[Resolved] My PC is infected, HijackThis Log attached

  1. 19-12-2009  #1
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member

    [Resolved] My PC is infected, HijackThis Log attached

    Hi,
    My brother connected a USB thumb-drive that infected the PC with something. The PC now is slow, i noticed "winhelp.exe" is taking a lot of CPU resources. The "Show hidden files & folders" option doesn't work, every time i change it, it goes back to "Do not show...". The taskbar is divided to 2 parts, so any program that's open appears twice down in the taskbar!!!


    I posted a picture with the results of Spybot - S&D; the 3 problems there keep appearing every time i scan even after i click "Fix selected problems" and "Win32.Autoit" never gets deleted even if i scan in safe mode or after a restart before everything else loads.

    The results from AVG Anti-Virus:
    PUP - Potentially harmful program Logger.CWN - C:\WINDOWS\system32\rundll.exe
    Infection - Virus identified Worm/Downadup - C:\WINDOWS\system32\ghpjqtks.dll

    This is the HijackThis Log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:55:19 AM, on 12/19/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Winhelp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\system32\cisvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\MICROS~3\rapimgr.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    F2 - REG:system.ini: Shell=Explorer.exe rundll.exe
    O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
    O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
    O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
    O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2716A1B0-98A7-4BDB-B1D9-E47E121FCBF9}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{60560590-E52A-4390-8E3D-8F5396D7EFE4}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EECE9AE5-6996-45B8-A1FB-1F3D13FF1CAF}: NameServer = 212.72.1.186,212.72.23.4
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

    --
    End of file - 7239 bytes


    This is the Uninstall List:

    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Flash Player 9 ActiveX
    Adobe Reader 7.1.0
    Apple Software Update
    Application Suite
    AVG Free 8.5
    CCleaner (remove only)
    Compatibility Pack for the 2007 Office system
    DivX Codec
    DivX Converter
    DivX Player
    DivX Web Player
    DustBuster 2.9.5.1
    FinePrint
    HijackThis 2.0.2
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Intel(R) Extreme Graphics 2 Driver
    J2SE Runtime Environment 5.0 Update 1
    Java 2 Runtime Environment, SE v1.4.1_06
    Java DB 10.3.1.4
    Java Web Start
    Java(TM) 6 Update 17
    Java(TM) 6 Update 3
    Java(TM) 6 Update 5
    Java(TM) 6 Update 7
    Lexisgoo version 3.0
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 3.5 SP1
    Microsoft ActiveSync
    Microsoft Choice Guard
    Microsoft Maren
    Microsoft Office Professional Edition 2003
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Mozilla Firefox (3.0.16)
    MSVCRT
    MSXML 6 Service Pack 2 (KB973686)
    Network Magic
    Orbit Downloader
    QuickTime
    RealPlayer
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB974455)
    Security Update for Windows Internet Explorer 8 (KB976325)
    Segoe UI
    SopCast 3.0.3
    Spybot - Search & Destroy
    Stamina 2.5
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Windows Internet Explorer 8 (KB975364)
    Update for Windows Internet Explorer 8 (KB976749)
    Veetle TV 0.9.14
    VideoLAN VLC media player 0.8.6i
    WebEx Support Manager for Internet Explorer
    Winamp
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 8
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Essentials
    Windows Live Essentials
    Windows Live installer
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    WinRAR archiver
    Xvid 1.1.3 final uninstall
    Yahoo! Messenger
    Attached Images
    Last edited by ThuG_PoeT; 19-12-2009 at 08:44 AM. Reason: Added the pictures
  2. 19-12-2009  #2
    broni
    broni is offline Senior Member
    Please download ComboFix from Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    • Please, never rename Combofix unless instructed.
    • Close any open browsers.
    • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

    NOTE. If Combofix asks you to install Recovery Console, please allow it.

    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    • Double click on combofix.exe & follow the prompts.
    • When finished, it will produce a report for you.
    • Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  3. 20-12-2009  #3
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    ComboFix 09-12-19.01 - Admin 12/20/2009 12:22:00.1.1 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.250 [GMT 4:00]
    Running from: c:\documents and settings\Admin\Desktop\KittyFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\regsvr.exe
    c:\windows\system32\regsvr.exe
    c:\windows\system32\setup.ini
    c:\windows\system32\winhelp.exe
    c:\windows\winhelp.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CBEVTSVC


    ((((((((((((((((((((((((( Files Created from 2009-11-20 to 2009-12-20 )))))))))))))))))))))))))))))))
    .

    2009-12-18 14:02 . 2009-12-18 14:02 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
    2009-12-16 15:59 . 2009-10-16 11:50 2520888 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\npTVUAx.dl l
    2009-12-16 15:59 . 2006-10-16 14:44 196608 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\ssleay32.d ll
    2009-12-16 15:59 . 2008-03-04 14:52 286720 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\libcurl.dl l
    2009-12-16 15:59 . 2007-10-31 05:39 59904 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\zlib1.dll
    2009-12-16 15:59 . 2007-05-17 09:58 143360 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\libexpatw. dll
    2009-12-16 15:59 . 2006-10-18 13:32 499712 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\msvcp71.dl l
    2009-12-16 15:59 . 2006-10-18 13:32 348160 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\msvcr71.dl l
    2009-12-16 15:59 . 2006-10-16 14:44 1028096 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\libeay32.d ll
    2009-12-14 05:20 . 2009-12-14 05:20 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCach e
    2009-12-10 04:51 . 2009-12-10 04:51 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-12-04 09:20 . 2009-12-04 09:20 152576 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-11-28 16:28 . 2009-12-04 09:20 79488 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-11-25 12:42 . 2009-11-25 12:42 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
    2009-11-25 11:47 . 2009-11-25 11:47 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2009-11-25 11:37 . 2009-11-25 11:37 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
    2009-11-25 11:31 . 2009-12-09 20:06 -------- d-----w- c:\windows\ie8updates
    2009-11-25 11:26 . 2009-11-25 11:29 -------- dc-h--w- c:\windows\ie8

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-12-20 07:51 . 2008-08-02 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-12-19 19:23 . 2008-08-04 14:08 -------- d-----w- c:\documents and settings\Admin\Application Data\Orbit
    2009-12-18 14:08 . 2009-05-22 11:59 -------- d-----w- c:\program files\Winamp
    2009-12-18 14:08 . 2009-05-24 16:03 -------- d-----w- c:\program files\SopCast
    2009-12-18 14:08 . 2008-08-04 14:08 -------- d-----w- c:\program files\Orbitdownloader
    2009-12-18 14:08 . 2008-03-21 02:17 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-12-18 14:08 . 2009-05-05 18:45 -------- d-----w- c:\program files\EP-Dog
    2009-12-18 14:08 . 2008-09-04 14:02 -------- d-----w- c:\documents and settings\Admin\Application Data\uTorrent
    2009-12-18 14:08 . 2009-01-23 08:17 -------- d-----w- c:\documents and settings\Admin\Application Data\LimeWire
    2009-12-18 14:08 . 2008-04-25 10:21 -------- d-----w- c:\documents and settings\Admin\Application Data\FrostWire
    2009-12-18 14:08 . 2008-03-20 05:04 -------- d-----w- c:\documents and settings\Admin\Application Data\MP3Rocket
    2009-12-18 12:06 . 2008-12-08 17:34 -------- d-----w- c:\program files\HTV
    2009-12-18 11:07 . 2008-08-02 12:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-11 20:37 . 2009-05-22 11:59 -------- d-----w- c:\documents and settings\Admin\Application Data\Winamp
    2009-12-04 09:32 . 2008-03-04 00:03 -------- d-----w- c:\program files\Java
    2009-11-27 19:47 . 2004-08-03 21:14 360320 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
    2009-11-27 19:47 . 2008-08-02 14:42 360320 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
    2009-11-27 08:28 . 2009-11-06 07:05 2063640 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
    2009-11-27 08:27 . 2009-11-03 05:11 3514648 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
    2009-11-27 08:27 . 2009-11-03 05:11 2029336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
    2009-11-15 14:08 . 2008-03-03 23:40 61632 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-11-15 14:02 . 2009-11-15 14:02 -------- d-----w- c:\program files\MSECache
    2009-11-08 11:08 . 2009-06-23 11:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Networks
    2009-11-08 10:43 . 2009-11-08 10:43 -------- d-----w- c:\program files\Pure Networks
    2009-11-08 10:24 . 2009-11-08 10:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
    2009-11-08 10:24 . 2009-11-08 10:23 -------- d-----w- c:\program files\WebEx
    2009-11-08 10:23 . 2009-11-08 10:23 8892928 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
    2009-11-08 10:20 . 2009-11-08 10:20 -------- d-----w- c:\program files\Common Files\Pure Networks Shared
    2009-11-08 10:16 . 2009-05-30 19:00 -------- d-----w- c:\program files\Linksys
    2009-11-06 12:22 . 2009-07-17 18:07 -------- d-----w- c:\program files\Microsoft
    2009-11-06 12:22 . 2009-11-06 12:22 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-11-06 12:21 . 2008-03-04 23:27 -------- d-----w- c:\program files\Windows Live
    2009-11-05 15:01 . 2009-11-05 15:01 -------- d-----w- c:\program files\Stamina
    2009-10-29 07:45 . 2004-08-03 22:56 916480 ----a-w- c:\windows\system32\wininet.dll
    2009-10-21 06:00 . 2004-08-03 22:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 06:00 . 2004-08-03 22:56 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 14:58 . 2004-08-03 21:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-13 10:53 . 2004-08-03 22:56 266752 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:54 . 2004-08-03 22:56 69632 ----a-w- c:\windows\system32\raschap.dll
    2009-10-12 13:54 . 2004-08-03 22:56 112128 ----a-w- c:\windows\system32\rastls.dll
    2009-10-11 00:17 . 2008-07-13 13:09 411368 ----a-w- c:\windows\system32\deploytk.dll
    .

    ------- Sigcheck -------

    [-] 2009-11-27 . 3ADCE4790F591BF160A94F6F08039577 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\TCPIP.SYS
    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57a bdc0ea2f5d4e132d055ba4e\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
    "nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-11-27 472112]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-08-15 04:17 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
    "c:\\Program Files\\SopCast\\SopCast.exe"=
    "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
    "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"= c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "20433:TCP"= 20433:TCP:BitComet 20433 TCP
    "20433:UDP"= 20433:UDP:BitComet 20433 UDP
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    "67:UDP"= 67:UDPHCP Discovery Service

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/26/2008 2:15 AM 335240]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/16/2009 9:31 AM 297752]
    S1 EPPSCSIx;EPPSCSIx;c:\windows\system32\drivers\EPPS CSI.SYS --> c:\windows\system32\drivers\EPPSCSI.SYS [?]
    S2 fmffym;Monitor Image;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 2:56 AM 14336]
    S2 mrfllv;Support Shell;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 2:56 AM 14336]
    S2 tqrlgswp;Image Monitor;c:\windows\system32\svchost.exe -k netsvcs [8/4/2004 2:56 AM 14336]
    S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [8/25/2008 6:18 AM 61536]
    S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [8/25/2008 6:18 AM 9360]
    S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [8/25/2008 6:18 AM 97088]
    S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [8/25/2008 6:19 AM 88624]
    S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [8/25/2008 6:21 AM 18704]
    S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [8/25/2008 6:18 AM 86432]
    S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [8/25/2008 6:21 AM 90800]
    S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [7/18/2008 7:48 PM 2383256]

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
    fmffym
    mrfllv
    tqrlgswp

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7E6FA2FF-CC41-4145-9C06-19C1F78DF855}]
    2009-06-23 10:35 16624 ----a-w- c:\program files\Microsoft\Microsoft Maren\Bin\reg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{970EA2E9-E7B8-45E1-9CB5-0DEB37C2C28D}]
    2009-06-25 19:50 422672 ----a-w- c:\program files\Microsoft\Microsoft Maren\Bin\TextService.dll
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.bing.com/
    IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    TCP: {2716A1B0-98A7-4BDB-B1D9-E47E121FCBF9} = 212.72.1.186,212.72.23.4
    TCP: {60560590-E52A-4390-8E3D-8F5396D7EFE4} = 212.72.1.186,212.72.23.4
    TCP: {EECE9AE5-6996-45B8-A1FB-1F3D13FF1CAF} = 212.72.1.186,212.72.23.4
    FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\
    FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.d-a-l.com/help/spyware-adware-viruses-hijackthis-logs/67463-my-pc-infected-hijackthis-log.html#post230324
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\npr pbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\npTVUAx.dl l
    FF - plugin: c:\program files\Veetle\Player\npvlc.dll
    FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .
    - - - - ORPHANS REMOVED - - - -

    HKU-Default-Run-Yahoo Messengger - c:\windows\system32\regsvr.exe



    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-12-20 12:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\f mffym]
    "ServiceDll"="c:\windows\system32\ghpjqtks.dll "
    --

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\m rfllv]
    "ServiceDll"="c:\windows\system32\ghpjqtks.dll "
    --

    [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\t qrlgswp]
    "ServiceDll"="c:\windows\system32\ghpjqtks.dll "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(3500)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\SOUNDMAN.EXE
    c:\program files\Microsoft ActiveSync\wcescomm.exe
    c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    c:\progra~1\MICROS~3\rapimgr.exe
    c:\progra~1\AVG\AVG8\avgrsx.exe
    c:\windows\system32\wscntfy.exe
    .
    ************************************************** ************************
    .
    Completion time: 2009-12-20 12:36:02 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-12-20 08:35

    Pre-Run: 5,985,656,832 bytes free
    Post-Run: 5,924,155,392 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

    - - End Of File - - 6B997EE3E7F8DE9AB0EC39CDC736E2BF
  4. 20-12-2009  #4
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:41:19 PM, on 12/20/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\MICROS~3\rapimgr.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
    O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
    O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
    O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2716A1B0-98A7-4BDB-B1D9-E47E121FCBF9}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{60560590-E52A-4390-8E3D-8F5396D7EFE4}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EECE9AE5-6996-45B8-A1FB-1F3D13FF1CAF}: NameServer = 212.72.1.186,212.72.23.4
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

    --
    End of file - 6821 bytes
  5. 20-12-2009  #5
    broni
    broni is offline Senior Member
    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.


    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\system32\ghpjqtks.dll

Folder::

Driver::
fmffym
mrfllv
tqrlgswp

NetSvc::
fmffym
mrfllv
tqrlgswp


Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\fmffym]
"ServiceDll"=-
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\mrfllv]
"ServiceDll"=-
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\tqrlgswp]
"ServiceDll"=-

RegLockDel::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.




    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
  6. 21-12-2009  #6
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    ComboFix 09-12-20.03 - Admin 12/21/2009 10:47:19.2.1 - x86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.503.256 [GMT 4:00]
    Running from: c:\documents and settings\Admin\Desktop\KittyFix.exe
    Command switches used :: c:\documents and settings\Admin\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    FILE ::
    "c:\windows\system32\ghpjqtks.dll"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_FMFFYM
    -------\Legacy_MRFLLV
    -------\Legacy_TQRLGSWP
    -------\Service_fmffym
    -------\Service_mrfllv
    -------\Service_tqrlgswp


    ((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
    .

    2009-12-18 14:02 . 2009-12-18 14:02 -------- d-sh--w- c:\documents and settings\Admin\IECompatCache
    2009-12-14 05:20 . 2009-12-14 05:20 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCach e
    2009-12-10 04:51 . 2009-12-10 04:51 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
    2009-11-25 12:42 . 2009-11-25 12:42 -------- d-sh--w- c:\documents and settings\Admin\PrivacIE
    2009-11-25 11:47 . 2009-11-25 11:47 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
    2009-11-25 11:37 . 2009-11-25 11:37 -------- d-sh--w- c:\documents and settings\Admin\IETldCache
    2009-11-25 11:31 . 2009-12-09 20:06 -------- d-----w- c:\windows\ie8updates
    2009-11-25 11:26 . 2009-11-25 11:29 -------- dc-h--w- c:\windows\ie8

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
    .
    2009-12-20 07:51 . 2008-08-02 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-12-19 19:23 . 2008-08-04 14:08 -------- d-----w- c:\documents and settings\Admin\Application Data\Orbit
    2009-12-18 14:08 . 2009-05-22 11:59 -------- d-----w- c:\program files\Winamp
    2009-12-18 14:08 . 2009-05-24 16:03 -------- d-----w- c:\program files\SopCast
    2009-12-18 14:08 . 2008-08-04 14:08 -------- d-----w- c:\program files\Orbitdownloader
    2009-12-18 14:08 . 2008-03-21 02:17 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-12-18 14:08 . 2009-05-05 18:45 -------- d-----w- c:\program files\EP-Dog
    2009-12-18 14:08 . 2008-09-04 14:02 -------- d-----w- c:\documents and settings\Admin\Application Data\uTorrent
    2009-12-18 14:08 . 2009-01-23 08:17 -------- d-----w- c:\documents and settings\Admin\Application Data\LimeWire
    2009-12-18 14:08 . 2008-04-25 10:21 -------- d-----w- c:\documents and settings\Admin\Application Data\FrostWire
    2009-12-18 14:08 . 2008-03-20 05:04 -------- d-----w- c:\documents and settings\Admin\Application Data\MP3Rocket
    2009-12-18 12:06 . 2008-12-08 17:34 -------- d-----w- c:\program files\HTV
    2009-12-18 11:07 . 2008-08-02 12:57 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2009-12-11 20:37 . 2009-05-22 11:59 -------- d-----w- c:\documents and settings\Admin\Application Data\Winamp
    2009-12-04 09:32 . 2008-03-04 00:03 -------- d-----w- c:\program files\Java
    2009-12-04 09:20 . 2009-12-04 09:20 152576 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
    2009-12-04 09:20 . 2009-11-28 16:28 79488 ----a-w- c:\documents and settings\Admin\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
    2009-11-27 19:47 . 2004-08-03 21:14 360320 ----a-w- c:\windows\system32\drivers\TCPIP.SYS
    2009-11-27 19:47 . 2008-08-02 14:42 360320 ----a-w- c:\windows\system32\drivers\TCPIP.SYS.ORIGINAL
    2009-11-27 08:28 . 2009-11-06 07:05 2063640 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
    2009-11-27 08:27 . 2009-11-03 05:11 3514648 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
    2009-11-27 08:27 . 2009-11-03 05:11 2029336 ----a-w- c:\documents and settings\All Users\Application Data\avg8\update\backup\avgtray.exe
    2009-11-15 14:08 . 2008-03-03 23:40 61632 ----a-w- c:\documents and settings\Admin\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-11-15 14:02 . 2009-11-15 14:02 -------- d-----w- c:\program files\MSECache
    2009-11-08 11:08 . 2009-06-23 11:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Pure Networks
    2009-11-08 10:43 . 2009-11-08 10:43 -------- d-----w- c:\program files\Pure Networks
    2009-11-08 10:24 . 2009-11-08 10:24 -------- d-----w- c:\documents and settings\All Users\Application Data\Hewlett-Packard
    2009-11-08 10:24 . 2009-11-08 10:23 -------- d-----w- c:\program files\WebEx
    2009-11-08 10:23 . 2009-11-08 10:23 8892928 ----a-w- c:\documents and settings\All Users\Application Data\atscie.msi
    2009-11-08 10:20 . 2009-11-08 10:20 -------- d-----w- c:\program files\Common Files\Pure Networks Shared
    2009-11-08 10:16 . 2009-05-30 19:00 -------- d-----w- c:\program files\Linksys
    2009-11-06 12:22 . 2009-07-17 18:07 -------- d-----w- c:\program files\Microsoft
    2009-11-06 12:22 . 2009-11-06 12:22 -------- d-----w- c:\program files\Windows Live SkyDrive
    2009-11-06 12:21 . 2008-03-04 23:27 -------- d-----w- c:\program files\Windows Live
    2009-11-05 15:01 . 2009-11-05 15:01 -------- d-----w- c:\program files\Stamina
    2009-10-29 07:45 . 2004-08-03 22:56 916480 ------w- c:\windows\system32\wininet.dll
    2009-10-21 06:00 . 2004-08-03 22:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
    2009-10-21 06:00 . 2004-08-03 22:56 25088 ----a-w- c:\windows\system32\httpapi.dll
    2009-10-20 14:58 . 2004-08-03 21:00 263552 ----a-w- c:\windows\system32\drivers\http.sys
    2009-10-16 11:50 . 2009-12-16 15:59 2520888 ----a-w- c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\npTVUAx.dl l
    2009-10-13 10:53 . 2004-08-03 22:56 266752 ----a-w- c:\windows\system32\oakley.dll
    2009-10-12 13:54 . 2004-08-03 22:56 69632 ----a-w- c:\windows\system32\raschap.dll
    2009-10-12 13:54 . 2004-08-03 22:56 112128 ----a-w- c:\windows\system32\rastls.dll
    2009-10-11 00:17 . 2008-07-13 13:09 411368 ----a-w- c:\windows\system32\deploytk.dll
    .

    ------- Sigcheck -------

    [-] 2009-11-27 . 3ADCE4790F591BF160A94F6F08039577 . 360320 . . [5.1.2600.3394] . . c:\windows\system32\drivers\TCPIP.SYS
    [7] 2008-06-20 . AD978A1B783B5719720CFF204B666C8E . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    [7] 2008-06-20 . 9AEFA14BD6B182D61E3119FA5F436D3D . 361600 . . [5.1.2600.5625] . . c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    [7] 2008-06-20 . 744E57C99232201AE98C49168B918F48 . 360960 . . [5.1.2600.3394] . . c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    [-] 2008-04-13 . 93EA8D04EC73A85DB02EB8805988F733 . 361344 . . [5.1.2600.5512] . . c:\windows\SoftwareDistribution\Download\9866fb57a bdc0ea2f5d4e132d055ba4e\tcpip.sys
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "SoundMan"="SOUNDMAN.EXE" [2003-06-10 55296]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-12-12 2043160]
    "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
    "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
    "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2009-07-07 647216]
    "nmapp"="c:\program files\Pure Networks\Network Magic\nmapp.exe" [2009-11-27 472112]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-4-23 29696]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-08-15 04:17 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\Java\\jre1.6.0_05\\bin\\javaw.exe"=
    "c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
    "c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
    "c:\\Program Files\\SopCast\\SopCast.exe"=
    "c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
    "c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
    "c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "c:\\Program Files\\uTorrent\\uTorrent.exe"=
    "c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe"= c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe:LocalSubNet,0.0.0.0/255.255.255.255:Enabled:Pure Networks Platform Service

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "20433:TCP"= 20433:TCP:BitComet 20433 TCP
    "20433:UDP"= 20433:UDP:BitComet 20433 UDP
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    "67:UDP"= 67:UDP:DHCP Discovery Service

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\IcmpSettings]
    "AllowInboundEchoRequest"= 1 (0x1)

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/26/2008 2:15 AM 335240]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/16/2009 9:31 AM 297752]
    S1 EPPSCSIx;EPPSCSIx;c:\windows\system32\drivers\EPPS CSI.SYS --> c:\windows\system32\drivers\EPPSCSI.SYS [?]
    S3 sea1bus;Sony Ericsson Device 0A1 driver (WDM);c:\windows\system32\drivers\sea1bus.sys [8/25/2008 6:18 AM 61536]
    S3 sea1mdfl;Sony Ericsson Device 0A1 USB WMC Modem Filter;c:\windows\system32\drivers\sea1mdfl.sys [8/25/2008 6:18 AM 9360]
    S3 sea1mdm;Sony Ericsson Device 0A1 USB WMC Modem Driver;c:\windows\system32\drivers\sea1mdm.sys [8/25/2008 6:18 AM 97088]
    S3 sea1mgmt;Sony Ericsson Device 0A1 USB WMC Device Management Drivers (WDM);c:\windows\system32\drivers\sea1mgmt.sys [8/25/2008 6:19 AM 88624]
    S3 sea1nd5;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (NDIS);c:\windows\system32\drivers\sea1nd5.sys [8/25/2008 6:21 AM 18704]
    S3 sea1obex;Sony Ericsson Device 0A1 USB WMC OBEX Interface;c:\windows\system32\drivers\sea1obex.sys [8/25/2008 6:18 AM 86432]
    S3 sea1unic;Sony Ericsson Device 0A1 USB Ethernet Emulation SEMCA1 (WDM);c:\windows\system32\drivers\sea1unic.sys [8/25/2008 6:21 AM 90800]
    S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [7/18/2008 7:48 PM 2383256]

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7E6FA2FF-CC41-4145-9C06-19C1F78DF855}]
    2009-06-23 10:35 16624 ----a-w- c:\program files\Microsoft\Microsoft Maren\Bin\reg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{970EA2E9-E7B8-45E1-9CB5-0DEB37C2C28D}]
    2009-06-25 19:50 422672 ----a-w- c:\program files\Microsoft\Microsoft Maren\Bin\TextService.dll
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.bing.com/
    IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
    IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
    IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
    IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    TCP: {2716A1B0-98A7-4BDB-B1D9-E47E121FCBF9} = 212.72.1.186,212.72.23.4
    TCP: {60560590-E52A-4390-8E3D-8F5396D7EFE4} = 212.72.1.186,212.72.23.4
    TCP: {EECE9AE5-6996-45B8-A1FB-1F3D13FF1CAF} = 212.72.1.186,212.72.23.4
    FF - ProfilePath - c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\
    FF - prefs.js: browser.search.selectedEngine - YouTube Video Search
    FF - prefs.js: browser.startup.homepage - hxxp://www.d-a-l.com/help/spyware-adware-viruses-hijackthis-logs/67463-my-pc-infected-hijackthis-log.html#post230324
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\Real\RealPlayer\browserrecord\components\npr pbrowserrecordplugin.dll
    FF - plugin: c:\documents and settings\Admin\Application Data\Mozilla\Firefox\Profiles\w0jz98i4.default\ext ensions\firefox@tvunetworks.com\plugins\npTVUAx.dl l
    FF - plugin: c:\program files\Veetle\Player\npvlc.dll
    FF - plugin: c:\program files\Veetle\plugins\npVeetle.dll
    FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
    .

    ************************************************** ************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
    Rootkit scan 2009-12-21 10:55
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    ************************************************** ************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2528)
    c:\windows\system32\WININET.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Java\jre6\bin\jqs.exe
    c:\windows\SOUNDMAN.EXE
    c:\program files\Microsoft ActiveSync\wcescomm.exe
    c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    c:\progra~1\MICROS~3\rapimgr.exe
    c:\progra~1\AVG\AVG8\avgrsx.exe
    c:\windows\system32\wscntfy.exe
    .
    ************************************************** ************************
    .
    Completion time: 2009-12-21 11:00:25 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-12-21 07:00
    ComboFix2.txt 2009-12-20 08:36

    Pre-Run: 5,935,296,512 bytes free
    Post-Run: 5,902,946,304 bytes free

    - - End Of File - - 4CAD2FD5CE436FAFEA4A9CF0DDB32E36
    Last edited by ThuG_PoeT; 21-12-2009 at 02:44 PM.
  7. 21-12-2009  #7
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:26:23 PM, on 12/21/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Pure Networks\Network Magic\nmapp.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\PROGRA~1\MICROS~3\rapimgr.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = Hotmail, News, Sport, Music, Movies, Money, Cars, Shopping, Windows Live from MSN UK
    O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [nmctxth] "C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe"
    O4 - HKLM\..\Run: [nmapp] "C:\Program Files\Pure Networks\Network Magic\nmapp.exe" -autorun -nosplash
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
    O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
    O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
    O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2716A1B0-98A7-4BDB-B1D9-E47E121FCBF9}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{60560590-E52A-4390-8E3D-8F5396D7EFE4}: NameServer = 212.72.1.186,212.72.23.4
    O17 - HKLM\System\CCS\Services\Tcpip\..\{EECE9AE5-6996-45B8-A1FB-1F3D13FF1CAF}: NameServer = 212.72.1.186,212.72.23.4
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: Pure Networks Platform Service (nmservice) - Cisco Systems, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe

    --
    End of file - 6820 bytes
  8. 21-12-2009  #8
    broni
    broni is offline Senior Member
    Very good

    Uninstall Combofix:
    Go Start > Run [Vista users, go Start>"Start search"]
    Type in:
    Combofix /Uninstall
    Note the space between the "Combofix" and the "/Uninstall"
    Restart computer.

    ================================================== ============

    Print these instructions out.

    NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe

    ***VERY IMPORTANT! Make sure, you update Superantispyware, and Malwarebytes before running the scans.***

    STEP 1. Download SUPERAntiSpyware Free for Home Users:
    SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

    * Double-click SUPERAntiSpyware.exe and use the default settings for installation.
    * An icon will be created on your desktop. Double-click that icon to launch the program.
    * If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: SUPERAntiSpyware.com - Database Definition Information.)
    * Close SUPERAntiSpyware.

    PHYSICALLY DISCONNECT FROM THE INTERNET

    Restart computer in Safe Mode.
    To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen

    * Open SUPERAntiSpyware.
    * Click Scan your Computer... button.
    * Click Scanning Preferences/Control Center... button.
    * Under General and Startup tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
    * Click the Scanning Control tab.
    * Under Scanner Options make sure the following are checked (leave all others unchecked):
    - Close browsers before scanning.
    - Terminate memory threats before quarantining.
    * Click the Close button to leave the control center screen.
    * On the left, make sure you check C:\Fixed Drive.
    * On the right, choose Perform Complete Scan.
    * Click Next to start the scan. Please be patient while it scans your computer.
    * After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
    * Make sure everything has a checkmark next to it and click Next.
    * A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
    * If asked if you want to reboot, click Yes.
    * To retrieve the removal information after reboot, launch SUPERAntispyware again.
    - Click Preferences, then click the Statistics/Logs tab.
    - Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
    - If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
    - Please copy and paste the Scan Log results in your next reply.
    * Click Close to exit the program.
    Post SUPERAntiSpyware log.

    RECONNECT TO THE INTERNET

    RESTART COMPUTER!

    STEP 2. Download Malwarebytes' Anti-Malware: Malwarebytes.org to your desktop.
    (Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform full scan, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad.
    * Post the log back here.

    The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
    Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

    RESTART COMPUTER!

    STEP 3.
    Post fresh HijackThis log.
    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
    Do NOT attempt to "fix" anything!


    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
  9. 23-12-2009  #9
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    SUPERAntiSpyware Scan Log
    SUPERAntiSpyware.com | Remove Malware | Remove Spyware - AntiMalware, AntiSpyware, AntiAdware!

    Generated 12/23/2009 at 02:57 AM

    Application Version : 4.32.1000

    Core Rules Database Version : 4402
    Trace Rules Database Version: 2235

    Scan type : Complete Scan
    Total Scan Time : 02:25:43

    Memory items scanned : 213
    Memory threats detected : 0
    Registry items scanned : 4903
    Registry threats detected : 0
    File items scanned : 39940
    File threats detected : 1

    Adware.Vundo/Variant-MSFake
    C:\WINDOWS\SYSTEM32\COMCTL32.OCX
  10. 23-12-2009  #10
    ThuG_PoeT
    ThuG_PoeT is offline Elite Member
    Save 20% on AVG Internet Security 2012 Suite!
    Malwarebytes' Anti-Malware 1.42
    Database version: 3411
    Windows 5.1.2600 Service Pack 2
    Internet Explorer 8.0.6001.18702

    12/23/2009 4:31:04 AM
    mbam-log-2009-12-23 (04-31-04).txt

    Scan type: Full Scan (C:\|D:\|E:\|F:\|)
    Objects scanned: 151521
    Time elapsed: 1 hour(s), 2 minute(s), 16 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 21
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 8

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\gnucdna.core (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{284477e4-a7cb-4055-9e1b-0ea7cba28945} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{c636f1fc-6ae4-4e6a-90ab-6d61d821a0dd} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fc94a0f7-9c7c-4ae2-9106-5c212332b209} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{c13d4627-02f5-4b03-897a-bf6a90022dd2} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{a916af3c-976d-4358-8736-95bea0b5fd2c} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{e2032ec2-a9ac-4ed7-9bdb-ebecacf076f2} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{d5694dfe-43b6-4e05-aa29-8c556c968973} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{0be385a3-85a5-4722-b677-68dae891ff21} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{ebab4a71-8c34-461a-b57d-dd041d439555} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{f06fea43-0cc3-4bf6-a85b-5efb1c07aa4b} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{272c0d60-0561-4c83-b3db-eb0a71f9d2eb} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{be45f056-e005-437b-be88-23acf70b0b6a} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{f02c0ae1-d796-42c9-81e1-084d88f79b8e} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{cb971ac0-6408-40da-a540-92f9f256f51f} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\TypeLib\{2850bdc7-2330-4e31-9fa0-88268846539a} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{bb5b7e14-f8b4-4365-a24d-f4965c33e1ee} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{89dc33a2-f86f-42a1-8b5f-d4d1943efc9c} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{b86f4810-19a9-4050-9ac9-b5cf60b5799a} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{7468213e-010e-4ec6-a17d-642e909ba7ec} (Adware.WhenU) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{70ca4938-6a0f-4641-a9a9-c936e4c1e7de} (Adware.WhenU) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\SharedDLLs\C:\WINDOWS\system32\GnucDNA. dll (Adware.WhenU) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\WINDOWS\system32\GnucDNA.dll (Adware.WhenU) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000057.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000170.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP3\A0000498.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000347.sys (Rootkit.Agent) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000019.exe (Worm.Sohanad) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000020.exe (Worm.Sohanad) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{75D51D9A-A323-4E7A-8294-8BD1B031D2E3}\RP1\A0000022.exe (Worm.Sohanad) -> Quarantined and deleted successfully.
+ Reply to Thread
Page 1 of 2 1 2 LastLast
« [Resolved] Running Slow Plz check | [Inactive] Very Slow Computer Processing/High Commit Charge »