Jump to content

duffman

Members
 View Profile  See their activity

  • Posts

    3

  • Joined

  • Last visited

 Content Type 

Posts posted by duffman

    can't remove 3 infected registry keys and 1 file

    in Resolved Malware Removal Logs

    Posted

    Thanks for your help with this, I just updated MWB and it appears that it did fix the problems. I will post my HijackThis log below to confirm.

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 10:15:52 AM, on 4/21/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16827)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

    C:\Program Files\Network Associates\VirusScan\Mcshield.exe

    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\system32\nvsvc32.exe

    C:\WINDOWS\Explorer.EXE

    C:\WINDOWS\system32\NOTEPAD.EXE

    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

    C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

    C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Network Associates\Common Framework\McTray.exe

    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

    \bass-spy\auditwizard\scan\lyncusb.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.basshall.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

    O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe

    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} (Infragistics ComboBox Control) - http://bass-mail/timecentre/Common/pvcombo.cab

    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5483.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1215730232189

    O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - http://bass-mail/timecentre/Common/iemenu.cab

    O16 - DPF: {80A9E319-C338-4027-B1E2-FB73B54A326F} (DDExportFiles.clsDDExports) - http://bass-mail/timecentre/reports/DDExportFiles.CAB

    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://bass-mail/arviewer/ActiveReports%20Pro/arview2.cab

    O16 - DPF: {A71B416C-CB2C-45F4-A67C-39EA7532FECF} (ActiveReportExport.ctlExport) - http://bass-mail/timecentre/reports/ActiveReportExport.CAB

    O16 - DPF: {B6C10489-FB89-11D4-93C9-006008A7EED4} (TeeChart Pro Activex control v5) - http://bass-mail/timecentre/Common/teechart5.cab

    O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (Infragistics DataTable Control 8.0 (OLEDB)) - http://bass-mail/timecentre/Common/pvdt80.cab

    O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co....cab?10,0,910,0

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = basshall.com

    O17 - HKLM\Software\..\Telephony: DomainName = basshall.com

    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = basshall.com

    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    O23 - Service: Lync USB Auditor Service (LyncUSBServ) - Unknown owner - \\bass-spy\auditwizard\scan\lyncusb.exe (file missing)

    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

    O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe

    O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe

    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe

    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

    O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\WINDOWS\system32\STacSV.exe

    --

    End of file - 11591 bytes

    can't remove 3 infected registry keys and 1 file

    in Resolved Malware Removal Logs

    Posted

    Below is the HijackThis log, the red lines are what I am unable to remove. In MWB it is recognized as Trojan.Vundo.H. The Keys and file are protected from changing permissions and from being deleted.

    Logfile of Trend Micro HijackThis v2.0.2

    Scan saved at 10:17:47 AM, on 4/17/2009

    Platform: Windows XP SP3 (WinNT 5.01.2600)

    MSIE: Internet Explorer v7.00 (7.00.6000.16827)

    Boot mode: Normal

    Running processes:

    C:\WINDOWS\System32\smss.exe

    C:\WINDOWS\system32\winlogon.exe

    C:\WINDOWS\system32\services.exe

    C:\WINDOWS\system32\lsass.exe

    C:\WINDOWS\system32\svchost.exe

    C:\WINDOWS\System32\svchost.exe

    C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    C:\WINDOWS\system32\spoolsv.exe

    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    C:\Program Files\Bonjour\mDNSResponder.exe

    C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    C:\Program Files\Java\jre6\bin\jqs.exe

    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

    C:\Program Files\Network Associates\VirusScan\Mcshield.exe

    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

    C:\WINDOWS\system32\nvsvc32.exe

    C:\WINDOWS\system32\NOTEPAD.EXE

    \bass-spy\auditwizard\scan\lyncusb.exe

    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE

    C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe

    C:\Program Files\Network Associates\Common Framework\UdaterUI.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

    C:\WINDOWS\system32\ctfmon.exe

    C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    C:\Program Files\Network Associates\Common Framework\McTray.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    C:\WINDOWS\explorer.exe

    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.basshall.com/

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =

    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {428D480A-7303-4E2B-935A-EF7CBDC946EA} - c:\windows\system32\aqlihol.dll

    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

    O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll

    O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE

    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"

    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"

    O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UdaterUI.exe" /StartedFromRunKey

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE

    O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"

    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

    O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe

    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} (Infragistics ComboBox Control) - http://bass-mail/timecentre/Common/pvcombo.cab

    O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab

    O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase5483.cab

    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1215730232189

    O16 - DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} (PopupMenu Object) - http://bass-mail/timecentre/Common/iemenu.cab

    O16 - DPF: {80A9E319-C338-4027-B1E2-FB73B54A326F} (DDExportFiles.clsDDExports) - http://bass-mail/timecentre/reports/DDExportFiles.CAB

    O16 - DPF: {8569D715-FF88-44BA-8D1D-AD3E59543DDE} (ActiveReports Viewer2) - http://bass-mail/arviewer/ActiveReports%20Pro/arview2.cab

    O16 - DPF: {A71B416C-CB2C-45F4-A67C-39EA7532FECF} (ActiveReportExport.ctlExport) - http://bass-mail/timecentre/reports/ActiveReportExport.CAB

    O16 - DPF: {B6C10489-FB89-11D4-93C9-006008A7EED4} (TeeChart Pro Activex control v5) - http://bass-mail/timecentre/Common/teechart5.cab

    O16 - DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} (Infragistics DataTable Control 8.0 (OLEDB)) - http://bass-mail/timecentre/Common/pvdt80.cab

    O16 - DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} (DigWebHelper Class) - http://photos.msn.com/resources/neutral/co....cab?10,0,910,0

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = basshall.com

    O17 - HKLM\Software\..\Telephony: DomainName = basshall.com

    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = basshall.com

    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    O20 - Winlogon Notify: eqciwtko - C:\WINDOWS\SYSTEM32\aqlihol.dll

    O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe

    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

    O23 - Service: iolo FileInfoList Service (ioloFileInfoList) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: iolo System Service (ioloSystemService) - Unknown owner - C:\Program Files\iolo\common\lib\ioloServiceManager.exe

    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

    O23 - Service: Lync USB Auditor Service (LyncUSBServ) - Unknown owner - \\bass-spy\auditwizard\scan\lyncusb.exe (file missing)

    O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe

    O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe

    O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe

    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

    O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe

    O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe

    O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe

    O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

    O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

    O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\WINDOWS\system32\STacSV.exe

    --

    End of file - 11705 bytes

    can't remove 3 infected registry keys and 1 file

    in Resolved Malware Removal Logs

    Posted

    i have posted my Combofix and MWB logs below, any help would be greatly appreciated.

    ComboFix 09-04-17.01 - mcook 04/16/2009 16:31.2 - NTFSx86

    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1600 [GMT -5:00]

    Running from: c:\documents and settings\mcook\Desktop\ComboFix.exe

    .

    ((((((((((((((((((((((((( Files Created from 2009-03-17 to 2009-04-17 )))))))))))))))))))))))))))))))

    .

    2009-04-16 21:12 . 2009-04-16 21:12 -------- d-----w C:\quarantine

    2009-04-16 15:56 . 2009-04-16 16:10 664 ----a-w c:\windows\system32\d3d9caps.dat

    2009-04-15 22:48 . 2009-04-16 16:35 -------- d-----w C:\!KillBox

    2009-04-15 17:57 . 2009-04-16 16:00 -------- d-----w c:\documents and settings\mcook\.housecall6.6

    2009-04-15 15:07 . 2009-03-06 14:22 284160 -c----w c:\windows\system32\dllcache\pdh.dll

    2009-04-15 15:07 . 2009-02-09 12:10 401408 -c----w c:\windows\system32\dllcache\rpcss.dll

    2009-04-15 15:07 . 2009-02-06 11:11 110592 -c----w c:\windows\system32\dllcache\services.exe

    2009-04-15 15:07 . 2009-02-09 12:10 729088 -c----w c:\windows\system32\dllcache\lsasrv.dll

    2009-04-15 15:07 . 2009-02-09 12:10 617472 -c----w c:\windows\system32\dllcache\advapi32.dll

    2009-04-15 15:07 . 2009-02-09 12:10 473600 -c----w c:\windows\system32\dllcache\fastprox.dll

    2009-04-15 15:07 . 2009-02-09 12:10 453120 -c----w c:\windows\system32\dllcache\wmiprvsd.dll

    2009-04-15 15:07 . 2009-02-06 10:10 227840 -c----w c:\windows\system32\dllcache\wmiprvse.exe

    2009-04-15 15:07 . 2009-02-09 12:10 714752 -c----w c:\windows\system32\dllcache\ntdll.dll

    2009-04-15 15:06 . 2009-03-27 06:58 1203922 -c----w c:\windows\system32\dllcache\sysmain.sdb

    2009-04-15 15:06 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll

    2009-04-15 15:06 . 2008-04-21 12:08 215552 -c----w c:\windows\system32\dllcache\wordpad.exe

    2009-04-15 01:55 . 2008-12-11 13:38 159600 ----a-w c:\windows\system32\drivers\pctgntdi.sys

    2009-04-15 01:55 . 2009-03-06 21:45 130424 ----a-w c:\windows\system32\drivers\PCTCore.sys

    2009-04-15 01:55 . 2008-12-18 17:16 73840 ----a-w c:\windows\system32\drivers\PCTAppEvent.sys

    2009-04-15 01:55 . 2009-04-16 19:01 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP

    2009-04-15 01:55 . 2008-12-10 17:36 64392 ----a-w c:\windows\system32\drivers\pctplsg.sys

    2009-04-15 01:55 . 2009-04-15 01:55 -------- d-----w c:\documents and settings\mcook\Application Data\PC Tools

    2009-04-15 01:55 . 2009-04-15 01:55 -------- d-----w c:\documents and settings\All Users\Application Data\PC Tools

    2009-04-15 01:44 . 2009-04-15 01:44 61440 ----a-w c:\windows\system32\drivers\sbngn.sys

    2009-04-15 01:23 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe

    2009-04-15 01:16 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys

    2009-04-15 01:15 . 2009-04-15 01:15 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

    2009-04-15 01:15 . 2009-04-15 01:16 -------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

    2009-04-14 19:15 . 2009-04-14 19:15 -------- d-----w C:\VundoFix Backups

    2009-04-14 18:50 . 2009-04-14 18:50 406 ----a-w c:\windows\system32\ioloBootDefrag.cfg

    2009-04-14 18:50 . 2009-04-14 23:45 -------- d-----w c:\documents and settings\LocalService\Application Data\iolo

    2009-04-14 18:50 . 2009-03-25 21:37 936288 ----a-w c:\windows\system32\Incinerator.dll

    2009-04-14 18:50 . 2009-02-17 16:31 28672 ----a-w c:\windows\system32\iolobtdfg.exe

    2009-04-14 18:50 . 2009-02-17 16:26 8192 ----a-w c:\windows\system32\smrgdf.exe

    2009-04-14 18:48 . 2009-04-14 18:48 74703 ----a-w c:\windows\system32\mfc45.dll

    2009-04-14 18:46 . 2009-04-14 19:01 -------- d-----w c:\documents and settings\All Users\Application Data\iolo

    2009-04-14 18:46 . 2009-04-14 18:50 -------- d-----w c:\documents and settings\mcook\Application Data\iolo

    2009-04-13 20:45 . 2009-04-13 20:45 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Adobe

    2009-04-13 20:45 . 2009-04-13 20:45 -------- d-----w c:\documents and settings\Administrator\Application Data\Research In Motion

    2009-04-13 20:45 . 2009-04-13 20:45 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer

    2009-04-13 17:54 . 2009-04-13 17:54 -------- d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

    2009-04-13 17:54 . 2009-04-13 17:54 -------- d-----w c:\documents and settings\mcook\Application Data\SUPERAntiSpyware.com

    2009-04-13 16:07 . 2009-04-13 16:07 -------- d-----w c:\documents and settings\mcook\Application Data\Malwarebytes

    2009-04-13 16:07 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys

    2009-04-13 16:07 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

    2009-04-13 16:07 . 2009-04-13 16:07 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes

    2009-04-13 15:12 . 2009-04-13 15:12 408 ----a-w c:\windows\Qvocakaxodemad.dat

    2009-04-13 15:12 . 2009-04-13 15:12 -------- d-----w c:\documents and settings\mcook\Local Settings\Application Data\{9DDCED28-913B-40F5-925C-68111CE264CF}

    2009-04-13 15:12 . 2009-04-13 15:12 0 ----a-w c:\windows\Xreyat.bin

    2009-04-10 11:24 . 2009-04-10 11:24 -------- d-----w c:\documents and settings\mcook\Local Settings\Application Data\ixmsylbo

    2009-04-10 11:24 . 2009-04-10 11:24 -------- d-----w c:\documents and settings\mcook\Application Data\ixmsylbo

    2009-03-21 14:06 . 2009-03-21 14:06 989696 -c----w c:\windows\system32\dllcache\kernel32.dll

    2009-03-18 16:51 . 2009-03-18 16:51 -------- d-----w c:\documents and settings\bassomatic\Application Data\Xerox

    .

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    2009-04-16 21:29 . 2009-04-15 01:25 5148 ----a-w C:\aaw7boot.log

    2009-04-16 18:51 . 2009-04-15 01:55 -------- d-----w c:\program files\Spyware Doctor

    2009-04-16 18:49 . 2009-04-16 18:16 -------- d-----w c:\program files\Unlocker

    2009-04-16 17:52 . 2009-04-13 17:54 -------- d-----w c:\program files\SUPERAntiSpyware

    2009-04-16 17:36 . 2009-04-16 17:36 -------- d-----w c:\program files\FileASSASSIN

    2009-04-16 17:30 . 2006-11-01 18:06 162616 ----a-w C:\RegDelNull.exe

    2009-04-16 17:30 . 2006-07-28 13:32 7005 ----a-w C:\Eula.txt

    2009-04-16 15:51 . 2008-07-13 17:27 283 ----a-w C:\STATION.A2K

    2009-04-15 21:03 . 2009-04-15 21:01 -------- d-----w c:\program files\Windows Live Safety Center

    2009-04-15 01:57 . 2009-04-15 01:55 -------- d-----w c:\program files\Common Files\PC Tools

    2009-04-15 01:44 . 2009-04-15 01:44 666 ----a-w C:\rwrznqc.txt

    2009-04-15 01:15 . 2009-04-15 01:15 -------- d-----w c:\program files\Lavasoft

    2009-04-14 19:28 . 2009-04-14 19:15 136 ----a-w C:\VundoFix.txt

    2009-04-14 18:49 . 2009-04-14 18:49 -------- d-----w c:\program files\iolo

    2009-04-13 20:44 . 2009-04-13 20:44 -------- d-----w c:\documents and settings\Administrator\Application Data\Malwarebytes

    2009-04-13 17:54 . 2009-04-13 17:54 -------- d-----w c:\program files\Common Files\Wise Installation Wizard

    2009-04-13 16:07 . 2009-04-13 16:07 -------- d-----w c:\program files\Malwarebytes' Anti-Malware

    2009-04-08 19:46 . 2008-09-03 18:21 -------- d-----w c:\program files\Java

    2009-03-31 17:13 . 2008-07-15 17:43 -------- d-----w c:\program files\Spybot - Search & Destroy

    2009-03-16 15:19 . 2009-03-16 15:19 -------- d-----w c:\program files\iTunes

    2009-03-16 15:19 . 2009-03-16 15:19 -------- d-----w c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

    2009-03-16 15:19 . 2009-03-16 15:19 -------- d-----w c:\program files\iPod

    2009-03-16 15:19 . 2008-07-11 00:43 -------- d-----w c:\program files\Common Files\Apple

    2009-03-16 15:17 . 2008-07-11 00:11 -------- d-----w c:\program files\Bonjour

    2009-03-16 15:17 . 2008-07-11 00:18 -------- d-----w c:\program files\QuickTime

    2009-03-12 01:02 . 2008-07-11 00:28 -------- d-----w c:\documents and settings\All Users\Application Data\FLEXnet

    2009-03-09 10:19 . 2008-12-08 17:05 410984 ----a-w c:\windows\system32\deploytk.dll

    2009-03-06 14:22 . 2004-08-04 10:00 284160 ----a-w c:\windows\system32\pdh.dll

    2009-03-03 00:18 . 2006-03-04 03:33 826368 ----a-w c:\windows\system32\wininet.dll

    2009-02-26 16:54 . 2008-12-30 15:54 -------- d-----w c:\program files\Microsoft Silverlight

    2009-02-20 18:09 . 2004-08-04 10:00 78336 ----a-w c:\windows\system32\ieencode.dll

    2009-02-09 12:10 . 2004-08-04 10:00 729088 ----a-w c:\windows\system32\lsasrv.dll

    2009-02-09 12:10 . 2004-08-04 10:00 714752 ----a-w c:\windows\system32\ntdll.dll

    2009-02-09 12:10 . 2004-08-04 10:00 617472 ----a-w c:\windows\system32\advapi32.dll

    2009-02-09 12:10 . 2004-08-04 10:00 401408 ----a-w c:\windows\system32\rpcss.dll

    2009-02-09 11:13 . 2004-08-04 10:00 1846784 ----a-w c:\windows\system32\win32k.sys

    2009-02-06 11:11 . 2004-08-04 10:00 110592 ----a-w c:\windows\system32\services.exe

    2009-02-06 11:06 . 2005-03-30 01:21 2145280 ----a-w c:\windows\system32\ntoskrnl.exe

    2009-02-06 10:39 . 2004-08-04 10:00 35328 ----a-w c:\windows\system32\sc.exe

    2009-02-06 10:32 . 2005-03-30 01:01 2023936 ----a-w c:\windows\system32\ntkrnlpa.exe

    2009-02-03 19:59 . 2004-08-04 10:00 56832 ----a-w c:\windows\system32\secur32.dll

    2008-12-09 23:41 . 2008-07-11 00:32 86504 ----a-w c:\documents and settings\mcook\Local Settings\Application Data\GDIPFONTCACHEV1.DAT

    .

    ((((((((((((((((((((((((((((( SnapShot@2009-04-16_21.15.44 )))))))))))))))))))))))))))))))))))))))))

    .

    + 2009-04-16 21:29 . 2009-04-16 21:29 16384 c:\windows\Temp\Perflib_Perfdata_78c.dat

    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

    .

    .

    *Note* empty entries & legit default entries are not shown

    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{428D480A-7303-4E2B-935A-EF7CBDC946EA}]

    c:\windows\system32\aqlihol.dll [bU]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

    "ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2007-11-27 98304]

    "RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 236016]

    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-26 8523776]

    "Network Associates Error Reporting Service"="c:\program files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 147514]

    "McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UdaterUI.exe" [2007-10-25 136512]

    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-13 342312]

    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]

    "Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

    "Acrobat Assistant 8.0"="c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-12 623992]

    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2008-05-26 1630208]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\

    Desktop Manager.lnk - c:\program files\Research In Motion\BlackBerry\DesktopMgr.exe [2007-11-12 1447184]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

    2008-12-22 16:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\eqciwtko]

    aqlihol.dll [bU]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-884832222-1912555811-1544898942-3991\Scripts\Logon\0\0]

    "Script"=logon.bat

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-884832222-1912555811-1544898942-3991\Scripts\Logon\1\0]

    "Script"=\\basshall.com\SysVol\basshall.com\scripts\bphlogon.wsf

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-884832222-1912555811-1544898942-500\Scripts\Logon\0\0]

    "Script"=logon.bat

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

    @="Service"

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

    "%windir%\\system32\\sessmgr.exe"=

    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408]

    R3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752]

    S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]

    S0 mulcxvmf;mulcxvmf;c:\windows\system32\drivers\mulcxvmf.sys [2004-08-04 23424]

    S0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-03-06 130424]

    S1 NaiAvTdi1;NaiAvTdi1;c:\windows\system32\drivers\mvstdi5x.sys [2007-11-27 59904]

    S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-04-16 9968]

    S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-02-17 55024]

    S2 ioloFileInfoList;iolo FileInfoList Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

    S2 ioloSystemService;iolo System Service;c:\program files\iolo\common\lib\ioloServiceManager.exe [2009-02-06 712048]

    S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - ENTDRV51

    *NewlyCreated* - LYNCUSBSERV

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

    otpjmzzb

    .

    Contents of the 'Scheduled Tasks' folder

    2009-04-15 c:\windows\Tasks\Ad-Aware Update (Weekly).job

    - c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

    2009-04-11 c:\windows\Tasks\AppleSoftwareUpdate.job

    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

    .

    .

    ------- Supplementary Scan -------

    .

    uStart Page = hxxp://www.basshall.com/

    uInternet Settings,ProxyOverride = *.local

    IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

    IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

    IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

    IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    DPF: {0FAA926E-2AF4-11D3-9995-00A0CC3A27A9} - hxxp://bass-mail/timecentre/Common/pvcombo.cab

    DPF: {7823A620-9DD9-11CF-A662-00AA00C066D2} - hxxp://bass-mail/timecentre/Common/iemenu.cab

    DPF: {80A9E319-C338-4027-B1E2-FB73B54A326F} - hxxp://bass-mail/timecentre/reports/DDExportFiles.CAB

    DPF: {A71B416C-CB2C-45F4-A67C-39EA7532FECF} - hxxp://bass-mail/timecentre/reports/ActiveReportExport.CAB

    DPF: {B6C10489-FB89-11D4-93C9-006008A7EED4} - hxxp://bass-mail/timecentre/Common/teechart5.cab

    DPF: {E9C9692E-F93C-11D1-ABB0-0040054FC6FB} - hxxp://bass-mail/timecentre/Common/pvdt80.cab

    .

    .

    ------- File Associations -------

    .

    JSEFile=NOTEPAD.EXE %1

    VBEFile=NOTEPAD.EXE %1

    VBSFile=NOTEPAD.EXE %1

    .

    **************************************************************************

    catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

    Rootkit scan 2009-04-16 16:35

    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully

    hidden files: 0

    **************************************************************************

    .

    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(712)

    c:\program files\SUPERAntiSpyware\SASWINLO.dll

    - - - - - - - > 'lsass.exe'(768)

    c:\program files\Bonjour\mdnsNSP.dll

    c:\windows\system32\EntApi.dll

    - - - - - - - > 'explorer.exe'(3136)

    c:\windows\system32\EntApi.dll

    c:\windows\system32\WPDShServiceObj.dll

    c:\windows\system32\PortableDeviceTypes.dll

    c:\windows\system32\PortableDeviceApi.dll

    .

    Completion time: 2009-04-16 16:37

    ComboFix-quarantined-files.txt 2009-04-16 21:37

    ComboFix2.txt 2009-04-16 21:17

    Pre-Run: 142,219,345,920 bytes free

    Post-Run: 142,208,962,560 bytes free

    227 --- E O F --- 2009-04-15 15:12

    MWB Log:

    Malwarebytes' Anti-Malware 1.36

    Database version: 1989

    Windows 5.1.2600 Service Pack 3

    4/16/2009 4:28:07 PM

    mbam-log-2009-04-16 (16-28-07).txt

    Scan type: Quick Scan

    Objects scanned: 85845

    Time elapsed: 3 minute(s), 12 second(s)

    Memory Processes Infected: 0

    Memory Modules Infected: 0

    Registry Keys Infected: 3

    Registry Values Infected: 0

    Registry Data Items Infected: 0

    Folders Infected: 0

    Files Infected: 1

    Memory Processes Infected:

    (No malicious items detected)

    Memory Modules Infected:

    (No malicious items detected)

    Registry Keys Infected:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{428d480a-7303-4e2b-935a-ef7cbdc946ea} (Trojan.Vundo.H) -> Delete on reboot.

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\eqciwtko (Trojan.Vundo.H) -> Delete on reboot.

    HKEY_CLASSES_ROOT\CLSID\{428d480a-7303-4e2b-935a-ef7cbdc946ea} (Trojan.Vundo.H) -> Delete on reboot.

    Registry Values Infected:

    (No malicious items detected)

    Registry Data Items Infected:

    (No malicious items detected)

    Folders Infected:

    (No malicious items detected)

    Files Infected:

    c:\windows\system32\aqlihol.dll (Trojan.Vundo.H) -> Delete on reboot.

Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.