Jump to content

Trojan returns with every new scan


dchen
 Share

Recommended Posts

Many thanks for providing MalwareBytes! I got the "google redirect" problem; installed malwarebytes; and was able to fix my original problem. On subsequent rescans, I notice about 250 new items every time. After quarantine and deletion it seems the file names have changed slightly each time. Attached are the logs...

hijackthis.log

==========

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:26:45 AM, on 2/22/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe

C:\WINDOWS\system32\ntvdm.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--

End of file - 8639 bytes

mbam-log-2009-02-22 (09-42-09).txt

=============================

Malwarebytes' Anti-Malware 1.34

Database version: 1792

Windows 5.1.2600 Service Pack 3

2/22/2009 9:42:09 AM

mbam-log-2009-02-22 (09-42-09).txt

Scan type: Full Scan (C:\|)

Objects scanned: 215677

Time elapsed: 1 hour(s), 7 minute(s), 18 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 254

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock v2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Presentation Wizard v2.0.24a.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Presto Transfer My Photos 1.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prey iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PrimalScript 4 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia - The Two Thrones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones 3RIPS Technic KPS RFG.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\#1 Video Converter 3.8.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\.C.A.R. Squadra Corse Alfa Romeo 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 - Live And Let Die ( 1973 ).exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 Live and Let Die.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 Click DVD COPY 5.0.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper v5.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\100 Hojdare S01E06 PDTV XViD SWEDiSH SQC 3246813....exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Business.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Rtm En Nl.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Unveiled.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 9 In 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Gold Edition 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Password Administrator 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Pro SP2 OEM Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Corporate SP2 Octob.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional SP2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP SP3 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.70.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro v4.0A.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Detector Enterprise v2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.5.0.478.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 3.8.0.2582 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2603Latest Build.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2621 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v.4.0.0.2613.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.02602.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor ver.5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Anarchy Texture v2.0 For Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v4.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Camera Media Studio 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Film Tools EZ Mask v1.01 for Adobe Photoshop.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy Pro 1.x.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\2 Fiddy MP3 Alarm Pro 1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\3D Live Pool v2.64.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\A Secret Handshake 2007 DVDRip XviD-VoMiT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D v8.1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Photoshop 8 cs with cracks by lestercity12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Repair v1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v3.5.738..exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Hackman Hex Editor 9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 Collectors Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Life 2 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Nelson 2006 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 - Digital Zone (ISO), Half-Life 2 Valve.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Episode One iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 4.6.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup v.5.4.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal Rising 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Happy Feet 2006 FS DVDRip XviD-LRC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trillian 3 Pro Alpha 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Pro 3.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v. 6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover ver.6.5.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Crime New York City CLONEDVD-PLEX.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Launch Bar v2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power-on and Shut-down 1.44.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto USdownloder.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoCAD AutoCAD LT All-in-One Desk Reference For Du.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk 3D Studio MAX 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Alias Studio Tools v13.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Autocad 2007 Professional.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD v.2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Inventor Professional v11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya v8.5 - 64 Bits.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Revit Structure 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoDWG DWGSee 2006 v1.8.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automate unDRM DRM is cracked.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.02 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize Enterprise v7.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoPatcher for Windows XP SP 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.64 final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.64.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.10.06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Powerdesk Pro 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 NO Activation or Keygen or Sno..exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Powerful Cookies v1.0.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO v.3.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 5.7.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v.6.2.0.1254.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.3.0.2132.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall v.4.3.268.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinAVI Video Converter V. 7.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Professional v2.1.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinBoost 4.46.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Window Builder Pro v5.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5 Build 49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds 5.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds v5.02 Golden.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Windows 2003 - Tiny Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Professional 7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Chickfights 2006 DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extreme Movie Manager Pro v4.4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZ Extract Resource v1.82.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZ Soft MP3 CD Ripper v1.71b1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZB Systems EasyBoot 5.1.0.565.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F-Secure Anti-Virus Client Security v5.55.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R First Encounter Assault Recon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. First Encounter Assault and Recon iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.199c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Coffee Cup Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO ASTROLOGICAL SOFT.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO DVD X Studios.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Mobile Phone Unlocker.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Recovery 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO total security PC 2006 NEW.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Air Assault Task Force iSO PC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rock Manager.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa 2007 DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky II.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rogue Remover v1.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\RollerCoaster Tycoon 3 Wild.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rome Season 2 Episode 10 HDTV.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Romeo And Juliet Sealed With A Kiss.DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Room 6 2006 DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Charm DVD To Real Converter v5.9.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter Pro v5.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\CheckMail v.3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Nvidia DVD Player New.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA Gelato v2.0 R1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\NVIDIA PureVideo Decoder v1 02 233.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\O DIA DA PROVA

Link to post
Share on other sites

  • Root Admin

Please go into the Control Panel, Add/Remove and for now remove ALL versions of JAVA

When we're done you can go back and install the latest version but for now please do not install any.

Then run this tool to help cleanup any left over Java

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please download JavaRa and unzip it to your desktop.

***Please close any instances of Internet Explorer (or other web browser) before continuing!***

  • Double-click on JavaRa.exe to start the program.
  • From the drop-down menu, choose English and click on Select.
  • JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
  • Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
  • A logfile will pop up. Please save it to a convenient location and post it back when you reply
    Then look for the following Java folders and if found delete them.
    C:\Program Files\Java
    C:\Program Files\Common Files\Java
    C:\Documents and Settings\All Users\Application Data\Java
    C:\Documents and Settings\All Users\Application Data\Sun\Java
    C:\Documents and Settings\username\Application Data\Java
    C:\Documents and Settings\username\Application Data\Sun\Java

Then run the following tool

    Download and install CCleaner
  • CCleaner
  • Double-click on the downloaded file "ccsetup216.exe" and install the application.
  • Keep the default installation folder "C:\Program Files\CCleaner"
  • Uncheck "Add CCleaner Yahoo! Toolbar and use CCleaner from your browser"
  • Click finish when done and close ALL PROGRAMS
  • Start the CCleaner program.
  • Click on Registry and Uncheck Registry Integrity so that it does not run (basically the very top, uncheck it)
  • Click on Options - Advanced and Uncheck "Only delete files in Windows Temp folders older than 48 hours"
  • Click back to Cleaner and under SYSTEM uncheck the Memory Dumps and Windows Log Files
  • Click on Run Cleaner button on the bottom right side of the program.
  • Click OK to any prompts

Then run this tool

Please visit this webpage for instructions for downloading ComboFix to your
DESKTOP
:
how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run
ComboFix.exe
on your DESKTOP and not from any other folder.

Also,
DO NOT
click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

Note:

The
Windows Recovery Console
will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:
  • Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  • Click
    Yes
    to allow ComboFix to continue scanning for malware.

  • When the tool is finished, it will produce a report for you.

  • Please post the
    C:\ComboFix.txt
    along with a
    new HijackThis log
    so we may continue cleaning the system.

Link to post
Share on other sites

Ran all programs as suggested--took about 2 hours to do. Posting logs ...

Thanks for the help!

-dchen

=====================

ComboFix 09-02-21.01 - david 2009-02-23 22:50:14.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.245 [GMT -5:00]

Running from: c:\documents and settings\david\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\winupdates

c:\program files\winupdates\a.zip

c:\windows\IE4 Error Log.txt

c:\windows\system32\bszip.dll

c:\windows\system32\taskkill.exe

.

((((((((((((((((((((((((( Files Created from 2009-01-24 to 2009-02-24 )))))))))))))))))))))))))))))))

.

2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner

2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-20 20:11 . 2009-02-20 20:11 0 --a------ c:\windows\system32\drivers\nfr.dll.gpref

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-24 03:26 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-21 02:25 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-01-17 00:46 --------- d-----w c:\program files\Google

2008-12-29 03:52 --------- d-----w c:\documents and settings\david\Application Data\U3

2008-12-27 20:01 --------- d--h--w c:\program files\InstallShield Installation Information

2008-12-27 20:01 --------- d-----w c:\program files\Canon

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"80:TCP"= 80:TCP:nfr

"7070:TCP"= 7070:TCP:nfr

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]

R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]

R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]

R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]

R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]

R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]

R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]

R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]

R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]

\Shell\Auto\command - E:\winsys2.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL winsys2.exe

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://slashdot.org/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-23 22:56:30

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2009-02-23 23:01:42

ComboFix-quarantined-files.txt 2009-02-24 04:00:42

Pre-Run: 31,987,781,632 bytes free

Post-Run: 34,698,899,456 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

123 --- E O F --- 2009-02-11 08:03:24

========================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:16:44 PM, on 2/23/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Windows NT\Accessories\wordpad.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--

End of file - 7909 bytes

Link to post
Share on other sites

Re-ran the malwarebytes scan (updated first) -- Trojan.Dropper still seems to be active! Attached is the log, and from HijackThis.

Thanks!

-dchen

=====================

Malwarebytes' Anti-Malware 1.34

Database version: 1798

Windows 5.1.2600 Service Pack 3

2/24/2009 6:08:31 AM

mbam-log-2009-02-24 (06-08-31).txt

Scan type: Full Scan (C:\|)

Objects scanned: 161035

Time elapsed: 33 minute(s), 30 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 217

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.42.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Presentation Wizard 2.0a patch 47.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prey full ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince Of Persia - 4 Version.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia Sands of Time-TECHNiC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper ver. 5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\(ø

Link to post
Share on other sites

  • Root Admin

I'm sorry dchen. If I've not replied back within 24 hours please post again - sometimes I get busy and miss getting back to the post because I don't see it as new.

Let's try a new approach.

STEP 01

Download
DDS
and save it to your desktop

Disable any script blocker if your Anti-Virus/Anti-Malware has it.

Once downloaded you can disconnect from the Internet and disable your Ant-Virus temporarily if needed.

Then double click
dds.scr
to run the tool.

When done, the
DDS.txt
will open.

Click Yes at the next prompt for Optional Scan.
    When done, DDS will open two (2) logs:

  1. DDS.txt
  2. Attach.txt

  • Save both reports to your desktop
  • Please include the following logs in your next reply:
    DDS.txt
    and
    Attach.txt

STEP 02

    Please create a BOOTLOG
  • Restart the computer and press F8 when Windows start booting. This will bring up the startup options.
  • Select "Enable Boot Logging" option and press enter.
  • Windows prompts you to select a Windows Installation (even if there is only one windows installation)
  • This boots windows normally and creates a boot log named ntbtlog.txt and saves it to C:\Windows
    If you're already running inside Windows you can enable it the following way.
  • Click on START - RUN and type in MSCONFIG go to the BOOT.INI tab and place a check mark by /BOOTLOG
  • Click on OK and you will be prompted to RESTART Windows. Please do restart now.
  • After Windows restarts open the file C:\Windows\ntbtlog.txt with Notepad
  • From the Edit menu choose Select All then Edit, COPY and post that back on your next reply.

STEP 03

Delete your current copy of Combofix.exe and download a NEW fresh copy and run that and post back it's log.

Additional links to download the tool:

ComboFix.exe

ComboFix.exe

ComboFix.exe

Link to post
Share on other sites

Hi AdvancedSetup, thanks for the new instructions!

I have included the DDS files as attachments.

-dchen

The BOOTLOG file is below:

=====================

Service Pack 3 3 1 2009 19:55:40.375

Loaded driver \WINDOWS\system32\ntoskrnl.exe

Loaded driver \WINDOWS\system32\hal.dll

Loaded driver \WINDOWS\system32\KDCOM.DLL

Loaded driver \WINDOWS\system32\BOOTVID.dll

Loaded driver ACPI.sys

Loaded driver \WINDOWS\System32\DRIVERS\WMILIB.SYS

Loaded driver pci.sys

Loaded driver isapnp.sys

Loaded driver pciide.sys

Loaded driver \WINDOWS\System32\DRIVERS\PCIIDEX.SYS

Loaded driver MountMgr.sys

Loaded driver ftdisk.sys

Loaded driver PartMgr.sys

Loaded driver VolSnap.sys

Loaded driver atapi.sys

Loaded driver disk.sys

Loaded driver \WINDOWS\System32\DRIVERS\CLASSPNP.SYS

Loaded driver fltmgr.sys

Loaded driver sr.sys

Loaded driver PxHelp20.sys

Loaded driver KSecDD.sys

Loaded driver PenClass.sys

Loaded driver Ntfs.sys

Loaded driver NDIS.sys

Loaded driver Mup.sys

Loaded driver agp440.sys

Loaded driver \SystemRoot\System32\DRIVERS\intelppm.sys

Loaded driver \SystemRoot\System32\DRIVERS\nv4_mini.sys

Loaded driver \SystemRoot\System32\DRIVERS\usbuhci.sys

Loaded driver \SystemRoot\System32\DRIVERS\usbehci.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSFHWBS2.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSF_DP.sys

Loaded driver \SystemRoot\system32\DRIVERS\HSF_CNXT.sys

Loaded driver \SystemRoot\System32\Drivers\Modem.SYS

Loaded driver \SystemRoot\System32\DRIVERS\bcm4sbxp.sys

Loaded driver \SystemRoot\System32\DRIVERS\i8042prt.sys

Loaded driver \SystemRoot\System32\DRIVERS\kbdclass.sys

Loaded driver \SystemRoot\system32\DRIVERS\point32.sys

Loaded driver \SystemRoot\System32\DRIVERS\mouclass.sys

Loaded driver \SystemRoot\System32\DRIVERS\parport.sys

Loaded driver \SystemRoot\System32\DRIVERS\imapi.sys

Loaded driver \SystemRoot\System32\DRIVERS\cdrom.sys

Loaded driver \SystemRoot\System32\DRIVERS\redbook.sys

Loaded driver \SystemRoot\System32\Drivers\GEARAspiWDM.sys

Loaded driver \SystemRoot\system32\drivers\smwdm.sys

Loaded driver \SystemRoot\system32\drivers\aeaudio.sys

Loaded driver \SystemRoot\System32\DRIVERS\audstub.sys

Loaded driver \SystemRoot\System32\DRIVERS\rasl2tp.sys

Loaded driver \SystemRoot\System32\DRIVERS\ndistapi.sys

Loaded driver \SystemRoot\System32\DRIVERS\ndiswan.sys

Loaded driver \SystemRoot\System32\DRIVERS\raspppoe.sys

Loaded driver \SystemRoot\System32\DRIVERS\raspptp.sys

Loaded driver \SystemRoot\System32\DRIVERS\msgpc.sys

Loaded driver \SystemRoot\System32\DRIVERS\psched.sys

Loaded driver \SystemRoot\System32\DRIVERS\ptilink.sys

Loaded driver \SystemRoot\System32\DRIVERS\raspti.sys

Loaded driver \SystemRoot\system32\DRIVERS\pvsvnic.sys

Loaded driver \SystemRoot\System32\DRIVERS\termdd.sys

Loaded driver \SystemRoot\System32\DRIVERS\swenum.sys

Loaded driver \SystemRoot\System32\DRIVERS\update.sys

Loaded driver \SystemRoot\System32\DRIVERS\mssmbios.sys

Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS

Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS

Loaded driver \SystemRoot\System32\DRIVERS\usbhub.sys

Loaded driver \SystemRoot\system32\drivers\MODEMCSA.sys

Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS

Did not load driver \SystemRoot\System32\Drivers\Fdc.SYS

Did not load driver \SystemRoot\System32\Drivers\Flpydisk.SYS

Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS

Did not load driver \SystemRoot\System32\Drivers\i2omgmt.SYS

Did not load driver \SystemRoot\System32\Drivers\Changer.SYS

Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS

Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS

Loaded driver \SystemRoot\System32\Drivers\Null.SYS

Loaded driver \SystemRoot\System32\Drivers\Beep.SYS

Loaded driver \SystemRoot\System32\drivers\vga.sys

Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS

Loaded driver \SystemRoot\System32\DRIVERS\RDPCDD.sys

Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS

Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS

Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys

Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys

Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys

Loaded driver \SystemRoot\System32\DRIVERS\ipnat.sys

Loaded driver \SystemRoot\System32\DRIVERS\wanarp.sys

Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys

Loaded driver \SystemRoot\System32\drivers\afd.sys

Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys

Did not load driver \SystemRoot\System32\DRIVERS\processr.sys

Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS

Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys

Loaded driver \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS

Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\System32\Drivers\Fips.SYS

Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS

Loaded driver \SystemRoot\system32\DRIVERS\pvsnet.sys

Loaded driver \SystemRoot\System32\DRIVERS\ndisuio.sys

Did not load driver \SystemRoot\System32\DRIVERS\rdbss.sys

Did not load driver \SystemRoot\System32\DRIVERS\mrxsmb.sys

Loaded driver \SystemRoot\system32\drivers\wdmaud.sys

Loaded driver \SystemRoot\system32\drivers\sysaudio.sys

Loaded driver \SystemRoot\system32\drivers\splitter.sys

Loaded driver \SystemRoot\system32\drivers\aec.sys

Loaded driver \SystemRoot\system32\drivers\swmidi.sys

Loaded driver \SystemRoot\system32\drivers\DMusic.sys

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Loaded driver \SystemRoot\system32\drivers\drmkaud.sys

Loaded driver \SystemRoot\System32\DRIVERS\mrxdav.sys

Loaded driver \SystemRoot\System32\drivers\BrPar.sys

Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS

Did not load driver \SystemRoot\System32\Drivers\Serial.SYS

Loaded driver \SystemRoot\System32\Drivers\HTTP.sys

Loaded driver \??\C:\WINDOWS\system32\drivers\hypervisor.sys

Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys

Loaded driver \SystemRoot\System32\DRIVERS\srv.sys

Loaded driver \??\C:\WINDOWS\system32\drivers\pvs.sys

Loaded driver \??\C:\WINDOWS\system32\drivers\pvspth.sys

Loaded driver \??\C:\WINDOWS\system32\drivers\pvsum.sys

Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys

Loaded driver \SystemRoot\system32\drivers\kmixer.sys

And the new output from ComboFix:

=========================

ComboFix 09-03-01.01 - david 2009-03-01 20:05:46.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.297 [GMT -5:00]

Running from: c:\documents and settings\david\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))

.

2009-02-28 21:21 . 2009-02-28 21:21 <DIR> d-------- c:\documents and settings\david\Application Data\Sibelius Software

2009-02-27 21:22 . 2009-02-27 21:23 <DIR> d-------- c:\program files\Musicnotes

2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner

2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-20 20:11 . 2009-02-20 20:11 0 --a------ c:\windows\system32\drivers\nfr.dll.gpref

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-28 02:23 1,409 ----a-w c:\windows\Fonts\RPRSSCRP.FOT

2009-02-24 03:26 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-02-21 02:25 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-01-17 00:46 --------- d-----w c:\program files\Google

2009-01-05 22:33 3,751,995 ----a-w c:\windows\system32\GPhotos.scr

2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll

.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_22.59.08.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll

+ 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll

+ 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe

+ 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll

+ 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe

+ 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll

+ 2008-06-17 19:02:19 8,461,312 -c----w c:\windows\system32\dllcache\shell32.dll

- 2009-01-17 01:40:17 122,136 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2009-03-02 00:55:58 150,792 ----a-w c:\windows\system32\FNTCACHE.DAT

- 2008-04-14 00:12:05 8,461,312 ----a-w c:\windows\system32\shell32.dll

+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll

+ 2006-12-02 03:56:00 96,256 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll

+ 2006-12-02 03:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll

+ 2006-12-02 03:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll

+ 2006-12-02 03:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll

+ 2006-12-02 05:25:52 1,101,824 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll

+ 2006-12-02 05:25:56 1,093,120 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll

+ 2006-12-02 05:25:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll

+ 2006-12-02 05:26:00 57,856 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll

+ 2006-12-02 05:08:00 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll

+ 2006-12-02 05:08:00 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll

+ 2006-12-02 05:08:00 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll

+ 2006-12-02 05:08:00 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll

+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll

+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll

+ 2006-12-02 05:46:44 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"80:TCP"= 80:TCP:nfr

"7070:TCP"= 7070:TCP:nfr

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]

R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]

R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]

R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]

R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]

R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]

R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]

R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]

R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]

\Shell\Auto\command - E:\winsys2.exe

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL winsys2.exe

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://slashdot.org/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-01 20:08:38

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

**************************************************************************

.

Completion time: 2009-03-01 20:12:23

ComboFix-quarantined-files.txt 2009-03-02 01:11:05

ComboFix2.txt 2009-02-24 04:01:45

Pre-Run: 34,422,636,544 bytes free

Post-Run: 34,416,644,096 bytes free

141 --- E O F --- 2009-02-25 08:01:01

DDS.txt

Attach.txt

DDS.txt

Attach.txt

Link to post
Share on other sites

  • Root Admin

Please download a NEW fresh copy of Combofix.exe and Update MBAM, then Disconnect from the Internet (remove your cable or disable your wireless)

Temporarily Uninstall Spybot - Search & Destroy - you can re-install it later.

Stop Acrobat 7 from loading (you need to update it, even if you only get Reader 9 and let it open all Web documents)

Do you have any direct Shares available from the MAC to Parallels PC? If so please disable them.

What ever your E: drive is for this system, it has a infected file. Combofix should remove it if it's connected. E:\winsys2.exe

STEP 01

Click on START - RUN and type in or copy / paste NETSH FIREWALL RESET (there is a space between each word) then hit the OK button.

STEP 02

Download but do not yet run ComboFix

If you have a previous version of Combofix.exe, delete it and download a fresh copy.

Download it to your DESKTOP - it MUST run from the Desktop

download.bleepingcomputer.com/sUBs/ComboFix.exe

subs.geekstogo.com/ComboFix.exe

Using your mouse, Highlight and then Right-click | Copy the entire contents of the Code box below, including blank lines

KILLALL::

File::
c:\windows\system32\drivers\nfr.dll.gpref
c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
E:\winsys2.exe
c:\windows\fonts\RPRSSCRP.FOT

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{076b156f-b8d1-11dc-a89e-000123456789}]

Open a new Notepad session (Do not use a Word Processor or WordPad). Click "Format" and be certain that Word Wrap is not enabled. Right-click | Paste the Code box contents from above into Notepad. Click File, Save as..., and set the location to your Desktop, and enter (including quotation marks) as the filename: "CFscript.txt" .

Using your mouse, drag the new file CFscript.txt and drop it on the Combo-Fix.exe icon as shown:

CFScript.gif

  • Important: Have no other programs running. Your Task Bar should be clear of any program entries including your Browser.
  • Disconnect from the Internet.
  • Disable your Antivirus software. If it has Script Blocking features, please disable these as well.
  • A window may open with a series of Disclaimers. Accept the Disclaimers to start the fix.
  • It may identify that Recovery Console is not installed. Please accept when asked if you wish it to be installed.
    When the scan completes Notepad will open with with your results log open. Do a File, Exit.

A caution - Do not run Combofix more than once. Do not touch your mouse/keyboard until the scan has completed, as this may cause the process to stall or your computer to lock. The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your Drive light. If it is flashing, Combofix is still at work.

Post back the Combofix log on your next reply.

STEP 03

Update and Scan with Malwarebytes' Anti-Malware

  • Start MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)
  • Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.
    • Update Malwarebytes' Anti-Malware
    • Select the Update tab
    • Click Update

    [*]When the update is complete, select the Scanner tab

    [*]Select Perform quick scan, then click Scan.

    [*]When the scan is complete, click OK, then Show Results to view the results.

    [*]Be sure that everything is checked, and click Remove Selected.

    [*]When completed, a log will open in Notepad. please copy and paste the log into your next reply

    • If you accidently close it, the log file is saved here and will be named like this:
    • C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Then post back the MBAM log and a new Hijackthis log.

Link to post
Share on other sites

Hi AdvancedSetup,

I uninstalled SpyBot and Acrobat Reader as requested, then performed all steps. I also ran MBAM in full scan mode, two times, to see if the Trojan.Dropper would return (before reconnecting to the Internet)... unfortunately it seems to not be removed.

Posting all logs...

Thanks for the try!

-dchen

ComboFix Log:

===============

ComboFix 09-03-02.01 - david 2009-03-02 21:26:17.3 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.304 [GMT -5:00]

Running from: c:\documents and settings\david\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\david\Desktop\CFscript.txt

* Created a new restore point

FILE ::

c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

c:\windows\fonts\RPRSSCRP.FOT

c:\windows\system32\drivers\nfr.dll.gpref

E:\winsys2.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

c:\windows\fonts\RPRSSCRP.FOT

c:\windows\system32\drivers\nfr.dll.gpref

.

((((((((((((((((((((((((( Files Created from 2009-02-03 to 2009-03-03 )))))))))))))))))))))))))))))))

.

2009-02-28 21:21 . 2009-02-28 21:21 <DIR> d-------- c:\documents and settings\david\Application Data\Sibelius Software

2009-02-27 21:22 . 2009-02-27 21:23 <DIR> d-------- c:\program files\Musicnotes

2009-02-23 22:22 . 2009-02-23 22:22 <DIR> d-------- c:\program files\CCleaner

2009-02-22 10:26 . 2009-02-22 10:26 <DIR> d-------- c:\program files\Trend Micro

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\david\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-20 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-20 23:15 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-20 23:15 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-03 02:08 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-01-17 00:46 --------- d-----w c:\program files\Google

.

((((((((((((((((((((((((((((( SnapShot@2009-02-23_22.59.08.53 )))))))))))))))))))))))))))))))))))))))))

.

+ 2008-06-17 19:04:34 8,461,824 ----a-w c:\windows\$hf_mig$\KB967715\SP3QFE\shell32.dll

+ 2008-07-09 07:38:24 17,272 ----a-w c:\windows\$hf_mig$\KB967715\spmsg.dll

+ 2008-07-09 07:38:25 231,288 ----a-w c:\windows\$hf_mig$\KB967715\spuninst.exe

+ 2008-07-09 07:38:24 26,488 ----a-w c:\windows\$hf_mig$\KB967715\update\spcustom.dll

+ 2008-07-09 07:38:29 755,576 ----a-w c:\windows\$hf_mig$\KB967715\update\update.exe

+ 2008-07-09 07:38:37 382,840 ----a-w c:\windows\$hf_mig$\KB967715\update\updspapi.dll

+ 2008-06-17 19:02:19 8,461,312 -c----w c:\windows\system32\dllcache\shell32.dll

- 2009-01-17 01:40:17 122,136 ----a-w c:\windows\system32\FNTCACHE.DAT

+ 2009-03-02 00:55:58 150,792 ----a-w c:\windows\system32\FNTCACHE.DAT

- 2008-04-14 00:12:05 8,461,312 ----a-w c:\windows\system32\shell32.dll

+ 2008-06-17 19:02:19 8,461,312 ----a-w c:\windows\system32\shell32.dll

+ 2006-12-02 03:56:00 96,256 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll

+ 2006-12-02 03:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll

+ 2006-12-02 03:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll

+ 2006-12-02 03:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll

+ 2006-12-02 05:25:52 1,101,824 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll

+ 2006-12-02 05:25:56 1,093,120 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll

+ 2006-12-02 05:25:58 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll

+ 2006-12-02 05:26:00 57,856 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll

+ 2006-12-02 05:08:00 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll

+ 2006-12-02 05:08:00 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll

+ 2006-12-02 05:08:00 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll

+ 2006-12-02 05:08:00 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll

+ 2006-12-02 05:08:00 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll

+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll

+ 2006-12-02 05:08:00 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll

+ 2006-12-02 05:46:44 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvMediaCenter"="c:\windows\system32\NVMCTRAY.DLL" [2003-07-28 49152]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 68856]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2004-12-20 33792]

"IntelliPoint"="c:\program files\Microsoft IntelliPoint\point32.exe" [2004-06-03 204800]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-25 282624]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2006-10-30 256576]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"RunNarrator"="Narrator.exe" [2008-04-13 c:\windows\system32\narrator.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-10-09 113664]

Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-02-17 65588]

TabUserW.exe.lnk - c:\windows\system32\WTablet\TabUserW.exe [2005-12-27 106496]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"ctfmon.exe"=c:\windows\system32\ctfmon.exe

"MSMSGS"="c:\program files\Messenger\MSMSGS.EXE" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"nwiz"=nwiz.exe /install

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

R2 AdobeActiveFileMonitor;Adobe Active File Monitor;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe [2004-10-04 98304]

R2 hypervisor;Parallels Hypervisor;c:\windows\system32\drivers\hypervisor.sys [2007-09-16 51200]

R2 PhotoshopElementsDeviceConnect;Photoshop Elements Device Connect;c:\program files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe [2004-10-04 118784]

R2 PRLDHCP;Parallels DHCP Service for Virtual NIC;c:\program files\Parallels\Parallels Workstation\PRLDHCP.exe [2007-09-16 32768]

R2 pvs;Parallels Kernel Driver;c:\windows\system32\drivers\pvs.sys [2007-09-16 28480]

R2 pvsnet;Parallels Network Driver;c:\windows\system32\drivers\pvsnet.sys [2007-09-25 12310]

R2 pvspth;Parallels Passthrough Driver;c:\windows\system32\drivers\pvspth.sys [2007-09-16 13344]

R2 pvsum;Parallels USB Manager;c:\windows\system32\drivers\PvsUM.sys [2007-09-16 8320]

R3 PVSVNIC;Parallels Virtual NIC Driver;c:\windows\system32\drivers\pvsvnic.sys [2007-09-16 4412]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://slashdot.org/

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200

FF - ProfilePath - c:\documents and settings\david\Application Data\Mozilla\Firefox\Profiles\2wdke8oe.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=

FF - prefs.js: browser.search.selectedEngine - Google

FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-02 21:30:29

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\nvsvc32.exe

c:\program files\Analog Devices\SoundMAX\spkrmon.exe

c:\windows\system32\Tablet.exe

c:\windows\system32\wdfmgr.exe

c:\program files\Canon\CAL\CALMAIN.exe

c:\windows\system32\rundll32.exe

c:\program files\iPod\bin\iPodService.exe

.

**************************************************************************

.

Completion time: 2009-03-02 21:33:20 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-03 02:33:17

ComboFix2.txt 2009-03-02 01:12:26

ComboFix3.txt 2009-02-24 04:01:45

Pre-Run: 34,443,104,256 bytes free

Post-Run: 34,432,557,056 bytes free

149 --- E O F --- 2009-02-25 08:01:01

HiJack This Log:

================

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:07:55 AM, on 3/3/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\Tablet.exe

C:\Program Files\Canon\CAL\CALMAIN.exe

C:\Program Files\Winamp\winampa.exe

C:\Program Files\Microsoft IntelliPoint\point32.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\WTablet\TabUserW.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://slashdot.org/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/

O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll

O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll

O3 - Toolbar: Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_5_7_0.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKCU\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NVMCTRAY.DLL,NvTaskbarInit

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')

O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\WTablet\TabUserW.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1125076715015

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1220192943387

O23 - Service: Adobe Active File Monitor (AdobeActiveFileMonitor) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsFileAgent.exe

O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe

O23 - Service: Photoshop Elements Device Connect (PhotoshopElementsDeviceConnect) - Unknown owner - C:\Program Files\Adobe\Photoshop Elements 3.0\PhotoshopElementsDeviceConnect.exe

O23 - Service: Parallels DHCP Service for Virtual NIC (PRLDHCP) - Parallels Software International, Inc. - C:\Program Files\Parallels\Parallels Workstation\PRLDHCP.exe

O23 - Service: spkrmon - Unknown owner - C:\Program Files\Analog Devices\SoundMAX\spkrmon.exe

O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe

O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe

--

End of file - 7256 bytes

MBAM Log 1 (QuickScan)

=======================

Malwarebytes' Anti-Malware 1.34

Database version: 1814

Windows 5.1.2600 Service Pack 3

3/2/2009 10:05:46 PM

mbam-log-2009-03-02 (22-05-46).txt

Scan type: Quick Scan

Objects scanned: 64599

Time elapsed: 2 minute(s), 50 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

MBAM Log 2

=============

Malwarebytes' Anti-Malware 1.34

Database version: 1814

Windows 5.1.2600 Service Pack 3

3/2/2009 11:23:49 PM

mbam-log-2009-03-02 (23-23-49).txt

Scan type: Full Scan (C:\|)

Objects scanned: 163179

Time elapsed: 38 minute(s), 57 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 180

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.34.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prey DVDRip REPACK XviD-ReCode.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia Revelations Psp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper v1.3.49.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 DVD Maker v3.0.0.48.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 CD Ripper 1.80.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper 4.2 with KeyGen.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\100 Deadliest Karate Moves - A TutorialScary....exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Activator 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows VISTA FINAL 2007 Updated Links.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista RC1 Build 5600 Direct Fast Link.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Ultimate Retail with full genui.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP 11 in 1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Corporate With SP2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Xp Media Center Edition - Live Editio.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional - Demonoid Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows xp Professional With SP3 May 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.62.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.39.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.58.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro 4.80.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware and Adware Removal 3.0e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 2006 3.8.0.2584 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2602 + fix.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2618 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 5.0.0.182 Vista Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.5.1.498.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.0.2613-RESURRECTiON.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v5.0.0.182.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Die Hard Nakatomi Plaza.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital 3D Screensaver 1.1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor 7.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Audio Editor v7.8.5 Build 550.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Digital Element WorldBuilder Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1Click DVD Copy 5.1.1.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\2 Fast 2 Furious.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\3D Home Design Suite Deluxe v6.0 Retail.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\A Scanner Darkly CAM.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Acronis True Image 9.1 Build 3633.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Acrobat 3D 7.0.86 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Adobe Pagemaker v7.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Advanced RAR Password Recovery 1.53.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Agnitum Outpost Firewall Pro v.4.0.964.6926.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Caste.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Life Deathmatch Source.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half Past Dead 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Half-Life 2 Collectors Edition - PROViSiON.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Backup 5.6.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Handy Password v3.8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Hannibal 2006 DVDRip Xvid.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trillian Password Recovery v1.0.200.2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Hunter v4.1 Build 903.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover 6.5.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Trojan Remover v6.5.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Crime New York City.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\True Image Enterprise Server 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto Power on and Shut down v2.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Auto Run Design Specialty v5.0.8.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoDesk - Lustre 2007 - ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AutoDesk 3DS Max 9 3D Studio Max.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Architectural Desktop 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk AutoCAD LT 2007.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Combustion v4.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk Maya Unlimited v8.0 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autodesk MotionBuilder ver.7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize 6.22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Automize 7.29 Enterprise.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Autopano Pro V1.0.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 9.60 - Final.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2006 v9.51.01.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerArchiver 2007 v10.0 Beta 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerDVD 7 - COMPLETE FULL.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\PowerISO 3.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer 6.2.1 Build 1newsid2234663.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio MailServer v6.12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Kerio Personal Firewall 4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Winavi Video Converter 7.7 With Crack.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WinBackup Pro 2.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Window Blinds + 32 themes.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Window Washer 6.0.5.409 Portable Edition.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Windowblinds 5.02.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\WindowBlinds Enhanced v.5.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Windows Internet Cleaner Pro v5.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Extra Drive Creator Pro 6.6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\eXtreme Movie Manager 5.6.2.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\EZ Backup Firefox and Thunderbird Premium v4.7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Ez Mp3 Creator V1.3.9.390.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\F.E.A.R. - First Encounter Assault Recon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Aibase-CS v1.140.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO - Unattended XP Making Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO CrackSearch Hacking Tools.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Guitar Lessons Vol.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Proxy Tools 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\AIO Sony Media.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Air America Radio The Al Franken Show 02 27 06.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa dvdscreen 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rocky Balboa PROPER-DVDSCR-XVID-MVS.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Rome - Complete Season 1 Caps.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Charm Real Converter 5.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Chat Watch 4.4.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\nVidia Forceware 91.28 32-bit 2yk & Xp.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\nVidia nTune 5.05.25.00.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\O&O Defrag 8.6 Pro.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\O&O FormatRecovery v4.0.727.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Object Rescue Pro 4.4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\ObjectRescue Pro v4.0.141.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Ten Thumbs Typing Tutor 4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Text Recordster v1.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\007 - Licence To Kill.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\123 DVD Clone v2.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Macromedia Director 8.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic Burning Studio v10.1.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic DVD R v 4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic DVD Ripper v4.2.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic ISO Maker 5.3 Build 0229.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic Swf2Gif 1.35.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic Utilities 2004 3.10.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic Utilities 2006 v4.22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Magic Utilities 4.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Download Accelerator Plus 8.1.5.6 Full.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Dr. DivX 2.0.0 RC3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Dr.Hardware 2005 Build 6.0.0e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Adobe Flash Professional 9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Advanced Encryption Package v4.21.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\AI Roboform Pro 6.8.9.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Alien Shooter 2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Apollo DVD Copy ver. 4.7.5.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Arial Audio Converter 2.3.11.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Ashampoo AntiVirus 1.40.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Aurora Media Workshop v3.3.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Pixarra Twisted Brush v12.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Plato DVD Ripper 1.19.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Plato DVD to DivX XviD Ripper 4.50.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Plato Video Converter v3.13.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Plato Video To Mp4 v2.13.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Batch It! Ultra v3.91.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Battlefield 2 iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Bearshare 5.2.5.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Google Earth PRO v3.0.0395.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Graphic Workshop Professional v3.0a 22.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Screen Recorder Gold v2.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\www el torrent ath cx El Mejor Dia De Mi Vida....exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Clean Disk Security 7.52.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Clean Space v9.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\AIO Mobile software v1.0.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Alarm v7.05.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Alias ImageStudio v.3.0 (Full).exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Nero 7 Premium Reloaded v7.5.9.0A Vista Ready.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Nero 7.8.5.0 Premium.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Nero CD-DVD Speed 4.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Nero PhotoShow Express 4.5.2045 ISO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Nero Premium Edition v7.2.0.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Net Aid v3.1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Network Event Viewer 6.0.0.52.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Express Plus 2.1.2.4.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\EZ Auction Timer Plus v1.60.153.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\FairStars Audio Converter 1.51.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Family Cyber Alert ver. 3.91.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internal Affairs XXX DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Business Promoter 9.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Cyclone v1.90.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.0 Beta 3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Download Manager 5.07 Beta 3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Download Manager v4.07.3.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.02.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Download Manager v5.07 Beta 6.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Explorer Security Pro v7.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Internet Video Converter 1.41.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\Intervideo DVDCopy Platinum v4.5B002.09C.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Sims 2 University.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Skeleton Key.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Texas Chainsaw Massacre.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Truman Show 1998 DVDRip AVC.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Untouchables DVDRip.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The White Dragon.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\david\Shared\_\The Work And The Glory American Zion DVDRip XviD.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Qoobox\Quarantine\C\WINDOWS\system32\bszip.dll.vir (Worm.P2P) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{841A6618-5B0A-44A9-81FC-280F6504ACFE}\RP1076\A0067347.dll (Worm.P2P) -> Quarantined and deleted successfully.

MBAM Log 3

=============

Malwarebytes' Anti-Malware 1.34

Database version: 1814

Windows 5.1.2600 Service Pack 3

3/3/2009 5:27:49 AM

mbam-log-2009-03-03 (05-27-49).txt

Scan type: Full Scan (C:\|)

Objects scanned: 163469

Time elapsed: 39 minute(s), 3 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 156

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\Documents and Settings\Darcy Chen\Shared\_\Premium Clock 2.32.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prey DVDRip REPACK XviD ReCode.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince of Persia The Two Thrones iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Prince Of Persia Anthology.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\#1 DVD Ripper 5.33.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\007 DVD Maker v3.0.0.45.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 Anonymous Proxy List Verifier v1.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\1 DVD Ripper 4.1.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\100 best albums of 2004 according to Fogass vol 1....exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista 86x Ultimate Final 32bit.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista RC1 Build 5600 Direct Fast Li.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows Vista Ultimate iSO.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP -For Gamer.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Corporate W SP3 Feb 2006.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Media Center 2005.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Microsoft Windows XP Professional Lite BOOT EDITION.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover 2.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.35.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyRemover v2.57.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\SpyStopper Pro 4.60.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware and Adware Removal 3.0c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 2006 3.8.0.2557.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 4.0.0.2618 for Windows.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor 5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v3.2.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v4.0.0.2603.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Spyware Doctor v5.0.0.179.exe (Trojan.Dropper) -> Quarantined and deleted successfully.

C:\Documents and Settings\Darcy Chen\Shared\_\Die Befreiung 01 Der L

Link to post
Share on other sites

  • Root Admin

Is this folder really shared?

Let's try these RK scanners.

RootRepeal - Rootkit Detector

  • Please download the following tool:
    RootRepeal - Rootkit Detector
  • Direct download link is here:
    RootRepeal.rar

  • If you don't already have a program to open a .RAR compressed file you can download a trial version from here:
    WinRAR

  • Extract the program file to a new folder such as
    C:\RootRepeal

  • Run the program
    RootRepeal.exe
    and go to the
    REPORT
    tab and click on the
    Scan
    button

  • Select
    ALL
    of the checkboxes and then click
    OK
    and it will start scanning your system.

  • If you have multiple drives you only need to check the C: drive or the one Windows is installed on.

  • When done, click on
    Save Report

  • Save it to the same location where you ran it from, such as
    C:\RootRepeal

  • Save it as
    your_name_rootrepeal.txt
    - where your_name is your
    forum name

  • This makes it more easy to track who the log belongs to.

  • Then open that log and select all and copy/paste it back on your next reply please.

  • Quit the RootRepeal program.

Please download the following scanning tool. GMER

  • Open the zip file and copy the file
    gmer.exe
    to your Desktop.
  • Double click on
    gmer.exe
    and run it.

  • It may take a minute to load and become available.

  • Do not make any changes. Click on the
    SCAN
    button and DO NOT use the computer while it's scanning.

  • Once the scan is done click on the
    SAVE
    button and browse to your Desktop and save the file as
    GMER.LOG

  • Zip up the
    GMER.LOG
    file and save it as
    gmerlog.zip
    and attach it to your reply post.

  • DO NOT
    directly post this log into a reply. You
    MUST
    attach it as a .ZIP file.

  • Click OK and quit the GMER program.

Link to post
Share on other sites

I started running RootRepeal and noticed that it hung in the folder:

C:\Documents and Settings\Darcy Chen\Shared\_

I had tried to use Windows Explorer to check that folder in the past; couldn't find it and thought that the "_" name was somehow not really there. Then I tried "Tools -> Folder Options -> Views" and unchecked "Hide protected operating system files" then I found that there was actually a folder named "_". This folder had 10's of thousands of EXE files, all the same size with long names that differed only by version number. I deleted all these files manually, then a full MBAM scan ran successfully with no threats found.

I'm hoping that this was the problem. I'm thinking that MBAM found and deleted a few of these files at a time, but did not report all 10's of thousands in a single directory all at once. I saved one of the EXE files as a ZIP archive. If you like, I can email this to you.

Best regards,

-dchen

Link to post
Share on other sites

  • Root Admin

Well after a bit more research this appears to be a known P2P file sharing worm.

Basically it came from one of your programs sharing out your system.

You should uninstall and remove this programs from your computer.

BitTorrent 5.0.9

SoulSeek Client 156c

File sharing involves using technology that allows internet users to share files that are housed on their individual computers. Peer-to-peer (P2P) applications, such as those used to share music files, are some of the most common forms of file-sharing technology. However, P2P applications introduce security risks that may put your information or your computer in jeopardy.

Risks of File-Sharing Technology

Link to post
Share on other sites

Hi AdvancedSetup, I think my system is now OK. I uninstalled the P2P programs that you suggested, rebooted and the most recent MBAM full scan was totally clean. Let me know if you would like me to email the ZIP file for the EXE file that I found.

Thanks again for all the great help!

-dchen

Link to post
Share on other sites

  • Root Admin

No that's fine. Just a file sharing worm. With the programs removed you should be okay as long as you didn't run or install any of those files.

Great, all looks good now.

I'll close your post soon so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?

At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.

Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Remove all but the most recent Restore Point on Windows XP

You should
Create a New Restore Point
to prevent possible reinfection from an old one.

Some of the malware you picked up could have been saved in System Restore.

Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.

Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to
"roll-back"
to a clean working state.

The easiest and safest way to do this is

:
  • Go to
    Start
    >
    Programs
    >
    Accessories
    >
    System Tools
    and click "
    System Restore
    ".
  • If the shortcut is missing you can also click on
    START
    >
    RUN
    > and type in
    %SystemRoot%\system32\restore\rstrui.exe
    and click OK

  • Choose the radio button marked "
    Create a Restore Point
    " on the first screen then click "
    Next
    ".

  • Give the new Restore Point a name, then click "
    Create
    ".

  • The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

  • Then use the
    Disk Cleanup
    to remove all but the most recently created Restore Point.
  • Go to
    Start
    >
    Run
    and type:
    Cleanmgr.exe

  • Select the drive where Windows is installed and click "
    Ok
    ". Disk Cleanup will scan your files for several minutes, then open.

  • Click the "
    More Options
    " tab, then click the "
    Clean up
    " button under System Restore.

  • Click Ok. You will be prompted with "
    Are you sure you want to delete all but the most recent restore point?
    "

  • Click
    Yes
    , then click Ok.

  • Click
    Yes
    again when prompted with "
    Are you sure you want to perform these actions?
    "

  • Disk Cleanup will remove the files and close automatically.

  • On the
    Disk Cleanup
    tab, if the
    System Restore: Obsolete Data Stores
    entry is available remove them also.

  • These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.

selectdrivecleanup.pngselectdrivecleanup1.png

Additional information

Microsoft KB article: How to turn off and turn on System Restore in Windows XP

Bert Kinney's site: All about Windows System Restore

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster

Download it from here

Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol

Download it from here

Here you can find information about how WinPatrol works here

Install FireTrust SiteHound

You can find information and download it from here

Install hpHosts

Download it from here

hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,

tracking and malicious websites. This prevents your computer from connecting to these untrusted sites

by redirecting them to 127.0.0.1 which is your own local computer.

hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

You can use one of these sites to check if any updates are needed for your pc.

Secunia Software Inspector

F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.

http://www.update.microsoft.com

Note 1: If you are running Windows XP SP2, you should upgrade to SP3.

Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.

The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.

I recommend Online Armor Free

A little outdated but good reading on how to prevent Malware

Keep safe online and happy surfing.

Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructions

Also don't forget that we offer FREE assistance with General PC questions and repair here PC Help

If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.