iexplore.exe virus

Amd / Amd athlon
January 17, 2009 at 04:53:53
Specs: Windows XP, athlon 1gb
I hit a nasty, and should have known better. Whilst researching a car project there was a video that wouldn't play on media player. I clicked to download tube viewer or something like that. I get TWO iexplore.exe files in task manager, one under my log-in name, and one under system, In the interim I have tried everything I could think of, and download to fix this. Then I found this site.

Below are the logs the moderater suggested I post. I guess I won't know if it's irradicated until time passes. I keep getting pop-up, and/or music playing in the background. Here's the logs


Malwarebytes' Anti-Malware 1.33
Database version: 1659
Windows 5.1.2600 Service Pack 3

1/17/2009 7:29:42 AM
mbam-log-2009-01-17 (07-29-42).txt

Scan type: Quick Scan
Objects scanned: 70430
Time elapsed: 13 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 16
Registry Values Infected: 1
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\ddcAqpoN.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\dtryfr.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5886e910-dc03-4cef-8c1f-76df83e8747c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5886e910-dc03-4cef-8c1f-76df83e8747c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\pmnnogvo (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{dd0e5903-d23d-4a75-8c6d-680a3103c077} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{dd0e5903-d23d-4a75-8c6d-680a3103c077} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{5886e910-dc03-4cef-8c1f-76df83e8747c} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{dd0e5903-d23d-4a75-8c6d-680a3103c077} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{500bca15-57a7-4eaf-8143-8c619470b13d} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\ddcaqpon -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\ddcaqpon -> Delete on reboot.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\dtryfr.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\pmnnOGVo.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\ddcAqpoN.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\NopqAcdd.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\NopqAcdd.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qxldtijj.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\John\Local Settings\Temporary Internet Files\Content.IE5\INEC8W0C\index[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\DO2rhEt0.exe.a_a (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mlJYrpQJ.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:34:35 AM, on 1/17/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.scubadiving.com/forum/tt...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?Lin...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {12D1E9F8-13D7-4BD1-816F-60D5DE289049} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: (no name) - {DD0E5903-D23D-4A75-8C6D-680A3103C077} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {F73875F0-6369-41F0-805F-00D37D92CDD0} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 5.0\THGuard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) - http://webiq005.webiqonline.com/Web...
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/Walgreen...
O16 - DPF: {4FAE30E1-EE9C-477D-8D06-BF8D3429B60F} (WebIQ Technology Client) - http://webiq001.webiqonline.com/Web...
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/Div...
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...
O16 - DPF: {A3D93B25-4601-49D2-B3AF-F447C73D561F} (Sony SNC-RZ25 Control) - http://groupercam2.kentdenver.org/p...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553635000} - http://fpdownload2.macromedia.com/g...
O17 - HKLM\System\CCS\Services\Tcpip\..\{F242B532-1942-42A9-A76C-568D67C3F75D}: NameServer = 205.152.144.23,205.152.132.23
O20 - AppInit_DLLs: dtryfr.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7430 bytes



See More: iexplore.exe virus

Report •


#1
January 18, 2009 at 06:47:25
Still getting pop-up, even when explorer is closed. About every 10 minutes a music piece will play. when I end process on iexplore.exe (SYSTEM) it quits. I just can't get rid of the thing..
Thanks for your help

Report •

#2
January 20, 2009 at 15:55:27

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Rename the setup file, combofix.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename combofix.exe to toolb.exe> click save.

Combofix is a powerful tool so follow the instructions exactly or you could damage your computer.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

In your case to run Combofix do the following:
1. Go offline turn off your AVG antivirus, Spybot and any other antispyware that you may have.
2. Run Combofix and save its log.
3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned.
4. Post the Combofix log.


Remember to re-enable the protection again afterwards before connecting to the Internet.

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running or move the mouse, it will cause your system to hang.)
Please post the log it produces.


Report •

#3
January 21, 2009 at 09:01:54
ComboFix 09-01-20.05 - John 2009-01-21 11:52:41.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.554 [GMT -5:00]
Running from: c:\documents and settings\John\Desktop\toolb.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
.

((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))
.

2009-01-21 11:30 . 2009-01-21 11:30 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-21 10:20 . 2009-01-21 10:22 <DIR> d-------- c:\windows\system32\drivers\Avg
2009-01-21 10:20 . 2009-01-21 10:20 <DIR> d-------- c:\program files\AVG
2009-01-21 10:20 . 2009-01-21 10:20 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
2009-01-21 10:20 . 2009-01-21 10:20 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
2009-01-21 10:20 . 2009-01-21 10:20 10,520 --a------ c:\windows\system32\avgrsstx.dll
2009-01-20 07:12 . 2009-01-20 07:12 <DIR> d-------- c:\program files\AskBarDis
2009-01-20 07:11 . 2009-01-20 07:11 <DIR> d-------- c:\program files\Zone Labs
2009-01-20 07:11 . 2008-11-13 15:18 1,221,008 --a------ c:\windows\system32\zpeng25.dll
2009-01-20 07:11 . 2009-01-21 11:55 348,371 --a------ c:\windows\system32\vsconfig.xml
2009-01-19 12:57 . 2009-01-19 13:09 <DIR> d-------- c:\documents and settings\John\.housecall6.6
2009-01-17 07:14 . 2009-01-17 07:14 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-01-17 07:14 . 2009-01-17 07:14 <DIR> d-------- c:\documents and settings\John\Application Data\Malwarebytes
2009-01-17 07:14 . 2009-01-17 07:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-01-17 07:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-17 07:14 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-01-17 06:00 . 2009-01-17 06:48 483 --a------ c:\windows\wininit.ini
2009-01-17 05:31 . 2009-01-17 05:31 <DIR> d-------- c:\documents and settings\John\Application Data\TrojanHunter
2009-01-17 05:14 . 2009-01-17 05:32 <DIR> d-------- c:\program files\TrojanHunter 5.0
2009-01-17 03:53 . 2009-01-17 03:53 <DIR> d-------- c:\program files\Trend Micro
2009-01-16 15:39 . 2009-01-16 15:39 <DIR> d-------- c:\program files\Alwil Software
2009-01-16 15:20 . 2009-01-17 05:10 <DIR> d-------- c:\documents and settings\All Users\Application Data\PrevxCSI
2009-01-16 13:09 . 2009-01-16 13:35 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-01-16 13:09 . 2009-01-16 14:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-01-16 12:33 . 2009-01-16 12:32 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-16 09:42 . 2009-01-16 09:44 69,632 --a------ c:\windows\system32\DO2rhEt0.exe
2008-12-31 09:37 . 2008-12-31 09:37 27 --a------ c:\windows\SonySNCRZ25.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-19 12:34 --------- d-----w c:\program files\NoAdware5.0
2009-01-16 18:04 --------- d-----w c:\documents and settings\John\Application Data\Lavasoft
2009-01-16 17:32 --------- d-----w c:\program files\Java
2009-01-16 17:14 --------- d-----w c:\program files\Windows Media Bonus Pack for Windows XP
2009-01-16 17:14 --------- d-----w c:\program files\Google
2009-01-06 14:08 --------- d-----w c:\documents and settings\John\Application Data\TaxCut
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-09-16 06:38 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091620080917\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-21_ 9.54.33.76 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
+ 2009-01-21 15:20:43 26,824 ----a-w c:\windows\system32\drivers\avgmfx86.sys
+ 2009-01-21 16:56:04 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_4dc.dat
+ 2006-12-02 05:08:00 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-02 05:08:00 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-02 05:08:00 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-02 05:08:00 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-02 05:46:44 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 18:22 333192 --a------ c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" [2008-04-13 1695232]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2006-08-11 7630848]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-16 136600]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2004-09-13 49152]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-01 413696]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-11-13 981904]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-21 1261336]
"SoundMan"="SOUNDMAN.EXE" [2006-08-02 c:\windows\soundman.exe]
"nwiz"="nwiz.exe" [2006-08-11 c:\windows\system32\nwiz.exe]
"NvMediaCenter"="NvMCTray.dll" [2006-08-11 c:\windows\system32\nvmctray.dll]

c:\documents and settings\John\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-11-19 368640]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-01-11 113664]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 258048]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
"msacm.ac3filter"= ac3filter.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-21 97928]
R4 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [2009-01-20 464264]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-21 231704]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1fe5ca81-bfa3-11dc-a10c-0019db4e5a83}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-16 c:\windows\Tasks\At25.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At26.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At27.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At28.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-17 c:\windows\Tasks\At29.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At30.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At31.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At32.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At33.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At34.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At35.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-21 c:\windows\Tasks\At36.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At37.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At38.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At39.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At40.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At41.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-20 c:\windows\Tasks\At42.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At43.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At44.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-17 c:\windows\Tasks\At45.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At46.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At47.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]

2009-01-16 c:\windows\Tasks\At48.job
- c:\windows\system32\DO2rhEt0.exe [2009-01-16 09:44]
.
- - - - ORPHANS REMOVED - - - -

BHO-{12D1E9F8-13D7-4BD1-816F-60D5DE289049} - (no file)
BHO-{DD0E5903-D23D-4A75-8C6D-680A3103C077} - (no file)
BHO-{F73875F0-6369-41F0-805F-00D37D92CDD0} - (no file)


.
------- Supplementary Scan -------
.
uLocal Page = \blank.htm
uStart Page = hxxp://www.scubadiving.com/forum/tt.aspx?forumid=35
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
TCP: {F242B532-1942-42A9-A76C-568D67C3F75D} = 205.152.144.23,205.152.132.23
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 11:56:23
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
r Running Proce
.
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\HPZipm12.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-21 11:58:19 - machine was rebooted [John]
ComboFix-quarantined-files.txt 2009-01-21 16:58:16
ComboFix2.txt 2009-01-21 14:55:22

Pre-Run: 101,646,385,152 bytes free
Post-Run: 101,668,474,880 bytes free

208 --- E O F --- 2009-01-16 00:16:34


Report •

Related Solutions

#4
January 21, 2009 at 12:51:02
Hi, I also have the exact same problem and got the following log after scan. Kindly do tell me how to fix this problem by sending email or replying here in the forum. Thanks.

________________________________________

ComboFix 09-01-21.01 - Avinash 2009-01-21 15:34:29.1 - NTFSx86
Microsoft® Windows Vista™ Home Basic 6.0.6001.1.1252.1.1033.18.3061.1790 [GMT -5:00]
Running from: c:\users\Avinash\Desktop\toolb.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\whlb32g.dll
c:\users\Avinash\FAVORI~1\googletalk-setup.exe
c:\users\Avinash\FAVORI~1\Links\FileFormatConverters.exe
c:\users\Avinash\FAVORI~1\wrar371.exe
c:\users\Avinash\Favorites\googletalk-setup.exe
c:\users\Avinash\Favorites\Links\FileFormatConverters.exe
c:\users\Avinash\Favorites\wrar371.exe
c:\windows\system32\[u]0[/u]NW5M038.exe.a_a
c:\windows\system32\msxml71.dll

.
((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))
.

2009-01-21 14:08 . 2009-01-21 14:08 73,728 --a------ c:\windows\System32\[u]0[/u]NW5M038.exe
2009-01-20 19:25 . 2009-01-20 19:25 <DIR> d-------- c:\program files\Microsoft Silverlight
2009-01-14 12:05 . 2008-12-15 21:42 288,768 --a------ c:\windows\System32\drivers\srv.sys
2009-01-11 22:06 . 2009-01-11 22:09 <DIR> d-------- c:\program files\Video Pilot
2009-01-11 22:06 . 2009-01-11 22:06 <DIR> d-------- c:\program files\Common Files\Two Pilots
2009-01-11 21:56 . 2009-01-11 21:56 <DIR> d-------- c:\users\Avinash\AppData\Roaming\MOVAVI
2009-01-11 21:50 . 2009-01-11 21:50 <DIR> d-------- c:\users\All Users\TEMP
2009-01-11 21:50 . 2009-01-11 21:50 <DIR> d-------- c:\programdata\TEMP
2009-01-06 23:42 . 2009-01-06 23:42 <DIR> d-------- c:\users\Avinash\AppData\Roaming\Roxio
2009-01-06 23:42 . 2009-01-06 23:42 <DIR> d-------- c:\users\All Users\Roxio
2009-01-06 23:42 . 2009-01-06 23:42 <DIR> d-------- c:\programdata\Roxio
2009-01-06 10:59 . 2009-01-06 10:59 <DIR> d-------- c:\users\Avinash\AppData\Roaming\Ubisoft
2009-01-06 10:59 . 2009-01-06 10:59 <DIR> d-------- c:\users\All Users\Ubisoft
2009-01-06 10:59 . 2009-01-06 10:59 <DIR> d-------- c:\programdata\Ubisoft
2009-01-06 10:45 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\System32\d3dx9_26.dll
2009-01-06 10:44 . 2009-01-06 11:49 <DIR> d--h----- c:\windows\msdownld.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 20:31 --------- d-----w c:\users\Avinash\AppData\Roaming\DNA
2009-01-21 20:31 --------- d-----w c:\programdata\McAfee
2009-01-21 19:54 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-20 20:48 --------- d-----w c:\users\Avinash\AppData\Roaming\BitTorrent
2009-01-18 09:06 --------- d-----w c:\program files\Google
2009-01-18 04:16 --------- d-----w c:\users\Avinash\AppData\Roaming\Skype
2009-01-18 03:14 --------- d-----w c:\users\Avinash\AppData\Roaming\skypePM
2009-01-14 22:39 --------- d-----w c:\program files\Windows Mail
2009-01-14 22:38 --------- d-----w c:\programdata\Microsoft Help
2008-12-25 23:04 --------- d-----w c:\programdata\Yahoo!
2008-12-25 23:04 --------- d-----w c:\program files\Yahoo!
2008-12-20 02:38 --------- d-----w c:\programdata\Apple Computer
2008-12-20 02:38 --------- d-----w c:\program files\QuickTime
2008-12-20 02:38 --------- d-----w c:\program files\Common Files\Apple
2008-12-20 02:37 --------- d-----w c:\programdata\Apple
2008-12-20 02:37 --------- d-----w c:\program files\Apple Software Update
2008-12-19 01:47 4,774 ----a-w c:\users\Avinash\AppData\Roaming\wklnhst.dat
2008-12-19 01:44 --------- d-----w c:\programdata\WindowsSearch
2008-12-13 23:35 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-06 05:56 284,672 ----a-w c:\users\Avinash\AppData\Roaming\DataSafeDotNet.exe
2008-11-28 21:52 --------- d-----w c:\program files\Veoh Networks
2008-11-23 01:44 --------- d-----w c:\users\Avinash\AppData\Roaming\Move Networks
2008-11-17 20:04 2,306,113 ----a-w c:\windows\System32\GPhotos.scr
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-27 15:04 70,992 ----a-w c:\windows\System32\XAPOFX1_2.dll
2008-10-27 15:04 514,384 ----a-w c:\windows\System32\XAudio2_3.dll
2008-10-27 15:04 235,856 ----a-w c:\windows\System32\xactengine3_3.dll
2008-10-27 15:04 23,376 ----a-w c:\windows\System32\X3DAudio1_5.dll
2008-10-22 20:14 152,904 ----a-w c:\windows\System32\vghd.scr
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-12 03:23 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-10-12 03:23 56 ---ha-w c:\programdata\ezsidmv.dat
2008-01-21 02:57 174 --sha-w c:\program files\desktop.ini
2008-09-02 05:41 76 --sh--r c:\windows\CT4CET.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-20 202240]
"VeohPlugin"="c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe" [2008-11-03 3522296]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-20 1233920]
"Google Update"="c:\users\Avinash\AppData\Local\Google\Update\GoogleUpdate.exe" [2008-11-12 133104]
"BitTorrent DNA"="c:\users\Avinash\Program Files\DNA\btdna.exe" [2008-12-19 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-06 133656]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-12-21 184320]
"OEM02Mon.exe"="c:\windows\OEM02Mon.exe" [2008-03-04 36864]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-06 141848]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2007-03-21 174872]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-06 166424]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-02-28 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2008-05-19 3444736]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2008-05-04 167936]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\FlashUtil9f.exe" [2008-03-24 218496]

c:\users\Avinash\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2008-05-13 1058088]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-09-02 50688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-09-02 00:57 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dell DataSafe Online]
--a------ 2008-07-24 15:36 993520 c:\program files\Dell DataSafe Online\DataSafeOnline.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-11-25 22:43 413696 c:\program files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9DBA16E2-5715-4B6E-95DD-36EB67DF15B6}"= c:\program files\Dell\MediaDirect\MediaDirect.exe:Dell MediaDirect
"{C62D6BD0-205B-4115-A8DB-F7F8D64E2E8B}"= c:\program files\Dell\MediaDirect\PCMService.exe:CyberLink PowerCinema Resident Program
"{5A8E0F54-DF68-4F47-93D1-854D5E7B859D}"= c:\program files\Dell\MediaDirect\Kernel\DMP\CLBrowserEngine.exe:Cyberlink Media Server Browser Engine
"{A8BC5E94-C264-4E63-93A3-6B88F9FB1FFB}"= c:\program files\Dell\MediaDirect\Kernel\DMS\CLMSService.exe:CyberLink Media Server
"{9C71F285-69D4-4349-927E-BB64163C5F0D}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{E3C8C395-9D7E-4E2C-8C3C-9FD47C4064AD}"= TCP:c:\program files\DNA\btdna.exe:DNA
"TCP Query User{1AC072E5-308C-43B1-B4FC-0E5F88D0F8E0}c:\\users\\avinash\\program files\\dna\\btdna.exe"= UDP:c:\users\avinash\program files\dna\btdna.exe:btdna.exe
"UDP Query User{3B6223B8-F8FC-44C9-A464-D32D3F28B2C7}c:\\users\\avinash\\program files\\dna\\btdna.exe"= TCP:c:\users\avinash\program files\dna\btdna.exe:btdna.exe
"TCP Query User{6B6FDF78-28E4-412B-B73B-53D7BB9545A4}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:µTorrent
"UDP Query User{A69354A0-E8E9-45D9-ABA7-F645BC1575EE}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:µTorrent
"TCP Query User{3C3413AB-8153-4FFB-A047-95BE0811004F}c:\\program files\\bittorrent\\bittorrent.exe"= UDP:c:\program files\bittorrent\bittorrent.exe:µTorrent
"UDP Query User{64E2C25E-63B9-47E4-A997-935FE6E8040D}c:\\program files\\bittorrent\\bittorrent.exe"= TCP:c:\program files\bittorrent\bittorrent.exe:µTorrent
"TCP Query User{28A84B84-C970-4BFE-A536-09E4339C7788}c:\\users\\avinash\\program files\\dna\\btdna.exe"= UDP:c:\users\avinash\program files\dna\btdna.exe:btdna.exe
"UDP Query User{4AC2C790-FBE3-4418-AEAE-F82FD07A623C}c:\\users\\avinash\\program files\\dna\\btdna.exe"= TCP:c:\users\avinash\program files\dna\btdna.exe:btdna.exe
"TCP Query User{86114547-31A8-4421-9540-34816D996A16}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{8EFCCE30-8EF2-467D-8F41-77B675EFFFE4}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"TCP Query User{0B824502-23AE-4465-9086-9996098BD8EF}c:\\users\\avinash\\appdata\\locallow\\powerchallenge\\powersoccer\\powersoccer.exe"= UDP:c:\users\avinash\appdata\locallow\powerchallenge\powersoccer\powersoccer.exe:powersoccer.exe
"UDP Query User{F231D806-4956-404B-85E1-66889D45E375}c:\\users\\avinash\\appdata\\locallow\\powerchallenge\\powersoccer\\powersoccer.exe"= TCP:c:\users\avinash\appdata\locallow\powerchallenge\powersoccer\powersoccer.exe:powersoccer.exe
"{E857B139-11E9-4D2B-AE75-C22E1F0AB889}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{E297CFBF-B6B9-4C60-8E3F-78D899497B7E}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{D02B83A1-655A-40A1-97A1-6A90D3B70741}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{496E0009-90EE-421E-BD02-E0459DF42B3D}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{0E9BF102-08FA-458A-B1FB-E7596F252758}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{89F23FE6-CD0F-4D29-A03B-9B67EC202F25}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{D99E3A66-9912-4DD5-93ED-D3F3DF4306EE}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"TCP Query User{A3843CC2-B57C-4C7D-BC38-529FB5F93FA3}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{EA7318F0-9B35-4B5D-93E8-4989290A6B50}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"{C270F31B-462D-4907-998F-82FA42A7BDB8}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{E15B522D-6147-443B-9929-0FEC88275499}c:\\users\\avinash\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= UDP:c:\users\avinash\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"UDP Query User{BC7C2070-611D-4FE5-AEF5-8255665C2F2A}c:\\users\\avinash\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= TCP:c:\users\avinash\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"{801DDA7A-EE99-48E4-8AE0-26E1FBC9CEF4}"= UDP:c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:Veoh Web Player
"{89A7A9C4-B1F1-46C6-BE41-F590BD9017B2}"= TCP:c:\program files\Veoh Networks\VeohWebPlayer\veohwebplayer.exe:Veoh Web Player
"TCP Query User{DD6965EB-2125-4C40-828F-9C9FC5BC92D6}c:\\users\\avinash\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= UDP:c:\users\avinash\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"UDP Query User{A37CFF7F-73FF-41BF-8540-8B158F278B0B}c:\\users\\avinash\\appdata\\roaming\\macromedia\\flash player\\www.macromedia.com\\bin\\octoshape\\octoshape.exe"= TCP:c:\users\avinash\appdata\roaming\macromedia\flash player\www.macromedia.com\bin\octoshape\octoshape.exe:octoshape.exe
"TCP Query User{CB53640D-CDC1-4EE9-93A5-9937A5F02E46}c:\\program files\\veoh networks\\veohwebplayer\\veohwebplayer.exe"= UDP:c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe:Veoh Web Player Beta
"UDP Query User{0EA03B6D-8CBF-436C-A853-9EEDB73C67C8}c:\\program files\\veoh networks\\veohwebplayer\\veohwebplayer.exe"= TCP:c:\program files\veoh networks\veohwebplayer\veohwebplayer.exe:Veoh Web Player Beta

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\BitTorrent\\bittorrent.exe"= c:\program files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R3 IntcHdmiAddService;Intel(R) High Definition Audio HDMI Service;c:\windows\System32\drivers\IntcHdmi.sys [2008-09-02 111616]
R3 OEM02Dev;Creative Camera OEM002 Driver;c:\windows\System32\drivers\OEM02Dev.sys [2008-09-02 235648]
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver;c:\windows\System32\drivers\OEM02Vfx.sys [2008-09-02 7424]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [2008-09-01 73728]
R4 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-04-28 161048]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeapfk
*Deregistered* - mfeavfk
*Deregistered* - mfebopk
*Deregistered* - mfehidk

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
.
Contents of the 'Scheduled Tasks' folder

2009-01-19 c:\windows\Tasks\At1.job
- c:\program files\norton pc checkup\pc_checkup.exe [2008-06-29 16:50]

2009-01-21 c:\windows\Tasks\At10.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At11.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At12.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At13.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At14.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At15.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At16.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At17.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At18.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At19.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-18 c:\windows\Tasks\At2.job
- c:\program files\norton pc checkup\pc_checkup.exe [2008-06-29 16:50]

2009-01-21 c:\windows\Tasks\At20.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At21.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At22.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At23.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At24.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At25.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At26.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At3.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At4.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At5.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At6.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At7.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At8.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\At9.job
- c:\windows\system32\[u]0[/u]NW5M038.exe [2009-01-21 14:08]

2009-01-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3325731624-3164886289-3794678036-1000.job
- c:\users\Avinash\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-12 00:23]

2009-01-21 c:\windows\Tasks\User_Feed_Synchronization-{8CF582F3-2B6C-4F3A-B639-E1664993623A}.job
- c:\windows\system32\msfeedssync.exe [2008-01-20 21:34]
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-Cognac - c:\windows\TEMP\5060.tmp.exe
MSConfigStartUp-googletalk - c:\users\Avinash\AppData\Roaming\Google\Google Talk\googletalk.exe
MSConfigStartUp-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Avinash\AppData\Roaming\Mozilla\Firefox\Profiles\zlhjljie.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-msgr&p=
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\NPVeohTVPlugin.dll
FF - plugin: c:\program files\Veoh Networks\VeohWebPlayer\npWebPlayerVideoPluginATL.dll
FF - plugin: c:\users\Avinash\AppData\Local\Google\Update\1.2.133.33\npGoogleOneClick7.dll
FF - plugin: c:\users\Avinash\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\Avinash\Program Files\DNA\plugins\npbtdna.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 15:36:30
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-01-21 15:38:18
ComboFix-quarantined-files.txt 2009-01-21 20:38:16

Pre-Run: 159,224,487,936 bytes free
Post-Run: 159,967,895,552 bytes free

274 --- E O F --- 2009-01-19 17:27:20


Report •

#5
January 21, 2009 at 14:17:53
relroy, you will need to start your own thread. Please do not post any logs until ask, just state your problem.

Report •

#6
January 21, 2009 at 14:29:40
Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, File, Folder, Registry etc.) is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
KILLALL::
File::
c:\windows\system32\DO2rhEt0.exe
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run".

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.


Download ATF Cleaner from this link:
http://www.majorgeeks.com/ATF_Cleaner_d4949.html
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE TO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
3.Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
4. Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
5. Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
6. Click View scan report at the bottom.
7. Click the Save Report As... button.
8. Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.


Report •


Ask Question