[Resolved] Hijack Log - Malware??

**Injigo** · 08-09-2009

I'm starting to absolutely love malware. Check it out:

Logfile of Advanced SystemCare 3 Security Analyzer
Scan saved at 10:51:25 AM, on 9/8/2009
Platform: Windows XP (WinNT 5.1)
MSIE: Internet Explorer v8.0 (8.0.6001.18702)
Boot mode: Fail-safe with network

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbm.exe
C:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\ctfmon.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: AcroIEHelperStub - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: (no name) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} -
O9 - Extra button: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Plug-in 1.6.0_16) - http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} (Java Plug-in 1.6.0_16) - http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} (Java Plug-in 1.6.0_16) - http://java.sun.com/update/1.6.0/jin...ndows-i586.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: AntipyProex (AntipPro2009_100) - Unknown - C:\WINDOWS\svchasts.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

Thanks in advanced.

David

**broni** · 09-09-2009

State your problems, please.
Why did you run HJT in Safe Mode?

**Injigo** · 09-09-2009

Well the first symptoms were:

Everytime I tried to run any executable file, I was presented with an error message that stated the directory of the executable, like this:

"C:\Program Files\Malwarebytes' Anti-Malware\mbm.exe"

Nothing else was in the error messages, just like so. So not being able to run anything I rebooted into Safe Mode with networking and ran Malwarebyte's Anti-Malware and performed a full system scan and removed all infected files.

After rebooting into normal mode, everything seemed to be fine until I attempted to run SpyBot S&D and Malwarebyte's Anti-Malware and was presented with the following error message:

---------------------------
D:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
---------------------------
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
---------------------------
OK
---------------------------

And the program would not run.

**Injigo** · 09-09-2009

I tried running HijackThis so i could post a log but while it was scanning, it closed randomly and did not produce a log file. After that, I got the same error message as before:

"---------------------------
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
---------------------------
Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item.
---------------------------
OK
---------------------------"

Renaming the HijackThis.exe file did not work either. I got this follow error:

"---------------------------
Error Renaming File or Folder
---------------------------
Cannot rename HijackThis: Access is denied.

Make sure the disk is not full or write-protected
and that the file is not currently in use.
---------------------------
OK
---------------------------"

**broni** · 09-09-2009

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Please, never rename Combofix unless instructed.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
- Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
NOTE. If Combofix asks you to install Recovery Console, please allow it.
- Close any open browsers.
- WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
- Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
- If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

**Injigo** · 09-09-2009

OK, I ran ComboFix and here is the log:

ComboFix 09-09-08.05 - les wilson 09/08/2009 22:46.1.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1715 [GMT -7:00]
Running from: c:\documents and settings\les wilson\Desktop\Combo-Fix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\les wilson\Application Data\Microsoft\Internet Explorer\Quick Launch\SUPERAntiSpyware Free Edition.lnk
c:\recycler\S-1-5-21-3524804560-0799563032-757981940-0410
c:\recycler\S-1-5-21-7778235297-6663423248-347489332-8897
c:\recycler\S-1-5-21-8455145880-2786522740-956576265-3721
c:\recycler\S-1-5-21-9217295077-8383695004-836632093-1906
c:\recycler\S-1-5-21-9836375518-2231968513-020357915-8748
c:\windows\system32\drivers\kbiwkmjkvssrpd.sys
c:\windows\system32\kbiwkmdpqxiuxd.dll
c:\windows\system32\kbiwkmkgmlwbov.dat
c:\windows\system32\kbiwkmqwxeptmt.dll
c:\windows\system32\kbiwkmtardnbev.dat
c:\windows\system32\msssc.dll

Infected copy of c:\windows\system32\eventlog.dll was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\eventlog.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ESQULserv.sys
-------\Legacy_ESQULserv.sys
-------\Service_kbiwkmepxurubx
-------\Legacy_kbiwkmepxurubx
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}

((((((((((((((((((((((((( Files Created from 2009-08-09 to 2009-09-09 )))))))))))))))))))))))))))))))
.

2009-09-09 04:57 . 2009-09-09 04:58 -------- d--h--w- c:\windows\PIF
2009-09-09 04:31 . 2009-09-09 04:31 -------- d-----w- c:\program files\Microsoft
2009-09-09 04:31 . 2009-09-09 04:31 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-09 04:23 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-09 04:23 . 2009-09-09 04:23 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-09-09 04:23 . 2009-09-09 05:49 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-09 04:23 . 2009-09-09 04:23 -------- d-----w- c:\documents and settings\les wilson\Application Data\SUPERAntiSpyware.com
2009-09-09 04:22 . 2009-09-09 04:22 314 ----a-w- c:\windows\system32\nk.dat
2009-09-09 04:21 . 2009-09-09 04:21 1 ----a-w- c:\windows\system32\xd.dat
2009-09-09 04:21 . 2009-09-09 04:21 1 ----a-w- c:\windows\system32\q1.dat
2009-09-09 04:21 . 2009-09-09 04:21 1 ----a-w- c:\windows\system32\idm.dat
2009-09-09 04:21 . 2009-09-09 04:21 1 ----a-w- c:\windows\system32\c2d.dat
2009-09-08 22:00 . 2009-09-08 22:00 40448 ----a-w- c:\windows\system32\lkod.dll
2009-09-08 18:18 . 2009-09-08 18:18 -------- d-----w- c:\program files\Trend Micro
2009-09-08 17:21 . 2008-06-20 00:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-09-08 17:20 . 2009-09-08 17:20 -------- d-----w- c:\program files\Panda Security
2009-09-08 17:11 . 2009-09-08 17:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\IObit
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\les wilson\Application Data\Apple Computer
2009-09-07 07:59 . 2009-09-07 07:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-09-07 07:54 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Apple Computer
2009-09-07 07:48 . 2009-09-07 07:50 -------- d-----w- c:\documents and settings\les wilson\Application Data\foobar2000
2009-09-07 07:48 . 2009-09-07 07:48 -------- d-----w- c:\program files\foobar2000
2009-09-06 14:20 . 2009-09-06 14:20 -------- d-----w- c:\program files\New Folder
2009-09-06 07:13 . 2009-09-06 07:13 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\LogMeIn
2009-09-06 07:11 . 2009-09-06 07:11 -------- d-----w- c:\documents and settings\LogMeInRemoteUser\Local Settings\Application Data\LogMeIn
2009-09-06 07:11 . 2009-09-06 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\LogMeIn
2009-09-06 07:11 . 2009-09-06 07:11 -------- d-sh--w- c:\documents and settings\LogMeInRemoteUser\IETldCache
2009-09-06 07:00 . 2009-09-06 07:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ICS
2009-09-06 07:00 . 2009-09-05 18:23 28984 ----a-w- c:\windows\system32\LMIport.dll
2009-09-06 07:00 . 2009-09-05 18:23 83288 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2009-09-06 07:00 . 2008-08-11 19:41 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2009-09-06 07:00 . 2009-09-05 18:23 87352 ----a-w- c:\windows\system32\LMIinit.dll
2009-09-06 07:00 . 2009-09-06 07:07 -------- d-----w- c:\program files\LogMeIn
2009-09-06 06:58 . 2009-09-06 06:59 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Deployment
2009-09-05 15:33 . 2006-07-05 23:12 186880 ----a-w- C:\Fix.exe
2009-09-05 10:58 . 2009-09-05 10:58 -------- d--h--r- c:\documents and settings\les wilson\Application Data\SecuROM
2009-09-05 10:58 . 2009-09-05 10:58 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-09-05 10:15 . 2009-09-05 10:15 -------- d-----w- c:\program files\Sierra
2009-09-05 10:03 . 2009-09-05 10:07 -------- d-----w- c:\program files\SimpleOCR
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Yahoo
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\program files\Yahoo!
2009-08-31 01:11 . 2009-08-31 01:11 -------- d-----w- c:\documents and settings\les wilson\Application Data\SpeedBit
2009-08-31 01:00 . 2009-08-31 01:00 50688 ----a-w- c:\windows\system32\wbhelp2.dll
2009-08-25 05:19 . 2009-08-25 05:19 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-08-25 05:19 . 2009-08-25 05:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-25 05:17 . 2009-08-25 05:30 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Adobe
2009-08-24 03:27 . 2009-08-24 03:27 -------- d-----w- c:\program files\DAMN NFO Viewer
2009-08-24 03:27 . 2009-08-24 03:27 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-24 03:27 . 2009-08-31 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Speedbit
2009-08-24 03:27 . 2009-09-05 15:22 -------- d-----w- c:\program files\SpeedBit Video Accelerator
2009-08-20 23:10 . 2009-08-21 00:28 -------- d-----w- c:\documents and settings\les wilson\Application Data\IObit
2009-08-20 23:10 . 2009-08-20 23:28 -------- d-----w- c:\program files\IObit
2009-08-13 06:12 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-11 22:55 . 2009-08-11 22:55 -------- d--h--w- c:\windows\system32\GroupPolicy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-09-09 05:30 . 2006-02-28 12:00 56320 ----a-w- c:\windows\system32\eventlog.dll
2009-09-09 05:02 . 2009-08-10 04:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-09 04:36 . 2009-07-06 07:59 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 04:35 . 2009-07-04 10:16 14248 ----a-w- c:\documents and settings\les wilson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-09 04:31 . 2009-07-06 07:58 -------- d-----w- c:\program files\Windows Live
2009-09-09 01:27 . 2009-06-30 23:55 -------- d-----w- c:\program files\City of Heroes
2009-09-08 17:24 . 2009-07-18 01:14 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-08 13:10 . 2009-07-06 01:24 -------- d-----w- c:\documents and settings\les wilson\Application Data\uTorrent
2009-09-08 03:30 . 2009-07-06 00:35 -------- d-----w- c:\program files\Steam
2009-09-07 12:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\Bonjour
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\iTunes
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\iPod
2009-09-07 08:01 . 2009-09-07 07:59 -------- d-----w- c:\program files\Common Files\Apple
2009-09-07 08:01 . 2009-09-07 08:00 -------- d-----w- c:\program files\QuickTime
2009-09-07 08:00 . 2009-09-07 08:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-09-07 08:00 . 2009-09-07 08:00 -------- d-----w- c:\program files\Apple Software Update
2009-09-07 08:00 . 2009-07-06 05:07 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\Tsunami-Filter-Pack
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\VirtualDub
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\Avisynth
2009-09-07 07:39 . 2009-06-30 23:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-07 06:55 . 2009-07-01 22:43 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-05 16:35 . 2009-07-17 04:05 -------- d-----w- c:\documents and settings\les wilson\Application Data\Uniblue
2009-09-05 15:15 . 2009-08-10 04:55 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-05 09:37 . 2009-06-30 23:11 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-31 08:56 . 2009-07-11 10:44 -------- d-----w- c:\program files\DivX
2009-08-20 22:12 . 2009-08-10 04:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-20 11:43 . 2009-08-10 04:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 07:58 . 2009-07-30 07:10 1887 ----a-w- c:\documents and settings\All Users\Application Data\xml5.tmp
2009-08-10 07:58 . 2009-07-30 07:10 13491 ----a-w- c:\documents and settings\All Users\Application Data\xml4.tmp
2009-08-10 07:58 . 2009-07-30 07:10 7976 ----a-w- c:\documents and settings\All Users\Application Data\xml3.tmp
2009-08-10 05:50 . 2009-08-10 05:50 -------- d-----w- c:\program files\MSXML 4.0
2009-08-10 05:31 . 2009-08-10 05:31 -------- d-----w- c:\documents and settings\les wilson\Application Data\Malwarebytes
2009-08-10 05:03 . 2009-08-10 05:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-07-31 07:55 . 2009-07-06 02:27 -------- d-----w- c:\documents and settings\les wilson\Application Data\Winamp
2009-07-28 08:54 . 2009-07-28 08:54 -------- d-----w- c:\documents and settings\les wilson\Application Data\acccore
2009-07-28 08:54 . 2009-07-28 08:53 -------- d-----w- c:\documents and settings\les wilson\Application Data\LAIM
2009-07-26 23:44 . 2009-07-26 23:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-18 01:14 . 2009-07-18 01:14 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 19:21 . 2006-02-28 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-11 10:44 . 2009-07-11 10:44 -------- d-----w- c:\program files\Common Files\DivX Shared
2009-07-09 19:16 . 2009-09-07 08:00 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-07-09 19:16 . 2009-09-07 08:00 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-07-04 03:04 . 2009-07-04 02:55 102262 ----a-w- c:\windows\hpoins05.dat
2009-07-03 17:09 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-30 23:19 . 2009-06-30 23:19 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-30 23:10 . 2009-06-30 23:10 0 ----a-w- c:\windows\nsreg.dat
2009-06-30 22:35 . 2009-06-30 22:35 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-25 08:25 . 2006-02-28 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2006-02-28 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2006-02-28 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2006-02-28 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2006-02-28 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2006-02-28 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2006-02-28 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2006-02-28 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2006-02-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2006-02-28 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2006-02-28 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19EA25F0-EB8F-43B9-B9E8-0A81E9A97177}]
2009-09-08 22:00 40448 ----a-w- c:\windows\system32\lkod.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-04 1994480]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-05 18:23 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TightVNC\\WinVNC.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business 2009.SP2\\RpcAgentSrv.exe"=
"d:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business 2009.SP2\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"d:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEARXP\\FEARXP.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboo t.sys [9/8/2009 10:21 AM 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 2:50 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 2:49 PM 74480]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 12:41 PM 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sy s [9/6/2009 12:00 AM 47640]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe [4/29/2009 4:00 PM 98488]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 2:50 PM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/9/2009 9:55 PM 356920]
S3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V023 0Vfx.sys [7/13/2009 1:42 AM 6272]
S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [7/13/2009 1:42 AM 500608]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

Notify-AtiExtEvent - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.speedbit.com/
mWindow Title =
IE: &Clean Traces - d:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - d:\program files\DAP\dapextie.htm
IE: Download &all with DAP - d:\program files\DAP\dapextie2.htm
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\progra~1\DAP\dapie.dll
FF - ProfilePath - c:\documents and settings\les wilson\Application Data\Mozilla\Firefox\Profiles\0828hlo5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: d:\program files\DAP\DAPFireFox\components\DAPFireFox.dll
FF - plugin: c:\documents and settings\les wilson\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\les wilson\Application Data\Mozilla\Firefox\Profiles\0828hlo5.default\ext ensions\LogMeInClient@logmein.com\plugins\npRACtrl .dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-09-08 22:52
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1202660629-1960408961-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ba,60,90,d5,6e,1a,65,22,bb,d2,a9,56,df,84 ,7c,23,cb,d4,4a,5b,65,bf,22,
9f,df,27,5a,37,f8,6e,22,f5,4b,b8,2c,6e,3a,c8,d2,ad ,25,b5,65,29,58,63,f6,6f,\
"??"=hex:57,f3,6f,7d,80,e3,a9,f6,e3,91,56,0e,7b,62 ,53,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUt il10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(756)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll

- - - - - - - > 'explorer.exe'(2040)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wdfmgr.exe
.
************************************************** ************************
.
Completion time: 2009-09-09 22:56 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-09 05:55

Pre-Run: 70,394,556,416 bytes free
Post-Run: 70,421,082,112 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

300 --- E O F --- 2009-08-26 13:51

Here's the updated HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:41:42 PM, on 9/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\fool\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = SpeedBit Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: MSN helper - {19EA25F0-EB8F-43B9-B9E8-0A81E9A97177} - lkod.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5125 bytes

**broni** · 09-09-2009

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

File::
c:\windows\system32\nk.dat
c:\windows\system32\xd.dat
c:\windows\system32\q1.dat
c:\windows\system32\idm.dat
c:\windows\system32\c2d.dat
c:\windows\system32\lkod.dll
C:\Fix.exe
c:\documents and settings\All Users\Application Data\xml5.tmp
c:\documents and settings\All Users\Application Data\xml4.tmp
c:\documents and settings\All Users\Application Data\xml3.tmp


Folder::

Driver::

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{19EA25F0-EB8F-43B9-B9E8-0A81E9A97177}]


RegLockDel::

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

**Injigo** · 10-09-2009

Alrighty, everything went smoothly from what I could tell. New ComboFix Log:

ComboFix 09-09-09.04 - les wilson 09/10/2009 0:07.2.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1695 [GMT -7:00]
Running from: c:\documents and settings\les wilson\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\les wilson\Desktop\CFScript.txt

FILE ::
"c:\documents and settings\All Users\Application Data\xml3.tmp"
"c:\documents and settings\All Users\Application Data\xml4.tmp"
"c:\documents and settings\All Users\Application Data\xml5.tmp"
"C:\Fix.exe"
"c:\windows\system32\c2d.dat"
"c:\windows\system32\idm.dat"
"c:\windows\system32\lkod.dll"
"c:\windows\system32\nk.dat"
"c:\windows\system32\q1.dat"
"c:\windows\system32\xd.dat"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\xml3.tmp
c:\documents and settings\All Users\Application Data\xml4.tmp
c:\documents and settings\All Users\Application Data\xml5.tmp
c:\documents and settings\les wilson\Application Data\Microsoft\Internet Explorer\Quick Launch\SUPERAntiSpyware Free Edition.lnk
C:\Fix.exe
c:\windows\system32\c2d.dat
c:\windows\system32\idm.dat
c:\windows\system32\lkod.dll
c:\windows\system32\nk.dat
c:\windows\system32\q1.dat
c:\windows\system32\xd.dat

.
((((((((((((((((((((((((( Files Created from 2009-08-10 to 2009-09-10 )))))))))))))))))))))))))))))))
.

2009-09-09 06:41 . 2009-09-10 07:02 -------- d-----w- c:\program files\fool
2009-09-09 04:57 . 2009-09-09 05:51 -------- d--h--w- c:\windows\PIF
2009-09-09 04:31 . 2009-09-09 04:31 -------- d-----w- c:\program files\Microsoft
2009-09-09 04:31 . 2009-09-09 04:31 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-09-09 04:23 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll
2009-09-09 04:23 . 2009-09-09 04:23 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-09-09 04:23 . 2009-09-10 07:11 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-09-09 04:23 . 2009-09-09 04:23 -------- d-----w- c:\documents and settings\les wilson\Application Data\SUPERAntiSpyware.com
2009-09-08 18:18 . 2009-09-08 18:18 -------- d-----w- c:\program files\Trend Micro
2009-09-08 17:21 . 2008-06-20 00:24 28544 ----a-w- c:\windows\system32\drivers\pavboot.sys
2009-09-08 17:20 . 2009-09-08 17:20 -------- d-----w- c:\program files\Panda Security
2009-09-08 17:11 . 2009-09-08 17:12 -------- d-----w- c:\documents and settings\Administrator\Application Data\IObit
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\les wilson\Application Data\Apple Computer
2009-09-07 07:59 . 2009-09-07 07:59 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-09-07 07:54 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Apple Computer
2009-09-07 07:48 . 2009-09-07 07:50 -------- d-----w- c:\documents and settings\les wilson\Application Data\foobar2000
2009-09-07 07:48 . 2009-09-07 07:48 -------- d-----w- c:\program files\foobar2000
2009-09-06 14:20 . 2009-09-06 14:20 -------- d-----w- c:\program files\New Folder
2009-09-06 07:13 . 2009-09-06 07:13 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\LogMeIn
2009-09-06 07:00 . 2009-09-06 07:00 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\ICS
2009-09-06 07:00 . 2009-09-05 18:23 28984 ----a-w- c:\windows\system32\LMIport.dll
2009-09-06 07:00 . 2009-09-05 18:23 83288 ----a-w- c:\windows\system32\LMIRfsClientNP.dll
2009-09-06 07:00 . 2008-08-11 19:41 47640 ----a-w- c:\windows\system32\drivers\LMIRfsDriver.sys
2009-09-06 07:00 . 2009-09-05 18:23 87352 ----a-w- c:\windows\system32\LMIinit.dll
2009-09-06 07:00 . 2009-09-06 07:07 -------- d-----w- c:\program files\LogMeIn
2009-09-06 06:58 . 2009-09-06 06:59 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Deployment
2009-09-05 10:58 . 2009-09-05 10:58 -------- d--h--r- c:\documents and settings\les wilson\Application Data\SecuROM
2009-09-05 10:58 . 2009-09-05 10:58 98304 ----a-w- c:\windows\system32\CmdLineExt.dll
2009-09-05 10:15 . 2009-09-05 10:15 -------- d-----w- c:\program files\Sierra
2009-09-05 10:03 . 2009-09-05 10:07 -------- d-----w- c:\program files\SimpleOCR
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Yahoo
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-09-01 08:12 . 2009-09-01 08:12 -------- d-----w- c:\program files\Yahoo!
2009-08-31 01:11 . 2009-08-31 01:11 -------- d-----w- c:\documents and settings\les wilson\Application Data\SpeedBit
2009-08-31 01:00 . 2009-08-31 01:00 50688 ----a-w- c:\windows\system32\wbhelp2.dll
2009-08-25 05:19 . 2009-08-25 05:19 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-08-25 05:19 . 2009-08-25 05:21 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-25 05:17 . 2009-08-25 05:30 -------- d-----w- c:\documents and settings\les wilson\Local Settings\Application Data\Adobe
2009-08-24 03:27 . 2009-08-24 03:27 -------- d-----w- c:\program files\DAMN NFO Viewer
2009-08-24 03:27 . 2009-08-24 03:27 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-24 03:27 . 2009-08-31 01:11 -------- d-----w- c:\documents and settings\All Users\Application Data\Speedbit
2009-08-24 03:27 . 2009-09-05 15:22 -------- d-----w- c:\program files\SpeedBit Video Accelerator
2009-08-20 23:10 . 2009-08-21 00:28 -------- d-----w- c:\documents and settings\les wilson\Application Data\IObit
2009-08-20 23:10 . 2009-08-20 23:28 -------- d-----w- c:\program files\IObit
2009-08-13 06:12 . 2009-07-10 13:27 1315328 -c----w- c:\windows\system32\dllcache\msoe.dll
2009-08-11 22:55 . 2009-08-11 22:55 -------- d--h--w- c:\windows\system32\GroupPolicy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-09-10 01:24 . 2009-06-30 23:55 -------- d-----w- c:\program files\City of Heroes
2009-09-09 14:10 . 2009-07-06 01:24 -------- d-----w- c:\documents and settings\les wilson\Application Data\uTorrent
2009-09-09 07:16 . 2009-07-06 00:35 -------- d-----w- c:\program files\Steam
2009-09-09 05:30 . 2006-02-28 12:00 56320 ------w- c:\windows\system32\eventlog.dll
2009-09-09 05:02 . 2009-08-10 04:57 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-09-09 04:36 . 2009-07-06 07:59 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-09 04:35 . 2009-07-04 10:16 14248 ----a-w- c:\documents and settings\les wilson\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-09-09 04:31 . 2009-07-06 07:58 -------- d-----w- c:\program files\Windows Live
2009-09-08 17:24 . 2009-07-18 01:14 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-07 12:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\Bonjour
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\iTunes
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-09-07 08:01 . 2009-09-07 08:01 -------- d-----w- c:\program files\iPod
2009-09-07 08:01 . 2009-09-07 07:59 -------- d-----w- c:\program files\Common Files\Apple
2009-09-07 08:01 . 2009-09-07 08:00 -------- d-----w- c:\program files\QuickTime
2009-09-07 08:00 . 2009-09-07 08:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-09-07 08:00 . 2009-09-07 08:00 -------- d-----w- c:\program files\Apple Software Update
2009-09-07 08:00 . 2009-07-06 05:07 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\Tsunami-Filter-Pack
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\VirtualDub
2009-09-07 07:39 . 2009-09-07 07:39 -------- d-----w- c:\program files\Avisynth
2009-09-07 07:39 . 2009-06-30 23:11 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-07 06:55 . 2009-07-01 22:43 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-06 07:11 . 2009-09-06 07:11 -------- d-----w- c:\documents and settings\All Users\Application Data\LogMeIn
2009-09-05 16:35 . 2009-07-17 04:05 -------- d-----w- c:\documents and settings\les wilson\Application Data\Uniblue
2009-09-05 15:15 . 2009-08-10 04:55 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-05 09:37 . 2009-06-30 23:11 -------- d-----w- c:\program files\Common Files\InstallShield
2009-08-31 08:56 . 2009-07-11 10:44 -------- d-----w- c:\program files\DivX
2009-08-20 22:12 . 2009-08-10 04:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-08-20 11:43 . 2009-08-10 04:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-08-10 05:50 . 2009-08-10 05:50 -------- d-----w- c:\program files\MSXML 4.0
2009-08-10 05:31 . 2009-08-10 05:31 -------- d-----w- c:\documents and settings\les wilson\Application Data\Malwarebytes
2009-08-10 05:03 . 2009-08-10 05:03 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-07-31 07:55 . 2009-07-06 02:27 -------- d-----w- c:\documents and settings\les wilson\Application Data\Winamp
2009-07-28 08:54 . 2009-07-28 08:54 -------- d-----w- c:\documents and settings\les wilson\Application Data\acccore
2009-07-28 08:54 . 2009-07-28 08:53 -------- d-----w- c:\documents and settings\les wilson\Application Data\LAIM
2009-07-26 23:44 . 2009-07-26 23:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
2009-07-18 01:14 . 2009-07-18 01:14 -------- d-----w- c:\program files\AGEIA Technologies
2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-12 19:21 . 2006-02-28 12:00 233472 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-09 19:16 . 2009-09-07 08:00 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-07-09 19:16 . 2009-09-07 08:00 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-07-04 03:04 . 2009-07-04 02:55 102262 ----a-w- c:\windows\hpoins05.dat
2009-07-03 17:09 . 2006-02-28 12:00 915456 ------w- c:\windows\system32\wininet.dll
2009-06-30 23:19 . 2009-06-30 23:19 0 ----a-w- c:\windows\ativpsrm.bin
2009-06-30 23:10 . 2009-06-30 23:10 0 ----a-w- c:\windows\nsreg.dat
2009-06-30 22:35 . 2009-06-30 22:35 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-25 08:25 . 2006-02-28 12:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:25 . 2006-02-28 12:00 56832 ----a-w- c:\windows\system32\secur32.dll
2009-06-25 08:25 . 2006-02-28 12:00 54272 ----a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:25 . 2006-02-28 12:00 301568 ----a-w- c:\windows\system32\kerberos.dll
2009-06-25 08:25 . 2006-02-28 12:00 147456 ----a-w- c:\windows\system32\schannel.dll
2009-06-25 08:25 . 2006-02-28 12:00 136192 ----a-w- c:\windows\system32\msv1_0.dll
2009-06-24 11:18 . 2006-02-28 12:00 92928 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-16 14:36 . 2006-02-28 12:00 81920 ----a-w- c:\windows\system32\fontsub.dll
2009-06-16 14:36 . 2006-02-28 12:00 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-12 12:31 . 2006-02-28 12:00 80896 ----a-w- c:\windows\system32\tlntsess.exe
2009-06-12 12:31 . 2006-02-28 12:00 76288 ----a-w- c:\windows\system32\telnet.exe
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-09-09_05.52.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-09 04:23 . 2009-09-09 06:28 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
- 2009-09-09 04:23 . 2009-09-09 04:23 65024 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF15.exe
+ 2009-09-09 04:23 . 2009-09-09 06:28 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
- 2009-09-09 04:23 . 2009-09-09 04:23 18944 c:\windows\Installer\{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}\IconCDDCBBF13.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-09-04 1994480]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2009-09-05 18:23 87352 ----a-w- c:\windows\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\run-]
"ctfmon.exe"=c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\TightVNC\\WinVNC.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"d:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business 2009.SP2\\RpcAgentSrv.exe"=
"d:\\Program Files\\SiSoftware\\SiSoftware Sandra Professional Business 2009.SP2\\WNt500x86\\RpcSandraSrv.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"d:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
"c:\\Program Files\\Sierra\\FEAR\\FEARXP\\FEARXP.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboo t.sys [9/8/2009 10:21 AM 28544]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [9/4/2009 2:50 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [9/4/2009 2:49 PM 74480]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [8/11/2008 12:41 PM 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sy s [9/6/2009 12:00 AM 47640]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;d:\program files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe [4/29/2009 4:00 PM 98488]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [9/4/2009 2:50 PM 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [8/9/2009 9:55 PM 356920]
S3 V0230Vfx;V0230Vfx;c:\windows\system32\drivers\V023 0Vfx.sys [7/13/2009 1:42 AM 6272]
S3 V0230VID;Live! Cam Video IM Pro;c:\windows\system32\drivers\V0230VID.sys [7/13/2009 1:42 AM 500608]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://search.speedbit.com/
mWindow Title =
IE: &Clean Traces - d:\program files\DAP\Privacy Package\dapcleanerie.htm
IE: &Download with &DAP - d:\program files\DAP\dapextie.htm
IE: Download &all with DAP - d:\program files\DAP\dapextie2.htm
Name-Space Handler: ftp\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\progra~1\DAP\dapie.dll
Name-Space Handler: http\ZDA - {5BFA1DAF-5EDC-11D2-959E-00C00C02DA5E} - d:\progra~1\DAP\dapie.dll
FF - ProfilePath - c:\documents and settings\les wilson\Application Data\Mozilla\Firefox\Profiles\0828hlo5.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com
FF - component: d:\program files\DAP\DAPFireFox\components\DAPFireFox.dll
FF - plugin: c:\documents and settings\les wilson\Application Data\Move Networks\plugins\npqmp071503000010.dll
FF - plugin: c:\documents and settings\les wilson\Application Data\Mozilla\Firefox\Profiles\0828hlo5.default\ext ensions\LogMeInClient@logmein.com\plugins\npRACtrl .dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-09-10 00:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1202660629-1960408961-682003330-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:ba,60,90,d5,6e,1a,65,22,bb,d2,a9,56,df,84 ,7c,23,cb,d4,4a,5b,65,bf,22,
9f,df,27,5a,37,f8,6e,22,f5,4b,b8,2c,6e,3a,c8,d2,ad ,25,b5,65,29,58,63,f6,6f,\
"??"=hex:57,f3,6f,7d,80,e3,a9,f6,e3,91,56,0e,7b,62 ,53,00

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macrome d\\Flash\\FlashUtil10c.exe,-101"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUt il10c.exe"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{1911415 6-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"

[HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4 C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\WININET.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\LMIRfsClientNP.dll
.
Completion time: 2009-09-10 0:15
ComboFix-quarantined-files.txt 2009-09-10 07:15
ComboFix2.txt 2009-09-09 05:56

Pre-Run: 70,380,277,760 bytes free
Post-Run: 70,344,794,112 bytes free

273 --- E O F --- 2009-08-26 13:51

New HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:25:19 AM, on 9/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\fool\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = SpeedBit Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4958 bytes

**broni** · 11-09-2009

Uninstall Combofix:
Go Start > Run
Type in:
combofix /u
Note the space between the "combofix" and the "/u"
Restart computer.

Print these instructions out.

NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

STEP 1. Download SUPERAntiSpyware Free for Home Users:
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: SUPERAntiSpyware.com - Database Definition Information.)
* Close SUPERAntiSpyware.

PHYSICALLY DISCONNECT FROM THE INTERNET

Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

* Open SUPERAntiSpyware.
* Click Scan your Computer... button.
* Click Scanning Preferences/Control Center... button.
* Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* On the left, make sure you check C:\Fixed Drive.
* On the right, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.

RECONNECT TO THE INTERNET

RESTART COMPUTER!

STEP 2. Download Malwarebytes' Anti-Malware: Malwarebytes.org to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

RESTART COMPUTER!

STEP 3.
Post fresh HijackThis log.
NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
Do NOT attempt to "fix" anything!

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

**Injigo** · 12-09-2009

Alright, no problems with any of that.

SUPERAntiSpyware Log:

SUPERAntiSpyware Scan Log
SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

Generated 09/12/2009 at 07:01 AM

Application Version : 4.28.1010

Core Rules Database Version : 4096
Trace Rules Database Version: 2036

Scan type : Complete Scan
Total Scan Time : 03:49:53

Memory items scanned : 223
Memory threats detected : 0
Registry items scanned : 5330
Registry threats detected : 0
File items scanned : 133130
File threats detected : 2

Adware.Vundo/Variant-MSFake
C:\PROGRAM FILES\TSUNAMI-FILTER-PACK\GRAPHEDT.EXE
C:\WINDOWS\SYSTEM32\XCDSRC.AX

MBAM Log:

Malwarebytes' Anti-Malware 1.41
Database version: 2784
Windows 5.1.2600 Service Pack 3

9/12/2009 8:23:59 AM
mbam-log-2009-09-12 (08-23-59).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 185714
Time elapsed: 27 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 6
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\BN (Trojan.Ambler) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\D1 (Trojan.Ambler) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\D2 (Trojan.Ambler) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\D3 (Trojan.Ambler) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\gd (Trojan.Ambler) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\MSN\pr (Trojan.Ambler) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

HijackThis Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:30:59 AM, on 9/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\LogMeIn\x86\RaMaint.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\fool\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = SpeedBit Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O8 - Extra context menu item: &Clean Traces - D:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - D:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: Download &all with DAP - D:\Program Files\DAP\dapextie2.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {0D41B8C5-2599-4893-8183-00195EC8D5F9} (asusTek_sysctrl Class) - http://support.asus.com/common/asusTek_sys_ctrl.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exe
O23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - D:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 5070 bytes

[Resolved] Hijack Log - Malware??

[Resolved] Hijack Log - Malware??

Similar Threads

Malware problems

[Resolved] Malware in my AV!

[RESOLVED] Dreaded CiD & Malware

Malware Problem!(RESOLVED)

Hijack this log - Malware help XP Thanks!