Trying to recover from meltdown. MBAM and HJT logs.

chamished · February 8, 2009

My computer went a little haywire earlier today and now loginning seems to be affected.

Here are my MBAM and HJT logs and hopefully someone will be able to help. thank you.

Malwarebytes' Anti-Malware 1.33

Database version: 1738

Windows 5.1.2600 Service Pack 3

2/8/2009 1:39:42 AM

mbam-log-2009-02-08 (01-39-42).txt

Scan type: Quick Scan

Objects scanned: 64166

Time elapsed: 8 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 10

Registry Values Infected: 4

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 37

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\CLSID\{a407fae3-6795-49fb-8a12-27ef0bb63116} (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\protect (Trojan.NtRootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\protect (Trojan.NtRootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\protect (Trojan.NtRootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\58e6c40a (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jsf8uiw3jnjgffght (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{c5bf49a2-94f3-42bd-f434-3604812c8955} (Trojan.BHO) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\PromoReg (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Mike Powell\Local Settings\Temp\winlognn.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\fprcyxcw.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\hdlhnnbt.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\jkkHApMF.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\kjdcutmn.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\mcekkmtu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\_hsfd83jfdg.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\drivers\protect.sys (Trojan.NtRootkit.Agent) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\K6QQGIAQ\hrobc[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\K6QQGIAQ\islre[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\K6QQGIAQ\qjgguh[1].htm (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\K6QQGIAQ\upd105320[2] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\N1WWMERK\aasuper0[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\N1WWMERK\aSPhJ[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\N1WWMERK\dnxkllz[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\N1WWMERK\nddaa[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\N1WWMERK\vbclmznn[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\P0P7D11N\aasuper2[1].htm (Trojan.TinyDownloader705) -> Quarantined and deleted successfully.

C:\Documents and Settings\Mike Powell\Local Settings\Temporary Internet Files\Content.IE5\XOV63UKZ\img[1] (Trojan.Vundo) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\7z.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\codeblocks.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\makehm.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\2.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\3.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\4.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\5.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\6.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\7.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\8.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\9.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\B.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\D.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\E.tmp (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\Temp\TMPD.tmp (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\Documents and Settings\Nancy Powell\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\senekarwxvnsru.dat (Trojan.Agent) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 1:34:15 AM, on 2/8/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Spyware Doctor\pctsAuxs.exe

C:\Program Files\Spyware Doctor\pctsSvc.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Spyware Doctor\pctsTray.exe

C:\WINDOWS\system32\wbem\unsecapp.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A...08&m=le1200

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.emachines.com/rdr.aspx?b=A...08&m=le1200

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A...08&m=le1200

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"

O4 - HKLM\..\Run: [58e6c40a] rundll32.exe "C:\WINDOWS\system32\qcxijcry.dll",b

O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\MIKEPO~1\LOCALS~1\Temp\winlognn.exe

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

O4 - HKLM\..\Run: [PromoReg] C:\WINDOWS\TEMP\TMPD.tmp

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKUS\S-1-5-20\..\Run: [pitedehega] Rundll32.exe "C:\WINDOWS\system32\giyesewu.dll",s (User 'NETWORK SERVICE')

O4 - S-1-5-18 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM')

O4 - .DEFAULT Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.4.2.cab

O20 - AppInit_DLLs: qhjdij.dll bbsyju.dll qdlath.dll

O20 - Winlogon Notify: ddcYrQkL - ddcYrQkL.dll (file missing)

O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)

O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\WINDOWS\system32\agrsmsvc.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: NTI Backup Now 5 Agent Service (BUNAgentSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\eMachines Games\eMachines Game Console\GameConsoleService.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - Unknown owner - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe

O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--

End of file - 8705 bytes

AdvancedSetup · February 8, 2009

STEP 1

With all other applications closed (Taskbar empty), open HijackThis again

and run Do a system scan only and place a check mark on the following items.

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [58e6c40a] rundll32.exe "C:\WINDOWS\system32\qcxijcry.dll",b
O4 - HKLM\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\MIKEPO~1\LOCALS~1\Temp\winlognn.exe
O4 - HKLM\..\Run: [PromoReg] C:\WINDOWS\TEMP\TMPD.tmp
O4 - HKUS\S-1-5-20\..\Run: [pitedehega] Rundll32.exe "C:\WINDOWS\system32\giyesewu.dll",s (User 'NETWORK SERVICE')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O20 - AppInit_DLLs: qhjdij.dll bbsyju.dll qdlath.dll
O20 - Winlogon Notify: ddcYrQkL - ddcYrQkL.dll (file missing)
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
Then Quit All Browsers including the one you're reading this in now.
Then click on Fix checked and then quit HJT

STEP 2

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

chamished · February 8, 2009

ComboFix 09-02-07.01 - Administrator 2009-02-08 13:50:07.1 - NTFSx86 NETWORK

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.894.713 [GMT -5:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

AV: Spyware Doctor with AntiVirus *On-access scanning enabled* (Updated)

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\services.exe

c:\windows\system32\3.tmp

c:\windows\system32\4.tmp

c:\windows\system32\bepesata.dll.tmp

c:\windows\system32\drivers\protect.sys

c:\windows\system32\gwqypx.dll

c:\windows\system32\MlTEgNnn.ini

c:\windows\system32\MlTEgNnn.ini2

c:\windows\system32\nnNgETlM.dll.vir

c:\windows\system32\okirezun.ini

c:\windows\system32\pdxlryir.dll

c:\windows\system32\pewofesa.dll

c:\windows\system32\qdlath.dll

c:\windows\system32\tutatezu.dll.tmp

c:\windows\system32\yrcjixcq.ini

c:\windows\Tasks\illtwywq.job

----- BITS: Possible infected sites -----

hxxp://childhe.com

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_PROTECT

-------\Service_Passthru

-------\Service_protect

((((((((((((((((((((((((( Files Created from 2009-01-08 to 2009-02-08 )))))))))))))))))))))))))))))))

.

2009-02-08 13:33 . 2005-10-27 19:24 49,664 -ra------ c:\windows\system32\drivers\hpzid412.sys.bak

2009-02-08 13:33 . 2005-10-27 19:24 16,496 -ra------ c:\windows\system32\drivers\hpzipr12.sys.bak

2009-02-08 13:33 . 2009-02-08 13:33 11,776 --ah----- c:\windows\system32\config\systemprofile\uuu.exe

2009-02-08 13:33 . 2009-02-08 13:33 3,584 --a------ c:\windows\jrfwotwn.exe

2009-02-08 13:33 . 2009-02-08 13:33 130 --a------ c:\windows\adobe.bat

2009-02-08 13:33 . 2009-02-08 13:45 6 --a------ c:\windows\_id.dat

2009-02-08 13:29 . 2009-02-08 13:29 64,000 --a------ c:\windows\system32\i386kd.exe

2009-02-08 13:29 . 2009-02-08 13:29 168 --a------ c:\windows\system32\2.tmp

2009-02-08 01:44 . 2009-02-08 01:44 32,256 --ah----- c:\documents and settings\Administrator\acxb.exe

2009-02-08 01:33 . 2009-02-08 01:33 <DIR> d-------- c:\program files\Trend Micro

2009-02-08 01:30 . 2009-02-08 01:30 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Malwarebytes

2009-02-08 01:24 . 2009-02-08 01:24 67,585 --a------ c:\windows\system32\20.tmp

2009-02-08 01:24 . 2009-02-08 01:24 29,184 --a------ c:\windows\system32\1F.tmp

2009-02-08 01:24 . 2009-02-08 01:24 7,073 --a------ c:\windows\system32\22.tmp

2009-02-08 01:24 . 2009-02-08 01:24 172 --a------ c:\windows\system32\1E.tmp

2009-02-07 20:58 . 2009-02-07 20:58 <DIR> d-------- c:\documents and settings\Nancy Powell\Application Data\Apple Computer

2009-02-07 19:42 . 2009-02-07 19:42 33,920 --a------ c:\windows\system32\drivers\qktksgef.sys

2009-02-07 19:41 . 2009-02-08 01:44 137,408 --a------ c:\windows\system32\drivers\ethyhoay.sys

2009-02-07 19:41 . 2009-02-08 13:33 66,560 ---h----- c:\windows\system32\secupdat.dat

2009-02-07 19:41 . 2009-02-08 13:33 53,248 --a------ c:\windows\system32\drivers\ndisio.sys

2009-02-07 19:41 . 2009-02-07 19:41 32,768 --ah----- c:\documents and settings\Nancy Powell\ouoj.exe

2009-02-07 19:38 . 2009-02-07 19:41 164,708 --a------ c:\windows\system32\17.tmp

2009-02-07 19:38 . 2009-02-07 19:38 67,585 --a------ c:\windows\system32\15.tmp

2009-02-07 19:38 . 2009-02-07 19:38 29,184 --a------ c:\windows\system32\14.tmp

2009-02-07 19:38 . 2009-02-07 19:38 172 --a------ c:\windows\system32\13.tmp

2009-02-07 11:52 . 2009-02-07 11:52 39,936 --a------ C:\xxweksc.exe

2009-02-07 11:52 . 2009-02-07 11:52 21,504 --a------ C:\wskrote.exe

2009-02-07 11:52 . 2009-02-07 11:52 21,504 --a------ C:\jwfmld.exe

2009-02-07 11:52 . 2009-02-07 11:52 2 --a------ C:\1491518629

2009-01-30 20:49 . 2009-01-30 20:49 <DIR> d-------- c:\documents and settings\Nancy Powell\Application Data\HP

2009-01-20 16:05 . 2009-02-07 19:43 764 --ah----- C:\aaw7boot.cmd

2009-01-20 14:27 . 2009-01-20 14:27 <DIR> d-------- c:\documents and settings\Mike Powell\Application Data\Malwarebytes

2009-01-20 14:22 . 2009-01-20 14:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-01-20 14:22 . 2009-01-20 14:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-01-20 14:22 . 2009-01-20 14:21 64,160 --a------ c:\windows\system32\drivers\Lbd.sys

2009-01-20 14:22 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-01-20 14:22 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-01-20 14:18 . 2009-01-20 14:18 <DIR> d-------- c:\program files\Lavasoft

2009-01-20 14:18 . 2009-01-20 14:22 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft

2009-01-20 14:18 . 2009-01-20 14:18 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-01-20 13:37 . 2009-01-20 13:37 <DIR> d-------- c:\program files\Canon

2009-01-20 13:36 . 2009-01-20 13:36 <DIR> d-------- c:\program files\Common Files\Canon

2009-01-18 16:42 . 2000-01-18 04:11 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec

2009-01-18 16:42 . 2009-02-08 01:44 <DIR> d-------- c:\documents and settings\Administrator

2009-01-15 00:55 . 2009-01-15 00:55 <DIR> d-------- c:\documents and settings\Mike Powell\Application Data\F-Secure

2009-01-14 23:39 . 2009-01-15 01:04 <DIR> d-------- c:\program files\F-Secure Internet Security

2009-01-14 23:39 . 2009-01-14 23:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\fssg

2009-01-14 23:35 . 2009-01-15 00:58 <DIR> d-------- c:\documents and settings\All Users\Application Data\f-secure

2009-01-14 22:53 . 2009-02-08 13:48 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP

2009-01-14 22:46 . 2009-01-14 23:28 <DIR> d-------- c:\documents and settings\Nancy Powell\Application Data\uTorrent

2009-01-14 22:25 . 2009-01-20 15:51 4 --a------ c:\windows\prpdlcze

2009-01-14 21:58 . 2009-01-14 21:58 <DIR> d-------- c:\windows\E80F62FF5D3C4A1984099721F2928206.TMP

2009-01-14 21:04 . 2009-01-18 16:02 <DIR> d-------- c:\program files\RocketDock

2009-01-14 20:41 . 2003-12-13 00:40 202,763 --a------ c:\windows\system32\uxtheme.uxtender

2009-01-14 16:35 . 2009-01-14 17:33 <DIR> d-------- c:\documents and settings\Mike Powell\Application Data\Download Manager

2009-01-12 18:02 . 2008-04-14 07:00 218,624 --a------ c:\windows\system32\uxtheme.backup

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-07 19:48 --------- d-----w c:\program files\Trillian

2009-01-29 23:48 --------- d-----w c:\documents and settings\Mike Powell\Application Data\uTorrent

2009-01-28 22:21 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-01-15 03:24 --------- d-----w c:\program files\BigFix

2009-01-15 02:59 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2009-01-15 02:58 --------- d-----w c:\program files\Symantec

2009-01-15 02:50 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-15 01:52 202,763 ----a-w c:\windows\system32\uxtheme.dll

2009-01-10 19:18 --------- d-----w c:\program files\Google

2009-01-10 03:06 --------- d-----w c:\documents and settings\Mike Powell\Application Data\Apple Computer

2009-01-03 23:32 --------- d-----w c:\documents and settings\Mike Powell\Application Data\Media Player Classic

2008-12-19 08:21 --------- d-----w c:\program files\iTunes

2008-12-19 08:21 --------- d-----w c:\documents and settings\All Users\Application Data\Last.fm

2008-12-19 08:20 --------- d-----w c:\program files\Last.fm

2008-12-18 02:43 --------- d-----w c:\program files\Norton PC Checkup

2008-12-16 09:25 --------- d-----w c:\program files\CDisplay

2008-12-15 23:45 --------- d-----w c:\program files\QuickTime

2008-12-15 23:45 --------- d-----w c:\program files\iPod

2008-12-15 23:45 --------- d-----w c:\program files\Common Files\Apple

2008-12-15 23:45 --------- d-----w c:\program files\Bonjour

2008-12-15 23:45 --------- d-----w c:\documents and settings\All Users\Application Data\Apple Computer

2008-12-15 23:43 --------- d-----w c:\program files\Apple Software Update

2008-12-15 23:43 --------- d-----w c:\documents and settings\All Users\Application Data\Apple

2008-12-15 19:11 --------- d-----w c:\program files\Ubisoft

2008-12-15 19:10 --------- d-----w c:\program files\Common Files\InstallShield

2008-12-15 06:36 --------- d-----w c:\documents and settings\All Users\Application Data\NexonUS

2008-12-15 03:20 --------- d-----w c:\program files\Combined Community Codec Pack

2008-12-12 20:16 --------- d-----w c:\program files\Windows Media Connect 2

2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys

2008-08-18 21:43 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat

.

------- Sigcheck -------

2008-04-14 07:00 1050624 bf24e3c99638657a52bbff0a397276bb c:\windows\explorer.exe

2008-04-14 07:00 1050624 66a371085bbfb8fcfbd2f99fe82702d1 c:\windows\system32\dllcache\explorer.exe

2008-04-14 07:00 32256 b649223adec090eca1954db5ca3acd62 c:\windows\system32\ctfmon.exe

2008-04-14 07:00 32768 a4947940dffadae7bdef24b6cecb3bb6 c:\windows\system32\dllcache\ctfmon.exe

2008-04-14 07:00 74752 fc2de0c15ccc5b6670493a8304d21276 c:\windows\system32\spoolsv.exe

2008-04-14 07:00 74752 9c103d4448987e2668c1756fe504f88e c:\windows\system32\dllcache\spoolsv.exe

2008-04-14 07:00 43008 172373b6195eb3e5a97d81eb0f46fd3f c:\windows\system32\userinit.exe

2008-04-14 07:00 43008 33a53a9bc77aa02d10b57a3b23dd71c5 c:\windows\system32\dllcache\userinit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Power2GoExpress"="NA" [X]

"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 511432]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 32256]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-01 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-02-24 8491008]

"BkupTray"="c:\program files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe" [2008-04-07 34040]

"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2008-04-14 229432]

"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2008-04-14 83896]

"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 472576]

"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2008-04-14 472576]

"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]

"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-09 72736]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-02-24 81920]

"eRecoveryService"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2008-07-10 442368]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2005-12-15 69632]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 434176]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]

"nwiz"="nwiz.exe" [2008-02-24 c:\windows\system32\nwiz.exe]

"RTHDCPL"="RTHDCPL.EXE" [2008-05-16 c:\windows\RTHDCPL.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"jrfwotwn.exe"="c:\windows\jrfwotwn.exe" [2009-02-08 3584]

c:\documents and settings\Mike Powell\Start Menu\Programs\Startup\

OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-08-24 101784]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2005-12-15 303104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

"vidc.ffds"= c:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\qktksgef.sys]

@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"UpdatesDisableNotify"=dword:00000001

"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\NewTech Infosystems\\NTI Backup Now 5\\BackupSvc.exe"=

"c:\\Program Files\\NewTech Infosystems\\NTI Backup Now 5\\SchedulerSvc.exe"=

"c:\\Program Files\\NewTech Infosystems\\NTI Backup Now 5\\Client\\Agentsvc.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\AIM6\\aim6.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=

"c:\nexon\Combat Arms\CombatArms.exe"= c:\nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe

"c:\nexon\Combat Arms\Engine.exe"= c:\nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe

"c:\\Nexon\\Combat Arms\\NMService.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"80:TCP"= 80:TCP:Promo

"53:UDP"= 53:UDP:Promo

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-20 64160]

R0 qktksgef;qktksgef;c:\windows\system32\drivers\qktksgef.sys [2009-02-07 33920]

R2 BUNAgentSvc;NTI Backup Now 5 Agent Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe [2008-03-03 33280]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416]

R2 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2008-04-07 50424]

R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2008-04-04 151552]

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-11-22 45132]

S1 ethyhoay;ethyhoay;c:\windows\system32\drivers\ethyhoay.sys [2009-02-07 137408]

.

Contents of the 'Scheduled Tasks' folder

2009-02-03 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-20 14:21]

2009-01-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2009-01-14 c:\windows\Tasks\Norton PC Checkup WeekDay Scanner.job

- c:\program files\norton pc checkup\PC_Checkup.exe [2008-12-17 21:43]

2009-02-08 c:\windows\Tasks\Norton PC Checkup Weekend Scanner.job

- c:\program files\norton pc checkup\PC_Checkup.exe [2008-12-17 21:43]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-RocketDock - c:\program files\RocketDock\RocketDock.exe

HKCU-Run-jsf8uiw3jnjgffght - c:\docume~1\MIKEPO~1\LOCALS~1\Temp\winlognn.exe

HKCU-Run-tezrtsjhfr84iusjfo84f - c:\docume~1\MIKEPO~1\LOCALS~1\Temp\csrssc.exe

HKLM-Run-LaunchApp - (no file)

HKU-Default-Run-services - c:\windows\services.exe

HKLM-Explorer_Run-services - c:\windows\services.exe

HKU-Default-Explorer_Run-services - c:\windows\services.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=0&o=xph&d=0808&m=le1200

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ACEW

mStart Page = hxxp://homepage.emachines.com/rdr.aspx?b=ACEW&l=0409&s=0&o=xph&d=0808&m=le1200

uInternet Settings,ProxyOverride = *.local

IE: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.4.2.cab

FF - ProfilePath - c:\documents and settings\Mike Powell\Application Data\Mozilla\Firefox\Profiles\vrvwtex5.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.stickyscreen.org/

FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll

FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-08 13:54:21

Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:

ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

c:\docume~1\MIKEPO~1\LOCALS~1\Temp\WER0820.dir00

c:\docume~1\MIKEPO~1\LOCALS~1\Temp\WER0820.dir00\appcompat.txt 16188 bytes

c:\docume~1\MIKEPO~1\LOCALS~1\Temp\WER0820.dir00\logonui.exe.hdmp 2917399 bytes

c:\docume~1\MIKEPO~1\LOCALS~1\Temp\WER0820.dir00\logonui.exe.mdmp 476081 bytes

c:\docume~1\MIKEPO~1\LOCALS~1\Temp\WER0820.dir00\manifest.txt 2020 bytes

scan completed successfully

hidden files: 5

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(644)

c:\program files\Bonjour\mdnsNSP.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\agrsmsvc.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\nvsvc32.exe

c:\program files\CyberLink\Shared Files\RichVideo.exe

c:\windows\system32\wbem\unsecapp.exe

c:\windows\system32\wscntfy.exe

c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

c:\windows\system32\rundll32.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\HP\Digital Imaging\bin\hpqste08.exe

.

**************************************************************************

.

Completion time: 2009-02-08 13:56:38 - machine was rebooted [Mike Powell]

ComboFix-quarantined-files.txt 2009-02-08 18:56:33

Pre-Run: 50,189,938,688 bytes free

Post-Run: 49,361,727,488 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

315 --- E O F --- 2009-01-15 00:45:07

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 14:21, on 2009-02-08

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

C:\WINDOWS\system32\agrsmsvc.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\Client\Agentsvc.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\CyberLink\Shared Files\RichVideo.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe

C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

C:\WINDOWS\RTHDCPL.EXE

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A...08&m=le1200

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.emachines.com/rdr.aspx?b=A...08&m=le1200

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [bkupTray] "C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BkupTray.exe"

O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC

O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC

O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName

O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [Power2GoExpress] NA

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKUS\S-1-5-18\..\Run: [jrfwotwn.exe] C:\WINDOWS\jrfwotwn.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [jrfwotwn.exe] C:\WINDOWS\jrfwotwn.exe (User 'Default user')

O4 - S-1-5-18 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM')

O4 - .DEFAULT Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')

O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000