cant get rid of virus

Dell / NOT SURE
January 22, 2009 at 17:15:31
Specs: Windows XP, celeron 256mb
i cant get rid of this virus it says it is write protected. already tried to run virus scan. it stopped the scan once. it is messing with computer. restarts the computer on its own and changed the way i log on to the computer. the files that say they are write protected are under the name of ddingxxx.pad , paddingx , and some others... it says the file is 203GB but the drive it is on is only 20GB ????

See More: cant get rid of virus

Report •


#1
January 22, 2009 at 17:18:36
Please download Malwarebytes' Anti-Malware from one of these sites:

MalwareBytes1

MalwareBytes2

Rename the setup file, mbam-setup.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename mbam-setup.exe to tool.exe> click save.

1. Double Click tool.exe to install the application.
2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
3. If an update is found, it will download and install the latest version.
4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.
5. When the scan is complete, click OK, then Show Results to view the results.
6. Make sure that everything found is checked, and click Remove Selected.
7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
9. Copy&Paste the entire report in your next reply.


Please download and install the latest version of HijackThis v2.0.2:


Download the "HijackThis" Installer from this link:
Hijack This

Rename the setup file, HJTInstall.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename HJTInstall.exe to tools.exe> click save.
1. Save " tools.exe" to your desktop.
2. Double click on tools.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.


Report •

#2
January 22, 2009 at 17:51:38
the download box don't give me the option to change the name

Report •

#3
January 22, 2009 at 18:21:47
Try downloading it without changing it's name, it may run without the name change. What browser are you using, IE6,IE7,Mozilla Fire Fox, Opra...?

Report •

Related Solutions

#4
January 22, 2009 at 18:28:13
yeah it ran without the name change. i am running fire fox

Report •

#5
January 22, 2009 at 18:33:42
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:32:17 PM, on 1/22/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\Explorer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\default\Desktop\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://verizon.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://red.clientapps.yahoo.com/cus...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cus...
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cus...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R3 - URLSearchHook: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - (no file)
O3 - Toolbar: (no name) - {4E7BD74F-2B8D-469E-D0FC-E57AF4D5FA7D} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\YAHOO!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKUS\S-1-5-19\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User '?')
O4 - HKUS\S-1-5-20\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User '?')
O4 - HKUS\S-1-5-18\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe" (User 'Default user')
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O8 - Extra context menu item: &Define - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O8 - Extra context menu item: &Search - ?p=ZKfox000
O8 - Extra context menu item: Look Up in &Encyclopedia - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra 'Tools' menuitem: Encarta Encyclopedia - {2FDEF853-0759-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Verizon Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\COMMON\yiesrvc.dll
O9 - Extra button: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra 'Tools' menuitem: Define - {5DA9DE80-097A-11D4-A92E-006097DBED37} - C:\Program Files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)
O9 - Extra button: ICQ 4 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\SYSTEM32\SHDOCVW.DLL
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe (file missing)
O9 - Extra button: Dell Home - {08DCFC6C-B6E4-480C-95A4-FC64F37B787E} - http://business.dellnet.com/ (file missing) (HKCU)
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.musicmatch.com
O15 - Trusted Zone: *.musicmatch.com (HKLM)
O16 - DPF: Mah Jong Garden by pogo - http://mahjong2.pogo.com/applet-5.8...
O16 - DPF: Phlinx by pogo - http://flinger.pogo.com/applet-5.9....
O16 - DPF: Squelchies by pogo - http://squelchies.pogo.com/applet-5...
O16 - DPF: Texas Hold'em Poker by pogo - http://holdem2.pogo.com/applet-5.9....
O16 - DPF: Tri-Peaks by pogo - http://peaks.pogo.com/applet-5.8.6....
O16 - DPF: World Class Solitaire by pogo - http://klondike.pogo.com/applet-5.9...
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6A060448-60F9-11D5-A6CD-0002B31F7455} (ExentInf Class) -
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/sh...
O16 - DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3} (WildTangent Control) -
O16 - DPF: {FFB3A759-98B1-446F-BDA9-909C6EB18CC7} (PCPitstop Exam) - http://utilities.pcpitstop.com/Opti...
O17 - HKLM\System\CCS\Services\Tcpip\..\{B159EEEA-4D6C-42ED-BA18-059CCA9CED0A}: Domain = cavtel.net
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll,mss.dll
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DvpApi (dvpapi) - Authentium, Inc. - C:\Program Files\Common Files\Authentium\AntiVirus\dvpapi.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Radialpoint Unicorn Update Service (RPSUpdaterR) - Radialpoint Inc. - C:\Program Files\Verizon\PC Security Checkup\rpsupdaterR.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe

--
End of file - 10451 bytes


Report •

#6
January 22, 2009 at 18:39:29
malware says access denied when i try to open the log file

Report •

#7
January 22, 2009 at 19:05:15
Your java is out of date and may have been exploited.
Download the latest version of java from this link Java
Click on the JRE 6 Update 11 download button.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
Then from your desktop double-click on jre-6u11-windows-i586-p.exe to install the newest version.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, and any antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#8
January 22, 2009 at 19:54:53
combofix wont run keeps comming up with a terminal error c:/windows/regedit.exe missing

Report •

#9
January 22, 2009 at 20:00:05
Go to start> run> type in combofix /u (note the space after combofix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

download it again as you did previously and try to run it.


Report •

#10
January 22, 2009 at 20:12:07
keep getting same message

Report •

#11
January 22, 2009 at 20:49:46
Maybe you have a copy of regedit in the dllcache

Set up the computer to view hidden files:
To show hidden files do the following:
Click Start > My Computer
On the Tools menu, click Folder Options.
Click the View tab.
Uncheck Hide file extensions for known file types.
Uncheck Hide protected operating system files.
Under the Hidden files folder, locate and check Show hidden files and folders.
If you see a warning message, click Yes.
Click Apply > OK.

Navigate to C:\Windows\System32\dllcache

Next open the folder> right click the regedit.exe file> click copy.

Next navigate to C:\Windows then right click a black space on the screen> click paste.

Try installing Combofix again.


Report •

#12
January 22, 2009 at 21:32:52
ComboFix 09-01-21.04 - default 2009-01-23 0:09:36.1 - [color=red][b]FAT32[/b][/color]x86
Running from: c:\documents and settings\default\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\a.bat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\default\Application Data\FunWebProducts
c:\documents and settings\default\err.log
c:\documents and settings\default\ResErrors.log
C:\Redemption.ECF
c:\windows\Pt.dll
c:\windows\start.exe
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekafwlvaanq.sys
c:\windows\system32\senekadgedayyd.dll
c:\windows\system32\senekadlykklau.dat
c:\windows\system32\senekanebuxdcn.dll
c:\windows\system32\senekaosnxoqlx.dat
c:\windows\system32\senekapop.dll
c:\windows\system32\windows.scr
c:\windows\Web\default.htt

----- BITS: Possible infected sites -----

hxxp://updateserver.info
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA
-------\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2008-12-23 to 2009-01-23 )))))))))))))))))))))))))))))))
.

2009-01-23 00:12 . 2009-01-23 00:12 1,392 --a------ c:\windows\SYSTEM32\senekagusalmqo.dat
2009-01-22 22:34 . 2009-01-22 22:34 410,984 --a------ c:\windows\SYSTEM32\deploytk.dll
2009-01-22 22:34 . 2009-01-22 22:34 73,728 --a------ c:\windows\SYSTEM32\javacpl.cpl
2009-01-22 22:22 . 2009-01-22 22:22 <DIR> d-------- c:\documents and settings\default\.SunDownloadManager
2009-01-22 21:16 . 2009-01-22 21:16 <DIR> d-------- c:\windows\inf
2009-01-22 20:56 . 2009-01-22 20:56 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-22 20:56 . 2009-01-22 20:56 <DIR> d-------- c:\documents and settings\default\Application Data\Malwarebytes
2009-01-22 20:56 . 2009-01-22 20:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-22 20:56 . 2009-01-14 16:11 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys
2009-01-22 20:56 . 2009-01-14 16:11 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys
2009-01-21 19:36 . 2009-01-21 19:36 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-01-21 19:36 . 2009-01-21 19:36 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-01-21 19:36 . 2009-01-21 19:36 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-01-21 19:00 . 2009-01-21 19:00 <DIR> d-------- c:\documents and settings\default\Application Data\Template
2009-01-21 14:04 . 2009-01-21 14:04 <DIR> d-------- c:\documents and settings\default\Application Data\{FF2E8277-4038-4B68-AF81-5B48C9A7D968}
2009-01-21 13:51 . 2009-01-21 13:52 43,008 --a------ c:\windows\SYSTEM32\chert9-303359.exe
2009-01-20 17:25 . 2009-01-20 17:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\FLEXnet
2009-01-20 16:45 . 2009-01-20 16:45 <DIR> d-------- c:\program files\Adobe Media Player
2009-01-20 16:37 . 2009-01-20 16:37 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2009-01-20 00:52 . 2009-01-20 00:52 0 --a------ c:\windows\SYSTEM32\DRIVERS\senekahqjbypto.sys
2009-01-19 20:40 . 2009-01-19 20:40 <DIR> d-------- c:\program files\Xilisoft
2009-01-19 20:39 . 2009-01-19 20:39 2 --a------ C:\131074573
2009-01-19 14:45 . 2009-01-19 14:45 <DIR> d-------- c:\documents and settings\default\Application Data\Publish Providers
2009-01-19 14:43 . 2009-01-19 14:43 <DIR> d-------- c:\documents and settings\default\Application Data\Sony
2009-01-19 14:21 . 2009-01-19 14:21 <DIR> d-------- c:\documents and settings\default\Application Data\Sony Setup
2009-01-19 14:20 . 2009-01-19 14:20 <DIR> d-------- c:\program files\Sony Setup
2009-01-19 14:15 . 2009-01-19 14:15 <DIR> d-------- c:\documents and settings\default\Application Data\Vso
2009-01-19 14:15 . 2009-01-19 14:15 81,920 --a------ c:\documents and settings\default\Application Data\ezpinst.exe
2009-01-19 14:15 . 2009-01-19 14:15 47,360 --a------ c:\windows\SYSTEM32\DRIVERS\pcouffin.sys
2009-01-19 14:15 . 2009-01-19 14:15 47,360 --a------ c:\documents and settings\default\Application Data\pcouffin.sys
2009-01-09 22:34 . 2009-01-09 22:34 <DIR> d-------- c:\program files\Google

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-20 22:27 91,200 ----a-w c:\documents and settings\default\Application Data\GDIPFONTCACHEV1.DAT
2008-12-21 00:18 --------- d-----w c:\program files\uTorrent
2008-12-21 00:18 --------- d-----w c:\documents and settings\default\Application Data\uTorrent
2008-12-19 04:04 --------- d-----w c:\documents and settings\All Users\Application Data\GRETECH
2008-12-19 04:03 --------- d-----w c:\documents and settings\default\Application Data\GRETECH
2008-12-19 04:02 --------- d-----w c:\program files\GRETECH
2008-12-19 03:30 --------- d-----w c:\documents and settings\default\Application Data\AVS4YOU
2008-12-19 03:28 --------- d-----w c:\documents and settings\All Users\Application Data\AVS4YOU
2008-12-19 03:23 --------- d-----w c:\program files\Common Files\AVSMedia
2008-12-19 03:23 --------- d-----w c:\program files\AVS4YOU
2008-12-19 03:10 --------- d-----w c:\program files\XviD
2008-12-19 02:56 798,720 ----a-w c:\windows\iun6002.exe
2008-12-18 03:28 2,318,976 ----a-w c:\windows\SYSTEM32\TUKernel.exe
2008-12-14 17:55 603,904 ----a-w c:\windows\SYSTEM32\TUProgSt.exe
2008-12-14 17:55 360,192 ----a-w c:\windows\SYSTEM32\TuneUpDefragService.exe
2008-12-14 17:54 --------- d-----w c:\documents and settings\default\Application Data\TuneUp Software
2008-12-14 17:52 --------- d-----w c:\program files\TuneUp Utilities 2009
2008-12-14 17:52 --------- d-----w c:\documents and settings\All Users\Application Data\TuneUp Software
2008-12-14 17:50 --------- d-sh--w c:\documents and settings\All Users\Application Data\{55A29068-F2CE-456C-9148-C869879E2357}
2008-12-11 18:31 27,904 ----a-w c:\windows\SYSTEM32\uxtuneup.dll
2007-03-21 13:56 774,144 ----a-w c:\program files\RngInterstitial.dll
2006-10-26 19:46 836 ----a-w c:\documents and settings\default\Application Data\ViewerApp.dat
2006-07-18 01:30 75 ----a-w c:\documents and settings\default\Application Data\fusioncache.dat
2000-10-13 21:56 271 --sh--w c:\program files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-11-28 1261336]
"Microsoft Works Portfolio"="c:\program files\Microsoft Works\WksSb.exe" [2000-08-10 372790]
"YBrowser"="c:\progra~1\YAHOO!\browser\ybrwicon.exe" [2006-07-21 192000]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-09-03 185896]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-22 136600]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2000-07-19 176183]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-11-14 11376640]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"EditLevel"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JDCT"= jl_jdct.drv
"msacm.divxa32"= msaud32_divx.acm

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe"
"Exetender"="c:\program files\Verizon Games on Demand Player\GPlayer.exe" /runonstartup
"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"Verizon_McciTrayApp"=c:\program files\Verizon\McciTrayApp.exe
"VerizonServicepoint.exe"=c:\program files\Verizon\Servicepoint\VerizonServicepoint.exe
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
"WorksFUD"=c:\program files\Microsoft Works\wkfud.exe
"EnsoniqMixer"=starter.exe
"SMSERIAL"=sm56hlpr.exe
"POINTER"=point32.exe
"LoadQM"=loadqm.exe
"RealTray"=c:\program files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
"WildTangent CDA"=RUNDLL32.exe c:\progra~1\WILDTA~1\APPS\CDA\CDAENG~1.DLL,cdaEngineMain
"VSOCheckTask"="c:\progra~1\MCAFEE.COM\VSO\MCMNHDLR.EXE" /checktask
"VirusScan Online"="c:\progra~1\MCAFEE.COM\VSO\mcvsshld.exe"
"MCAgentExe"=c:\progra~1\MCAFEE.COM\AGENT\mcagent.exe
"MCUpdateExe"=c:\progra~1\MCAFEE.COM\AGENT\MCUPDATE.EXE
"ICQ Lite"=c:\program files\ICQLite\ICQLite.exe -minimize
"AVG7_CC"=c:\progra~1\GRISOFT\AVGFRE~1\AVGCC.EXE /STARTUP
"AVG7_EMC"=c:\progra~1\GRISOFT\AVGFRE~1\AVGEMC.EXE
"AVG7_AMSVR"=c:\progra~1\GRISOFT\AVGFRE~1\AVGAMSVR.EXE
"HostManager"=c:\program files\Common Files\AOL\1144794860\ee\AOLHostManager.exe
"cevoiexa"=c:\windows\SYSTEM32\AKGJIKNE.EXE
"ViewMgr"=c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
"WeatherOnTray"=c:\program files\SPAMBLOCKERUTILITY\BIN\4.8.0.0\SBWEATHERONTRAY.EXE
"SpamBlocker"=c:\program files\SpamBlockerUtility\Bin\4.8.0.0\SbOEAddOn.exe
"Spam Blocker for Outlook Express"=c:\progra~1\SPAMBL~1\BIN\480~1.0\SBInst.exe
"MotiveMonitor"=c:\program files\Motive\motmon.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\GlobalSCAPE\\CuteFTP\\cutftp32.exe"=
"c:\\Documents and Settings\\All Users\\Desktop\\PROGRAMS\\Qwix101\\Qwix.exe"=
"c:\\WINDOWS\\System32\\mmc.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4

R3 hamachi_oem;PlayLinc Adapter;c:\windows\system32\DRIVERS\gan_adapter.sys [2006-10-19 10664]
R3 Radialpoint Security Services;Radialpoint Security Services;c:\windows\system32\dllhost.exe [2004-08-04 5120]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2008-08-29 97928]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704]
S2 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2008-08-24 76040]
S2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\System32\TUProgSt.exe [2008-12-14 603904]


--- Other Services/Drivers In Memory ---

*Deregistered* - AFD
*Deregistered* - ALG
*Deregistered* - AudioSrv
*Deregistered* - audstub
*Deregistered* - avg8emc
*Deregistered* - avg8wd
*Deregistered* - AvgLdx86
*Deregistered* - AvgMfx86
*Deregistered* - AvgTdiX
*Deregistered* - Beep
*Deregistered* - Browser
*Deregistered* - CdaD10BA
*Deregistered* - Cdfs
*Deregistered* - CryptSvc
*Deregistered* - CSS DVP
*Deregistered* - DcomLaunch
*Deregistered* - Dhcp
*Deregistered* - dmio
*Deregistered* - dmload
*Deregistered* - dmserver
*Deregistered* - Dnscache
*Deregistered* - dvpapi
*Deregistered* - ERSvc
*Deregistered* - EventSystem
*Deregistered* - Fastfat
*Deregistered* - FastUserSwitchingCompatibility
*Deregistered* - Fips
*Deregistered* - FltMgr
*Deregistered* - Ftdisk
*Deregistered* - Gpc
*Deregistered* - helpsvc
*Deregistered* - ImapiService
*Deregistered* - IpNat
*Deregistered* - IPSec
*Deregistered* - JavaQuickStarterService
*Deregistered* - KSecDD
*Deregistered* - lanmanserver
*Deregistered* - lanmanworkstation
*Deregistered* - LmHosts
*Deregistered* - mnmdd
*Deregistered* - MountMgr
*Deregistered* - MRxSmb
*Deregistered* - Msfs
*Deregistered* - mssmbios
*Deregistered* - Mup
*Deregistered* - NDIS
*Deregistered* - NdisTapi
*Deregistered* - Ndisuio
*Deregistered* - NdisWan
*Deregistered* - NDProxy
*Deregistered* - NetBIOS
*Deregistered* - NetBT
*Deregistered* - Netman
*Deregistered* - Nla
*Deregistered* - Npfs
*Deregistered* - Ntfs
*Deregistered* - Null
*Deregistered* - PartMgr
*Deregistered* - ParVdm
*Deregistered* - pcouffin
*Deregistered* - PptpMiniport
*Deregistered* - ProtectedStorage
*Deregistered* - RasAcd
*Deregistered* - Rasl2tp
*Deregistered* - RasMan
*Deregistered* - RasPppoe
*Deregistered* - Raspti
*Deregistered* - Rdbss
*Deregistered* - RDPCDD
*Deregistered* - rdpdr
*Deregistered* - RpcSs
*Deregistered* - SamSs
*Deregistered* - Schedule
*Deregistered* - SENS
*Deregistered* - SharedAccess
*Deregistered* - ShellHWDetection
*Deregistered* - Spooler
*Deregistered* - sr
*Deregistered* - srservice
*Deregistered* - Srv
*Deregistered* - stisvc
*Deregistered* - swenum
*Deregistered* - TapiSrv
*Deregistered* - Tcpip
*Deregistered* - TermDD
*Deregistered* - TermService
*Deregistered* - Themes
*Deregistered* - TrkWks
*Deregistered* - TuneUp.ProgramStatisticsSvc
*Deregistered* - Update
*Deregistered* - UxTuneUp
*Deregistered* - VgaSave
*Deregistered* - VolSnap
*Deregistered* - W32Time
*Deregistered* - Wanarp
*Deregistered* - winmgmt
*Deregistered* - wuauserv
*Deregistered* - WZCSVC

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\^RNA]
rundll rnasetup.dll,installoptionalcomponent rna

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"c:\progra~1\OUTLOO~1\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
c:\windows\SYSTEM32\UPDCRL.EXE -e -u c:\windows\SYSTEM\verisignpub1.crl
.
Contents of the 'Scheduled Tasks' folder

2008-12-18 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\SYMANTEC\LIVEUPDATE\NDETECT.EXE [2000-08-15 20:52]

2009-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2009-01-23 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2009\OneClickStarter.exe [2008-12-11 21:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://verizon.yahoo.com
mWindow Title = Microsoft Internet Explorer provided by Comcast
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/verizon/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = iexplore
uSearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/verizon/*http://www.yahoo.com
IE: &AIM Search
IE: &Define - c:\program files\Common Files\Microsoft Shared\Reference 2001\A\ERS_DEF.HTM
IE: &ICQ Toolbar Search
IE: &Search - ?p=ZKfox000
IE: Look Up in &Encyclopedia - c:\program files\Common Files\Microsoft Shared\Reference 2001\A\ERS_ENC.HTM
IE: {{4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\Paltalk Messenger\Paltalk.exe
Trusted Zone: musicmatch.com
Trusted Zone: musicmatch.com
DPF: DirectAnimation Java Classes
DPF: Mah Jong Garden by pogo - hxxp://mahjong2.pogo.com/applet-5.8.6.20/mahjong/mahjong-ob-assets.cab
DPF: Microsoft XML Parser for Java
DPF: Phlinx by pogo - hxxp://flinger.pogo.com/applet-5.9.0.18/flinger/flinger-ob-assets.cab
DPF: Squelchies by pogo - hxxp://squelchies.pogo.com/applet-5.8.6.20/squelchies/squelchies-ob-assets.cab
DPF: Texas Hold'em Poker by pogo - hxxp://holdem2.pogo.com/applet-5.9.3.38/holdem/holdem-ob-assets.cab
DPF: Tri-Peaks by pogo - hxxp://peaks.pogo.com/applet-5.8.6.20/peaks/peaks-ob-assets.cab
DPF: World Class Solitaire by pogo - hxxp://klondike.pogo.com/applet-5.9.1.28/worldclass/worldclass-ob-assets.cab
DPF: {FA13A9FA-CA9B-11D2-9780-00104B242EA3}
FF - ProfilePath - c:\documents and settings\default\Application Data\Mozilla\Firefox\Profiles\a54td9y7.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
FF - user.js: browser.blink_allowed - false
.
.
------- File Associations -------
.
txtfile=%windir%\NOTEPAD.EXE %1
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-23 00:20:07
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
r Running Proce
.
c:\program files\Common Files\Authentium\AntiVirus\dvpapi.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\YAHOO!\browser\ycommon.exe
.
**************************************************************************
.
Completion time: 2009-01-23 0:25:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-23 05:25:12

Pre-Run: 10,399,416,320 bytes free
Post-Run: 10,938,073,088 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default = multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS ="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /TUTag=WAPMXD /Kernel=TUKernel.exe
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS ="Microsoft Windows XP Professional (TuneUp Backup)" /noexecute=optin /fastdetect /TUTag=WAPMXD-BAK

370


Report •


Ask Question