is probably one of my problems, and Online Gaming, like WoW and CoD4. When I discovered all of this, the niight before I was playing WoW and I normally have a very good Latency, average around 100ms, but the day before the Windows Malicious Software Removal Tool was installed my Latency jumped up to over 1000ms for the first time ever. I turned on Ad-Aware and started to Scan, all of a sudden my Latency dropped back down to the 100s. I was thinking I had a Virus, then Windows Malicious Software Removal Tool confirmed it. Also my Latency for CoD4 was starting to gradually get worse too. I will try out my computer today and I'll let you know. Thank you so much, you've been extremely helpful. This is a great site, I've recommended this place to everyone I know.
Report Offensive Follow Up For Removal
|
|
Response Number 15
|
Name: EDoggM
Date: March 15, 2008 at 12:23:40 Pacific
|
Reply: (edit)Wow, ok I can't click on anything from the Start Panel when I try to go to My Computer, My Documents, Search, etc. However I can click on the most recent programs that I've been too. My desktop will not let me open Folders, it'll do the same blinking, but it will let me open programs. I went around this and started up IE and went to my C drive. There was an option on the left under System Tasks that let me go to Add or Remove Programs and I'm doing that as I type on my other computer (laptop). FindAWF & SmitFraudFix do not show up on my Add or Remove Programs list, but I will go ahead and delete them from my Program Files and or Desktop. Did you still want me to keep CCleaner on here? I'm still not able to remove ComboFix.
Report Offensive Follow Up For Removal
|
|
Response Number 16
|
Name: jabuck
Date: March 15, 2008 at 15:00:45 Pacific
|
Reply: (edit)Restart the computer. Navigate to and delete these files if found: C:\Documents and Settings\Eric\Desktop\combofix.exe
Navigate to and delete these folders if found:
C:\Qoobox
C:\Documents and Settings\Eric\Desktop\SmitfraudFix
Restsrt the computer again and let us known how it is operating and if the programs were removed.
Report Offensive Follow Up For Removal
|
|
Response Number 17
|
Name: EDoggM
Date: March 15, 2008 at 18:02:55 Pacific
|
Reply: (edit)I deleted: C:\Documents and Settings\Eric\Desktop\combofix.exe
C:\Qoobox FindAWF and SmitFraudFix no longer show up on my computer as well In the C drive there was a Empty Folder and a Notepad named ComboFix and deleted those too but I'm still getting the issue with the Start > Control Panel, My Computer, My Documents etc. It seems that trying to execute any type of Folder to open gets that same issue. The screen will blink, the Toolbar and Desktop Icons will disappear, but whatever window I do have open will stay open, and then my Toolbar and Desktop Icons will reappear.
Report Offensive Follow Up For Removal
|
|
Response Number 18
|
Name: jabuck
Date: March 15, 2008 at 20:34:31 Pacific
|
Reply: (edit)Download SDFix to your desktop from the following link: SDFix.exe. Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix) Please then reboot your computer in Safe Mode by doing the following :
Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, the Advanced Options Menu should appear;
Select the first option, to run Windows in Safe Mode, then press Enter.
Choose your usual account.
Open the extracted SDFix folder and double click RunThis.bat to start the script.
Type Y to begin the cleanup process.
It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
(Report.txt will also be copied to Clipboard ready for posting back on the forum).
Finally paste the contents of the Report.txt. Post a new Hijack This log and a new Combofix log please.
Report Offensive Follow Up For Removal
|
|
Response Number 19
|
Name: EDoggM
Date: March 15, 2008 at 21:54:00 Pacific
|
Reply: (edit)SDFix Log: [b]SDFix: Version 1.157 [/b] Run by Eric on Sat 03/15/2008 at 09:42 AM Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix [b]Checking Services [/b]:
Restoring Windows Registry Values
Restoring Windows Default Hosts File
Rebooting
[b]Checking Files [/b]:
No Trojan Files Found
Removing Temp Files
[b]ADS Check [/b]:
[b]Final Check [/b]:
catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-15 09:45:13
Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... C:\WINDOWS\Temp\TMP0000001D6AE020D8417E22DC scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1
[b]Remaining Services [/b]:
Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Steam\\Steam.exe"="C:\\Program Files\\Steam\\Steam.exe:*:Enabled:Steam Client"
"C:\\Program Files\\Steam\\steamapps\\edoggm\\counter-strike source\\hl2.exe"="C:\\Program Files\\Steam\\steamapps\\edoggm\\counter-strike source\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"="C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe:*:Enabled:CoD2MP_s"
"C:\\Program Files\\Sierra\\FEAR\\FEAR.exe"="C:\\Program Files\\Sierra\\FEAR\\FEAR.exe:*:Enabled:FEAR"
"C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"="C:\\Program Files\\Sierra\\FEAR\\FEARMP.exe:*:Enabled:FEARMP"
"C:\\WINDOWS\\ehome\\ehshell.exe"="C:\\WINDOWS\\ehome\\ehshell.exe:LocalSubNet:Enabled:Media Center"
"C:\\Program Files\\Flagship Studios\\Hellgate London Demo\\Launcher.exe"="C:\\Program Files\\Flagship Studios\\Hellgate London Demo\\Launcher.exe:*:Enabled:Hellgate: London"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe"="C:\\Program Files\\Electronic Arts\\Battlefield 2142\\BF2142.exe:*:Enabled:Battlefield 2"
"C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"="C:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) "
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"="C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main"
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"="C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD"
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"="C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater"
"C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"="C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]:
File Backups: - C:\SDFix\backups\backups.zip
[b]Files with Hidden Attributes [/b]: Mon 8 Oct 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 8 Sep 2006 304,704 A..H. --- "C:\Program Files\Canon\CanoScan Toolbox Ver5.0\Maint.exe"
Mon 19 Dec 2005 61,440 A..H. --- "C:\Program Files\Canon\CanoScan Toolbox Ver5.0\uinstrsc.dll"
Sat 8 Sep 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Fri 8 Feb 2008 3,278 ...HR --- "C:\Documents and Settings\Eric\Application Data\SecuROM\UserData\securom_v7_01.bak"
Fri 18 Jan 2008 4,371 ..SH. --- "C:\Documents and Settings\Eric\Local Settings\Application Data\NewSoft\PageManager\7.15.14A\Setting\PM65.BAK" [b]Finished![/b]
Report Offensive Follow Up For Removal
|
|
Response Number 20
|
Name: EDoggM
Date: March 15, 2008 at 21:55:05 Pacific
|
Reply: (edit)HijackThis Log: Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:49:17 AM, on 3/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\WDBtnMgr.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Logitech\Gaming Software\LWEMon.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: IE - {D83A7B12-A4D4-4984-8F72-D41C6B4C1E6E} - C:\Program Files\eSoftware\studio.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [WD Button Manager] WDBtnMgr.exe
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe /noui
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/1503...
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupd...
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logitech\Bluetooth\LBTServ.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Retrospect WD Service (RetroWDSvc) - Dantz Development Corporation - C:\PROGRA~1\Dantz\RETROS~1\wdsvc.exe --
End of file - 7918 bytes
Report Offensive Follow Up For Removal
|
|
Response Number 21
|
Name: EDoggM
Date: March 15, 2008 at 21:55:42 Pacific
|
Reply: (edit)ComboFix Log: ComboFix 08-03-14.4 - Eric 2008-03-15 9:52:01.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3012 [GMT -7:00]
Running from: C:\Documents and Settings\Eric\Desktop\ComboFix.exe [color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
. ((((((((((((((((((((((((( Files Created from 2008-02-15 to 2008-03-15 )))))))))))))))))))))))))))))))
. 2008-03-15 09:41 . 2008-03-15 09:41 <DIR> d-------- C:\WINDOWS\ERUNT
2008-03-15 09:40 . 2008-03-15 09:47 <DIR> d-------- C:\SDFix
2008-03-14 07:35 . 2008-03-14 07:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-03-14 07:25 . 2008-03-14 07:25 <DIR> d-------- C:\Program Files\Yahoo!
2008-03-14 07:25 . 2008-03-14 07:25 <DIR> d-------- C:\Program Files\CCleaner
2008-03-13 09:03 . 2001-07-09 03:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-03-11 13:32 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-03-11 13:31 . 2008-03-11 13:31 <DIR> d-------- C:\Program Files\Common Files\Java
2008-03-11 13:01 . 2008-03-11 13:01 1,167 --a------ C:\WINDOWS\mozver.dat
2008-03-11 12:48 . 2008-03-11 12:59 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-03-11 12:48 . 2008-03-15 07:49 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-11 12:48 . 2005-04-15 19:58 1,071,088 --a------ C:\WINDOWS\system32\MSCOMCTL.OCX
2008-03-11 12:48 . 2005-08-25 18:18 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2008-03-11 12:48 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2008-03-11 12:34 . 2008-03-12 12:15 3,686 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-11 12:23 . 2008-03-11 12:23 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-11 12:07 . 2008-03-11 12:07 0 --a------ C:\WINDOWS\nsreg.dat
2008-03-11 12:06 . 2008-03-11 12:06 4,659 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-10 09:07 . 2008-03-10 11:08 <DIR> d-------- C:\Program Files\eSoftware
2008-03-09 04:21 . 2008-03-15 09:37 64,900 --a------ C:\WINDOWS\system32\DVCState-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-15 09:37 54,524 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-15 09:37 54,524 --a------ C:\WINDOWS\system32\BMXState-{00000001-00000000-00000008-00001102-00000005-00311102}.rfx
2008-03-09 04:21 . 2008-03-15 09:37 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
2008-03-09 04:21 . 2008-03-15 09:37 1,080 --a------ C:\WINDOWS\system32\settings.sfm
2008-03-09 04:10 . 2000-05-11 02:00 90,112 --a------ C:\WINDOWS\UpdReg.EXE
2008-03-09 04:09 . 2006-08-17 11:59 87,403 --a------ C:\WINDOWS\system32\instwdm.ini
2008-03-09 04:09 . 2006-08-17 11:31 10,240 --a------ C:\WINDOWS\CTDCRES.DLL
2008-03-09 04:09 . 2005-02-07 17:45 3,128 --a------ C:\WINDOWS\system32\XFi.bmp
2008-03-09 04:09 . 2005-02-07 17:45 766 --a------ C:\WINDOWS\system32\SBXFi.ico
2008-03-09 04:09 . 2006-08-17 10:55 191 --a------ C:\WINDOWS\system32\ctzapxx.ini
2008-03-09 04:08 . 2006-05-03 10:07 29,705,938 --------- C:\WINDOWS\system32\28MBGM.sf2
2008-03-09 04:08 . 2000-12-13 03:21 7,572,224 --------- C:\WINDOWS\system32\CT8MGM.SF2
2008-03-09 04:08 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
2008-02-22 08:28 . 2008-02-22 08:28 8 --a------ C:\WINDOWS\system32\nvModes.dat .
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-15 16:47 --------- d-----w C:\Documents and Settings\Eric\Application Data\OpenOffice.org2
2008-03-15 07:45 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-15 07:45 107,832 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
2008-03-14 13:29 --------- d-----w C:\Program Files\Windows Defender
2008-03-14 13:29 --------- d-----w C:\Program Files\WDC
2008-03-14 13:29 --------- d-----w C:\Program Files\Steam
2008-03-14 13:29 --------- d-----w C:\Program Files\REGSHAVE
2008-03-14 13:29 --------- d-----w C:\Program Files\QuickTime
2008-03-11 20:32 --------- d-----w C:\Program Files\Java
2008-03-09 11:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-09 11:19 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-03-09 11:19 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-03-09 11:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-03-09 11:07 --------- d-----w C:\Program Files\Creative
2008-03-09 09:13 --------- d-----w C:\Documents and Settings\Eric\Application Data\Creative
2008-03-03 16:15 --------- d-----w C:\Program Files\Common Files\Logitech
2008-03-03 16:10 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-03 16:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
2008-02-12 20:20 --------- d-----w C:\Program Files\Stardock
2008-02-12 20:20 --------- d-----w C:\Program Files\Common Files\Sta
| |
