Malwarebytes won't run

tallisall · February 27, 2009

A friend brought his Dell laptop over and wanted me to get a virus off. The machine is an Inspirion 1520 with XP Home sp-2, Intel dual core 1.4GHz, and 1 gig ram. He bought Trend Micro's antivirus, but it would not load. I downloaded Malwarebytes ver 1.34 and after renaming the exe file it loaded. I did a manual update, but it will not start. I checked in device manager and unhid the non plug and play folder, but did not find the TDSSserv.sys driver there.

Please look at the HiJackThis log. I need some help.

Thanks

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 5:38:36 PM, on 2/25/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\WLTRYSVC.EXE

C:\WINDOWS\System32\bcmwltry.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\dlcxcoms.exe

C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

C:\Program Files\Dell Support Center\bin\sprtsvc.exe

C:\Program Files\Trend Micro\Internet Security\UfSeAgnt.exe

C:\Program Files\Trend Micro\BM\TMBMSRV.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Greetings Workshop\GWREMIND.EXE

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\DOCUME~1\RICHARD\LOCALS~1\Temp\owly0z01tc.exe

C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe

C:\Scan-RDH\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4071215

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4071215

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O1 - Hosts: 195.245.119.131 browser-security.microsoft.com

O2 - BHO: C:\WINDOWS\system32\hs78344kjkfd.dll - {c5bf49a2-94f3-42bd-f434-3604812c8955} - C:\WINDOWS\system32\hs78344kjkfd.dll

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [3838] C:\cxfagn.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [knc4yo8iy4mfv7gdecbh] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\m9xw2p.exe

O4 - HKCU\..\Run: [spp57qyw8gk3ryh8h1w2m] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\c76ofd.exe

O4 - HKCU\..\Run: [yj60222whs6cujnunw655lszpffpdmyyfcb] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\o14i9g5ft.exe

O4 - HKCU\..\Run: [m5n0fc07j4wmuh4s18r] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\c4j513q5.exe

O4 - HKCU\..\Run: [wpklrox6n9y44jluvd1fmqbwrtm3wf6kzz2qmqqszo] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\owly0z01tc.exe

O4 - HKCU\..\Run: [qxcyw8bxre9sbanvv87a3iioog2p15cw7kiib40io2] C:\DOCUME~1\RICHARD\LOCALS~1\Temp\eyrl3gx9rei.exe

O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE

O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe

O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL bmjyjq.dll

O20 - Winlogon Notify: adfeedbfce - C:\WINDOWS\system32\adfeedbfce.dll

O20 - Winlogon Notify: avicore - avicore.dll (file missing)

O20 - Winlogon Notify: c00D9D9E - C:\WINDOWS\SYSTEM32\c00D9D9E.mat

O20 - Winlogon Notify: sys32 - sys32.dll (file missing)

O20 - Winlogon Notify: __c00636A1 - __c00636A1.jpg (file missing)

O20 - Winlogon Notify: __c008B459 - __c008B459.jpg (file missing)

O20 - Winlogon Notify: __c00C7F8A - C:\WINDOWS\system32\__c00C7F8A.dat (file missing)

O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - C:\WINDOWS\system32\hs78344kjkfd.dll

O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\

O23 - Service: dlcx_device - - C:\WINDOWS\system32\dlcxcoms.exe

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe

O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

O23 - Service: Trend Micro Central Control Component (SfCtlCom) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe

O23 - Service: Trend Micro Unauthorized Change Prevention Service (TMBMServer) - Trend Micro Inc. - C:\Program Files\Trend Micro\BM\TMBMSRV.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\Program Files\Trend Micro\Internet Security\TmProxy.exe

O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--

End of file - 7247 bytes

AdvancedSetup · February 27, 2009

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

tallisall · February 27, 2009

I have downloaded combofix to desktop, but it will not run. Should I try it in safe mode?

tallisall · February 27, 2009

Renamed combofix and it ran. During its run, it stopped and said that it had detected the presence of rootkit activity and gave a list of files to copy down before reboot. I copied the files, it rebooted, and when it came back up windows blue screened with a message that it shutdown for protection. stop: 0x0000008e (0x0000005, 0x00300020, 0xBA747CF0, 0x00000000) I turned the laptop off, then rebooted into safe mode and combofix finished. The laptop now will not bootup normally without blue screening. I did HiJackThis in safe mode.

ComboFix 09-02-26.02 - RICHARD 2009-02-27 12:14:49.1 - NTFSx86 MINIMAL

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1022.844 [GMT -6:00]

Running from: c:\documents and settings\RICHARD\Desktop\rdh.exe

FW: Trend Micro Personal Firewall *disabled*

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat

c:\windows\IE4 Error Log.txt

c:\windows\sysguard.exe

c:\windows\system32\a.exe

c:\windows\system32\adfeedbfce.dll

c:\windows\system32\ahtn.htm

c:\windows\system32\bcuncfau.ini

c:\windows\system32\bkcogsvt.ini

c:\windows\system32\bmjyjq.dll

c:\windows\system32\dnpdnqwd.ini

c:\windows\system32\drivers\UACwsrfuiwi.sys

c:\windows\system32\frmwrk32.exe

c:\windows\system32\hs78344kjkfd.dll

c:\windows\system32\init32.exe

c:\windows\system32\kjqbpeip.dll

c:\windows\system32\lllssj.dll

c:\windows\system32\mcrxkrbf.dll

c:\windows\system32\megisqdm.dll

c:\windows\system32\piepbqjk.ini

c:\windows\system32\queekyni.ini

c:\windows\system32\rtyikgpn.dll

c:\windows\system32\tBceNnnn.ini

c:\windows\system32\tBceNnnn.ini2

c:\windows\system32\UACdmspprpu.log

c:\windows\system32\UACiatywmkm.dll

c:\windows\system32\UACnbowmxvn.dll

c:\windows\system32\UACoesjjlpy.log

c:\windows\system32\UACppwvyqjv.dll

c:\windows\system32\UACrfvaggps.log

c:\windows\system32\UACvkftowqb.dat

c:\windows\system32\UACwdnmtqoy.dll

c:\windows\system32\uglggc.dll

c:\windows\system32\uklxgxqt.dll

c:\windows\system32\uniq.tll

c:\windows\system32\warning.gif

c:\windows\system32\win32hlp.cnf

c:\windows\system32\yepacrew.ini

c:\windows\system32\ywhpwl.dll

C:\xcrashdump.dat

----- BITS: Possible infected sites -----

hxxp://kakoitodomen.com

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-01-27 to 2009-02-27 )))))))))))))))))))))))))))))))

.

2009-02-25 17:37 . 2009-02-25 17:42 <DIR> d-------- C:\Scan-RDH

2009-02-25 13:40 . 2009-02-27 09:49 <DIR> d-------- C:\Downloads

2009-02-23 10:57 . 2009-02-23 10:57 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-02-23 10:57 . 2009-02-23 10:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-02-23 10:57 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-23 10:57 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-02-22 11:32 . 2009-02-27 11:46 5,164 --a------ c:\windows\system32\uacinit.dll

2009-02-22 11:31 . 2009-02-27 12:20 100,590 --a------ c:\windows\system32\drivers\ba655cfb.sys

2009-02-22 11:31 . 2009-02-22 11:31 72,704 --a------ c:\windows\system32\hwgiuibk.dll

2009-02-22 11:31 . 2009-02-22 11:31 39,936 --a------ c:\windows\Jnekoducexucok.dll

2009-02-22 11:31 . 2009-02-22 11:31 39,936 --a------ C:\cwxwwgtl.exe

2009-02-22 11:31 . 2009-02-22 11:31 27,136 --a------ C:\pfkik.exe

2009-02-22 11:31 . 2009-02-22 11:31 2 --a------ C:\-1193060467

2009-02-22 11:26 . 2009-02-22 11:26 147 --a------ c:\windows\TmProxy.ini

2009-02-21 23:25 . 2009-02-21 23:25 <DIR> d-------- c:\windows\system32\Dell

2009-02-20 19:52 . 2009-02-20 19:52 <DIR> d-------- c:\documents and settings\RICHARD\Application Data\MSNInstaller

2009-02-18 18:14 . 2009-02-18 18:14 20,992 --ahs---- c:\windows\system32\c0090F2.mat

2009-02-16 22:28 . 2009-02-16 22:28 16,896 --a------ c:\windows\syssvc.exe

2009-02-16 16:23 . 2009-02-16 16:23 20,992 --ahs---- c:\windows\system32\c00AA651.mat

2009-02-15 18:35 . 2009-02-15 18:35 <DIR> d-------- c:\windows\system32\log

2009-02-15 17:26 . 2009-02-15 17:17 138,384 --a------ c:\windows\system32\drivers\tmcomm.sys

2009-02-15 17:26 . 2009-02-15 17:17 52,496 --a------ c:\windows\system32\drivers\tmactmon.sys

2009-02-15 17:26 . 2009-02-15 17:17 52,240 --a------ c:\windows\system32\drivers\tmevtmgr.sys

2009-02-15 17:17 . 2008-08-16 02:53 1,195,448 --a------ c:\windows\system32\drivers\vsapint.sys

2009-02-15 17:17 . 2009-02-15 17:17 656,648 --a------ c:\windows\system32\UfWSC.cpl

2009-02-15 17:17 . 2009-02-15 17:17 333,328 --a------ c:\windows\system32\drivers\TM_CFW.sys

2009-02-15 17:17 . 2008-08-16 03:00 205,328 --a------ c:\windows\system32\drivers\tmxpflt.sys

2009-02-15 17:17 . 2009-02-15 17:17 65,936 --a------ c:\windows\system32\drivers\tmtdi.sys

2009-02-15 17:17 . 2008-08-16 03:00 36,368 --a------ c:\windows\system32\drivers\tmpreflt.sys

2009-02-15 16:41 . 2009-02-15 16:41 302,592 --a------ c:\windows\system32\nnnNecBt.dll.vir

2009-02-15 15:50 . 2009-02-15 15:50 20,992 --ahs---- c:\windows\system32\c00ED910.mat

2009-02-14 13:33 . 2009-02-14 13:33 20,992 --ahs---- c:\windows\system32\c006AC40.mat

2009-02-13 20:52 . 2009-02-13 20:52 20,992 --ahs---- c:\windows\system32\c0073440.mat

2009-02-12 17:49 . 2009-02-27 11:54 <DIR> d-------- c:\program files\Greetings Workshop

2009-02-12 17:40 . 2009-02-12 17:40 20,992 --ahs---- c:\windows\system32\c00BD929.mat

2009-02-07 14:10 . 2009-02-07 14:10 20,992 --ahs---- c:\windows\system32\c00B168E.mat

2009-02-01 15:07 . 2009-02-01 15:07 20,992 --ahs---- c:\windows\system32\c0028BAE.mat

2009-01-31 15:01 . 2009-01-31 15:01 20,992 --ahs---- c:\windows\system32\c00AE53A.mat

2009-01-30 20:42 . 2009-01-30 20:42 20,992 --ahs---- c:\windows\system32\c0041F35.mat

2009-01-28 08:10 . 2009-01-28 08:10 20,992 --ahs---- c:\windows\system32\c00CD639.mat

2009-01-27 17:52 . 2009-01-27 17:52 20,992 --ahs---- c:\windows\system32\c00A1BAA.mat

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-02-27 15:54 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater

2009-02-25 22:08 --------- d-----w c:\program files\Dell

2009-02-22 17:50 --------- d-----w c:\program files\Norton Security Scan

2009-02-22 17:50 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-02-22 17:30 --------- d-----w c:\documents and settings\RICHARD\Application Data\Skype

2009-02-22 17:28 --------- d-----w c:\program files\Dl_cats

2009-02-22 17:18 --------- d-----w c:\documents and settings\RICHARD\Application Data\skypePM

2009-02-21 22:49 --------- d-----w c:\documents and settings\All Users\Application Data\Dell

2009-02-16 22:20 --------- d-----w c:\program files\Trend Micro

2009-02-15 23:22 --------- d-----w c:\documents and settings\All Users\Application Data\Trend Micro

2009-01-07 00:09 --------- d-----w c:\program files\Google

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-06 8429568]

"Logitech Utility"="Logi_MwX.Exe" [2003-03-04 c:\windows\LOGI_MWX.EXE]

c:\documents and settings\RICHARD\Start Menu\Programs\Startup\

Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1997-09-04 50688]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2007-12-14 50688]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\c00D9D9E]

2008-10-25 09:08 20992 c:\windows\system32\c00D9D9E.mat

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

S1 ba655cfb;ba655cfb;c:\windows\system32\drivers\ba655cfb.sys [2009-02-22 100590]

S2 dlcx_device;dlcx_device;c:\windows\system32\dlcxcoms.exe -service --> c:\windows\system32\dlcxcoms.exe -service [?]

S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2009-02-15 52240]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2007-12-15 29744]

S3 tmcfw;Trend Micro Common Firewall Service;c:\windows\system32\drivers\TM_CFW.sys [2009-02-15 333328]

S3 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2009-02-15 488768]

S3 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2009-02-15 648456]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{004c0132-927d-11dd-ab8f-0050b64247b4}]

\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb14405a-01c9-11de-ac18-001d09aeea45}]

\shell\autorun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\m.exe /s

.

Contents of the 'Scheduled Tasks' folder

2008-12-12 c:\windows\Tasks\Norton Security Scan for RICHARD.job

- c:\program files\Norton Security Scan\Nss.exe [2008-12-11 17:49]

.

- - - - ORPHANS REMOVED - - - -

BHO-{c5bf49a2-94f3-42bd-f434-3604812c8955} - c:\windows\system32\hs78344kjkfd.dll

HKLM-Run-3838 - C:\cxfagn.exe

SharedTaskScheduler-{C5BF49A2-94F3-42BD-F434-3604812C8955} - c:\windows\system32\hs78344kjkfd.dll

Notify-__c00C7F8A - c:\windows\system32\__c00C7F8A.dat

Notify-avicore - avicore.dll

Notify-sys32 - sys32.dll

Notify-__c00636A1 - __c00636A1.jpg

Notify-__c008B459 - __c008B459.jpg

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4071215

mStart Page = hxxp://www.dell.com

mSearch Bar = hxxp://www.google.com/ie

uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4071215

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-02-27 12:22:43

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(260)

c:\windows\system32\c00D9D9E.mat

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\savedump.exe

.

**************************************************************************

.

Completion time: 2009-02-27 12:26:03 - machine was rebooted

ComboFix-quarantined-files.txt 2009-02-27 18:26:01

Pre-Run: 102,303,694,848 bytes free

Post-Run: 102,230,867,968 bytes free

195 --- E O F --- 2009-02-13 00:40:19

Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:37:08 PM, on 2/27/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\savedump.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Scan-RDH\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=4071215

O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k