Something deep inside...

fmajor7th · February 2, 2009

Hello Malwarebytes,

I've recently discovered your site. It is so encouraging to find a site dedicated to the task of eradicating malware with excellent advice and anti-malware programs.

In response to infection, I recently downloaded and ran some new anti-malware software including SuperAntiSpyware and Comodo Antivirus. SuperAntiSpyware usually finds 100+ items: ~XX.TMP.EXE files (where X represents a hexadecimal integer) located in localsettings\temp, _restore, prefetch and system32 folders; also one file in start up. Then I found your site; I read your 'how did I become infected' entry, and downloaded and ran your Malwarebytes anti-malware software. With a full scan, your software reported no issues so I ran Hijack This: this found 20 or so suspect tmp files as running processes, and two further suspect files which seem to me to be the root or residual parts of the malware (pls see logs below).

If this helps, I also ran Ad-aware some months ago: then, the logs recognised/classified the malware files into three main categories: win32. generic worm, win32.trojanproxy.bobax, and win32.trojan.killav. Both Adaware and SuperAntiSpyware remove or quarantine nearly all the files that they find, except these root files which appear to launch the tmp files each start up; these then show up on Task Manager alongside the usual 30-40 normal processes. The 'end process' facility in task manager is disabled. I often have to reload my anti-malware programs each time I wish to use them because they are often disabled (by the malware, I assume); occasionally, it does not allow them to be installed at all. I use Opera as my main browser, then Netscape, then on occasion, IE.

I would be interested to hear your comments, especially ones that fully/properly explain what is happening on my machine, and in doing so, offer or lead to potential solutions for locating/eradicating these root files and what I can do to further prevent them infecting my system in the future. Whatever, congratulations on operating a business/website in such a noble and worthwhile cause.

Fmajor7th

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 15:46:15, on 02/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\blueyonder\PCguard\fws.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\RunDll32.exe

C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe

C:\Program Files\QuickTime\qttask.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~66.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~60.tmp.exe

C:\WINDOWS\system32\ctfmon.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~6C.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~72.tmp.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Comodo\common\CAVASpy\cavasm.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~7A.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~8B.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~7B.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~8F.tmp.exe

C:\Program Files\MSI\Core Center\CoreCenter.exe

C:\WINDOWS\system32\RAMASST.exe

C:\WINDOWS\System32\DVDRAMSV.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~A1.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~A3.tmp.exe

C:\Program Files\Common Files\Command Software\dvpapi.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~A2.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~A5.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~B0.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~B4.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~B6.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~B8.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~BC.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~BF.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~C0.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~C3.tmp.exe

C:\DOCUME~1\USERON~1\LOCALS~1\Temp\~C5.tmp.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

N2 - Netscape 6: user_pref("browser.startup.homepage", "http://www.demon.net/"); (C:\Documents and Settings\USER ONE\Application Data\Mozilla\Profiles\default\p5xnmo1h.slt\prefs.js)

N2 - Netscape 6: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5CNetscape%206%5Csearchplugins%5CSBWeb_01.src"); (C:\Documents and Settings\USER ONE\Application Data\Mozilla\Profiles\default\p5xnmo1h.slt\prefs.js)

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\blueyonder\PCguard\pkR.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\blueyonder\PCguard\FBHR.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode

O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd

O4 - HKLM\..\Run: [b'sCLiP] C:\PROGRA~1\B'SCLI~1\Win2K\BSCLIP.exe

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"

O4 - HKLM\..\Run: [PCguardadvisor.exe] "C:\Program Files\blueyonder\PCguard advisor\PCguardadvisor.exe"

O4 - HKLM\..\Run: [PCguard] "C:\Program Files\blueyonder\PCguard\Rps.exe"

O4 - HKLM\..\Run: [KHVUII_akXLNZ_J] C:\WINDOWS\system32\bdfyytlfshlqh.exe

O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

O4 - HKLM\..\Run: [ueQaYzakOp] C:\WINDOWS\system32\mzyypdobc.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')

O4 - Startup: OpenOffice.org 1.0.1.lnk = C:\Program Files\OpenOffice.org1.0.1\program\quickstart.exe

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: CoreCenter.lnk = C:\Program Files\MSI\Core Center\CoreCenter.exe

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll

O23 - Service: AntiVir Service (AntiVirService) - Unknown owner - C:\Program Files\AVPersonal\AVGUARD.EXE (file missing)

O23 - Service: AntiVir Update (AVWUpSrv) - Unknown owner - C:\Program Files\AVPersonal\AVWUPSRV.EXE (file missing)

O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe

O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: PCguard Firewall (RP_FWS) - Radialpoint Inc. - C:\Program Files\blueyonder\PCguard\fws.exe

--

End of file - 7524 bytes

mbam-log-2009-02-02 (13-02-08).txt

Scan type: Full Scan (C:\|)

Objects scanned: 143317

Time elapsed: 1 hour(s), 1 minute(s), 40 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

AdvancedSetup · February 3, 2009

Well that is not the full log for MBAM so I can't tell the version of the program or definitions.

Please run the following program.

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

fmajor7th · February 3, 2009

Hello Malwarebytes,

Thank you for your prompt reply. Sorry about my hasty/sloppy C&P - failing to scroll up fully and thereby cutting off the top four lines of the mbam log text. Here is missing part:

Malwarebytes' Anti-Malware 1.33

Database version: 1714

Windows 5.1.2600 Service Pack 3

02/02/2009 13:02:08

mbam-log-2009-02-02 (13-02-08).txt

Thanks for your instructions; I'm on the case now and will get back to you shortly.

Fmajor7th

fmajor7th · February 3, 2009

Hello Again Malwarebytes,

Continuing from last time... I followed your instructions re ComboFix: all very clear and straightforward. XP would not allow me to install the WRConsole manually from my XP CD prior to running ComboFix because of the XP version mismatch: my original XP disc is a four year old SP1 and I am running an updated XP SP3. However, I dont think this matters because WRC was installed satisfactorily as part of the ComboFix set up.

I tried to disable all my running Antivirus/spyware and firewall s/w prior to running CF. I uninstalled Comodo, and I exited SuperAntiSpyware but the latter still showed up on the logs; PCGuard is my ISP's firewall: on a recent update, it somehow was disabled (by the malware, I assume - I am waiting to install ZA) so I though this would be OK but again it showed up on the logs. I notice other old protection s/w also showed up in the logs even though they are (or I thought they were) not running 'on access'. I hope this isn't a problem.

Whatever, ComboFix seemed to run perfectly, executing all the pre-stated stages. I also ran HJT again as per your instructions - pls see the logs for both below. I realise I am not out of the woods yet and I don't wish to temp fate but... things look promising: in my present OS state, all the tmp (malware) processes have gone from Task manager and the end process facility is re-enabled, and my CPU is running a sweet hum at 0-4% in the background instead of the labouring 30+% and chasing its tail. I await your further comments/instructions with great anticipation. (Apologies, I have to go away for three days now - the machine will not be turned on or used at all during this period - I will be back Sat. 7th. ). Thank you once again.

Fmajor7th

ComboFix 09-02-02.04 - User One 2009-02-03 21:58:02.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.736 [GMT 0:00]

Running from: c:\documents and settings\User One\Desktop\ComboFix.exe

AV: PCguard Anti-Virus *On-access scanning disabled* (Outdated)

FW: PCguard Firewall *enabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\IE4 Error Log.txt

c:\windows\system32\i

.

((((((((((((((((((((((((( Files Created from 2009-01-03 to 2009-02-03 )))))))))))))))))))))))))))))))

.

2009-02-03 21:52 . 2009-02-03 21:52 43,520 --a------ c:\windows\system32\hdhgufd.exe

2009-02-03 17:43 . 2009-02-03 17:43 43,520 --a------ c:\windows\system32\pphednnflwgjxq.exe

2009-02-03 17:29 . 2009-02-03 17:29 43,520 --a------ c:\windows\system32\johjfcpftwddj.exe

2009-02-03 11:35 . 2009-02-03 11:35 43,520 --a------ c:\windows\system32\iiznw.exe

2009-02-02 15:44 . 2009-02-02 15:44 43,520 --a------ c:\windows\system32\upzwec.exe

2009-02-02 15:18 . 2009-02-02 15:18 43,520 --a------ c:\windows\system32\ahxjq.exe

2009-02-02 14:30 . 2009-02-02 14:30 <DIR> d-------- c:\program files\Trend Micro

2009-02-02 14:26 . 2009-02-02 14:26 43,520 --a------ c:\windows\system32\oesrlrow.exe

2009-02-02 11:12 . 2009-02-02 11:12 43,520 --a------ c:\windows\system32\fwwamhi.exe

2009-01-20 23:01 . 2009-01-20 23:01 <DIR> d-------- c:\windows\Sun

2009-01-18 16:16 . 2009-01-18 16:16 <DIR> d-------- c:\documents and settings\User One\Application Data\Malwarebytes

2009-01-18 16:15 . 2009-01-18 16:15 <DIR> d-------- c:\program files\iPod

2009-01-18 16:15 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-18 16:14 . 2009-01-18 16:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-18 16:14 . 2009-01-18 16:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-18 16:14 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-16 13:05 . 2008-11-13 15:18 1,221,008 --a------ c:\windows\system32\zpeng25.dll

2009-01-16 13:05 . 2009-01-16 13:05 348,220 --a------ c:\windows\system32\vsconfig.xml

2009-01-16 13:05 . 2009-01-16 13:05 4,212 --ah----- c:\windows\system32\zllictbl.dat

2009-01-16 11:29 . 2009-01-19 01:35 <DIR> d-------- c:\program files\SUPERAntiSpyware

2009-01-16 11:29 . 2009-01-16 11:29 <DIR> d-------- c:\documents and settings\User One\Application Data\SUPERAntiSpyware.com

2009-01-16 11:29 . 2009-01-16 11:29 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-01-15 21:03 . 2009-01-15 21:03 89,088 --a------ c:\windows\system32\ctfmon.exe

2009-01-15 17:21 . 2009-01-15 17:21 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard

2009-01-15 17:16 . 2009-01-15 17:16 <DIR> d-------- c:\windows\system32\scripting

2009-01-15 17:15 . 2008-04-13 22:58 2,940,928 -----c--- c:\windows\system32\dllcache\wmploc.dll

2009-01-15 17:14 . 2008-04-14 05:43 2,109,440 -----c--- c:\windows\system32\dllcache\wmvcore.dll

2009-01-15 17:14 . 2008-04-14 05:42 809,984 -----c--- c:\windows\system32\dllcache\wmvdmod.dll

2009-01-15 17:14 . 2008-04-14 05:42 759,296 -----c--- c:\windows\system32\dllcache\wmsdmod.dll

2009-01-15 17:14 . 2008-04-14 05:42 303,616 -----c--- c:\windows\system32\dllcache\wmstream.dll

2009-01-15 17:14 . 2008-04-14 05:42 278,559 -----c--- c:\windows\system32\dllcache\wmv8ds32.ax

2009-01-15 17:14 . 2008-04-14 05:42 258,048 -----c--- c:\windows\system32\dllcache\wmvds32.ax

2009-01-15 17:14 . 2008-04-13 22:06 144,384 --------- c:\windows\system32\drivers\hdaudbus.sys

2009-01-15 17:14 . 2008-04-14 05:42 115,200 -----c--- c:\windows\system32\dllcache\wmsdmoe.dll

2009-01-15 17:14 . 2008-04-14 05:42 20,480 -----c--- c:\windows\system32\dllcache\wmpui.dll

2009-01-15 17:13 . 2006-12-29 00:31 19,569 --a------ c:\windows\005146_.tmp

2009-01-15 17:13 . 2008-04-14 00:10 10,240 --------- c:\windows\system32\drivers\sffp_mmc.sys

2009-01-14 20:50 . 2009-01-14 20:50 <DIR> d-------- c:\documents and settings\User One\Application Data\OpenOffice.org

2009-01-14 20:48 . 2009-01-14 20:48 <DIR> d-------- c:\program files\OpenOffice.org 3

2009-01-14 20:48 . 2009-01-14 20:48 <DIR> d-------- c:\program files\JRE

2009-01-14 20:48 . 2009-01-14 20:48 <DIR> d-------- c:\program files\Java

2009-01-14 20:48 . 2009-01-14 20:48 <DIR> d-------- c:\program files\Common Files\Java

2009-01-14 20:48 . 2008-06-10 02:32 73,728 --a------ c:\windows\system32\javacpl.cpl

2009-01-14 20:45 . 2009-01-14 20:46 <DIR> d-------- c:\program files\OpenOfficeorg3

2009-01-14 19:44 . 2009-02-03 21:59 5,109 --a------ c:\windows\system32\drivers\kljgkg.sys

2009-01-13 13:51 . 2008-04-14 05:42 221,184 --a------ c:\windows\system32\wmpns.dll

2009-01-13 13:47 . 2009-01-15 17:17 <DIR> d-------- c:\windows\ServicePackFiles

2009-01-13 13:46 . 2008-04-13 23:09 2,897,920 --------- c:\windows\system32\xpsp2res.dll

2009-01-13 13:45 . 2007-08-10 20:46 26,488 --a------ c:\windows\system32\spupdsvc.exe

2009-01-13 13:45 . 2004-07-17 11:40 19,528 --a------ c:\windows\002160_.tmp

2009-01-13 13:43 . 2009-01-15 17:09 <DIR> d-------- c:\windows\EHome

2009-01-11 18:29 . 2009-01-11 18:29 75,776 --ah----- c:\windows\system32\gbrv.exe

2009-01-11 18:26 . 2009-01-11 18:26 75,776 --ah----- c:\windows\system32\jqwwpb.exe

2009-01-06 01:11 . 2009-01-06 01:11 68,608 --ah----- c:\windows\system32\hjuytd.exe

2009-01-04 23:05 . 2009-01-04 23:05 74,752 --ah----- c:\windows\system32\adgoms.exe

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-03 21:52 39,936 ----a-w c:\windows\system32\wmfptc32.dll

2009-01-19 01:35 --------- d-----w c:\program files\iTunes

2009-01-16 13:08 121,344 ----a-w c:\windows\Internet Logs\xDB24C.tmp

2009-01-14 22:45 --------- d-----w c:\program files\SpywareBlaster

2009-01-14 22:45 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-01-12 14:49 --------- d-----w c:\program files\Opera

2008-12-30 15:50 73,216 ---ha-w c:\windows\system32\okxfeof.exe

2005-11-28 14:47 21 ----a-w c:\program files\AVPersonalAVWIN.INI

2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL

.

------- Sigcheck -------

2004-08-04 00:56 44032 97e1ef029c968b457abb70e28f27b892 c:\windows\$NtServicePackUninstall$\ctfmon.exe

2008-04-14 05:42 44032 1b513a83c7b862daca38de1b731c0040 c:\windows\ServicePackFiles\i386\ctfmon.exe

2009-01-15 21:03 89088 35eb8dce4aab288029eff8bc9e9a6486 c:\windows\system32\ctfmon.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2009-01-15 89088]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-01-19 1900544]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"B'sCLiP"="c:\progra~1\B'SCLI~1\Win2K\BSCLIP.exe" [2007-11-17 1499136]

"WinampAgent"="c:\program files\Winamp\Winampa.exe" [2007-11-17 132608]

"PCguardadvisor.exe"="c:\program files\blueyonder\PCguard advisor\PCguardadvisor.exe" [2007-11-17 2007040]

"PCguard"="c:\program files\blueyonder\PCguard\Rps.exe" [2007-11-17 393216]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-11-17 274432]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-19 352256]

"UeQaYzakOp"="c:\windows\system32\hdhgufd.exe" [2009-02-03 43520]

"Ptipbmf"="ptipbmf.dll" [2003-06-05 c:\windows\system32\ptipbmf.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2009-01-15 89088]

c:\documents and settings\User One\Start Menu\Programs\Startup\

OpenOffice.org 1.0.1.lnk - c:\program files\OpenOffice.org1.0.1\program\quickstart.exe [10/28/2007 11:08:48 AM 180224]

OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [1/15/2009 9:03:33 PM 457728]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

CoreCenter.lnk - c:\program files\MSI\Core Center\CoreCenter.exe [12/4/2007 8:59:16 PM 2613248]

RAMASST.lnk - c:\windows\system32\RAMASST.exe [9/28/2007 11:02:55 AM 197656]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{EDB0E980-90BD-11D4-8599-0008C7D3B6F8}"= "c:\program files\Qualcomm\Eudora\EuShlExt.dll" [2002-03-28 77824]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000001

"UpdatesDisableNotify"=dword:00000001

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

R0 BsStor;B.H.A Storage Helper Driver;c:\windows\system32\drivers\BsStor.sys [3/19/2004 5:47:29 PM 9344]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [12/22/2008 11:06:00 AM 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/22/2008 11:05:58 AM 55024]

R2 BsUDF;B.H.A UDF Filesystem;c:\windows\system32\drivers\BsUDF.sys [3/19/2004 5:47:28 PM 390400]

R3 s3legacy;s3legacy;c:\windows\system32\drivers\s3legacy.sys [3/18/2004 6:06:37 PM 65664]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/22/2008 11:06:02 AM 7408]

R4 NdisFileServices32;NdisFileServices32;c:\windows\system32\drivers\kljgkg.sys [1/14/2009 7:44:07 PM 5109]

S2 AVWUpSrv;AntiVir Update;"c:\program files\AVPersonal\AVWUPSRV.EXE" --> c:\program files\AVPersonal\AVWUPSRV.EXE [?]

S3 avgntdd;avgntdd;c:\program files\AVPersonal\AVGNTDD.SYS [12/10/2004 12:46:36 PM 32560]

--- Other Services/Drivers In Memory ---

*Deregistered* - PCAlertDriver

*Deregistered* - RushTopDevice

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe

HKLM-Run-KHVUII_akXLNZ_J - c:\windows\system32\bdfyytlfshlqh.exe

HKLM-Run-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe

HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe

HKLM-Run-ZoneAlarm Client - c:\program files\Zone Labs\ZoneAlarm\zlclient.exe

HKLM-Run-Cmaudio - cmicnfg.cpl

.

------- Supplementary Scan -------

.

uStart Page = about:blank

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-03 21:59:17

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1008)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\adsldpc.dll

.

Completion time: 2009-02-03 22:01:51

ComboFix-quarantined-files.txt 2009-02-03 22:01:49

Pre-Run: 79,794,221,056 bytes free

Post-Run: 80,398,155,776 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

180

--------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 22:12:00, on 03/02/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\blueyonder\PCguard\fws.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\DVDRAMSV.exe

C:\Program Files\Common Files\Command Software\dvpapi.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896