Spyware Protect 2009 Residuals- Please Help!

Tien · March 2, 2009

Dear Sir,

After many hours, I finally was able to remove Spyware Protect 2009 from my computer, or so I thought. Ever since then, my computer has been running much slower, particularly on startup, so i checked my msconfig -> startup settings and noticed a new startup item named "2cfd402c1" with a command line of "rundll32.exe "C:\Documents and Settings\Administrator\Application Data\Macromedia\Common\2cfd402c1.dll". I have tried everything from removing the registry line via regedit (line keeps popping back up after restart), to deleting the file in the specified folder (comes back after restart), to disabling that command in msconfig (item comes back checked after each restart." Malwarebytes has found 8 infections related to this, but is unable to clean them...it says itll clean on reboot, but when i run malware again after the reboot, the same infections popped up. Super antispyware doesnt find anything. Here are the MBAM and Hijackthis logs:

Malwarebytes' Anti-Malware 1.34

Database version: 1814

Windows 5.1.2600 Service Pack 3

3/1/2009 5:47:49 PM

mbam-log-2009-03-01 (17-47-49).txt

Scan type: Full Scan (C:\|E:\|)

Objects scanned: 137009

Time elapsed: 24 minute(s), 26 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 8

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave1 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi1 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer1 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux1 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\midi2 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\wave2 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\aux2 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\mixer2 (Hijack.Sound) -> Bad: (C:\DOCUME~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll) Good: (wdmaud.drv) -> Quarantined and deleted successfully.

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\syssvc.exe (Trojan.Fraudtool) -> Quarantined and deleted successfully.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:02:53 PM, on 3/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\IFXTCS.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\IFXSPMGT.exe

C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\HPQ\IAM\bin\asghost.exe

C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe

C:\Program Files\ProtectTools\Embedded Security Software\SpTna.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\HPQ\HP ProtectTools Security Manager\PTServs.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\AccelerometerSt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)

O2 - BHO: (no name) - {40ADB85C-D0FD-40DB-9D3F-DE377A033375} - (no file)

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: HP Credential Manager for ProtectTools - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\HPQ\IAM\Bin\ItIeAddIN.dll

O2 - BHO: (no name) - {ED7D33A1-11AA-4203-8A5F-068B8288FA8E} - (no file)

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\Sminst\Recguard.exe

O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start

O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start

O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [AccelerometerSysTrayApplet] C:\WINDOWS\system32\AccelerometerSt.exe

O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\Administrator\Application Data\Macromedia\Common\2cfd402c1.dll""

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-19\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\LocalService\Application Data\Macromedia\Common\2cfd402c1.dll"" (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [rundll32.exe] rundll32.exe "C:\Documents and Settings\NetworkService\Application Data\Macromedia\Common\2cfd402c1.dll"" (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\2cfd402c1.dll"" (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [rundll32.exe] rundll32.exe "C:\WINDOWS\system32\config\systemprofile\Application Data\Macromedia\Common\2cfd402c1.dll"" (User 'Default user')

O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm

O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm

O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com

O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O20 - Winlogon Notify: geBQGWnL - geBQGWnL.dll (file missing)

O20 - Winlogon Notify: OneCard - C:\Program Files\HPQ\IAM\Bin\AsWlnPkg.dll

O20 - Winlogon Notify: qoMgfFUN - qoMgfFUN.dll (file missing)

O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - C:\WINDOWS\system32\IFXSPMGT.exe

O23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - C:\WINDOWS\system32\IFXTCS.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE

--

End of file - 7495 bytes

AdvancedSetup · March 2, 2009

Please visit this webpage for instructions for downloading ComboFix to your

DESKTOP

:

how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

NOTE!!:

You must save and run

ComboFix.exe

on your DESKTOP and not from any other folder.

Also,

DO NOT

click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:

ComboFix.exe

Note:

The

Windows Recovery Console

will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Click
Yes
to allow ComboFix to continue scanning for malware.
When the tool is finished, it will produce a report for you.
Please post the
C:\ComboFix.txt
along with a
new HijackThis log
so we may continue cleaning the system.

Tien · March 2, 2009

ComboFix 09-03-01.01 - Administrator 2009-03-01 19:20:01.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.459 [GMT -8:00]

Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe

FW: Norton Internet Worm Protection *disabled*

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\tmp.reg

E:\Autorun.inf

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Service_UACd.sys

((((((((((((((((((((((((( Files Created from 2009-02-02 to 2009-03-02 )))))))))))))))))))))))))))))))

.

2009-03-01 19:02 . 2009-03-01 19:02 <DIR> d-------- c:\program files\Trend Micro

2009-03-01 17:52 . 2009-03-01 17:52 <DIR> d-------- c:\program files\SUPERAntiSpyware

2009-03-01 12:27 . 2009-03-01 13:06 <DIR> d-------- c:\program files\EsetOnlineScanner

2009-03-01 11:50 . 2009-03-01 11:50 578,560 --a------ c:\windows\system32\dllcache\user32.dll

2009-03-01 11:49 . 2009-03-01 11:49 <DIR> d-------- c:\windows\ERUNT

2009-03-01 03:50 . 2009-03-01 03:50 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com

2009-03-01 03:50 . 2009-03-01 17:52 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com

2009-03-01 03:47 . 2009-03-01 03:47 <DIR> d-------- c:\documents and settings\Administrator\Application Data\GlarySoft

2009-02-03 16:19 . 2009-02-03 16:19 <DIR> d-------- c:\documents and settings\All Users\Application Data\AOL OCP

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-02 01:51 --------- d-----w c:\program files\Common Files\Wise Installation Wizard

2009-02-27 15:59 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-02-27 15:17 --------- d-----w c:\program files\Spybot - Search & Destroy

2009-02-21 01:43 --------- d-----w c:\program files\World of Warcraft

2009-02-11 18:19 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-02-11 18:19 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-02-11 06:29 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help

2009-02-10 02:29 --------- d-----w c:\documents and settings\Administrator\Application Data\AICPA

2009-01-30 21:44 --------- d-----w c:\program files\AICPASampleTest

2009-01-23 16:47 --------- dc-h--w c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}

2009-01-23 16:47 --------- d-----w c:\program files\Lavasoft

2009-01-20 05:39 --------- d-----w c:\documents and settings\Administrator\Application Data\dyyno-vlc

2009-01-18 21:30 64,160 -c--a-w c:\windows\system32\drivers\Lbd.sys

2009-01-18 11:10 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

2009-01-17 08:42 --------- d-----w c:\program files\BitComet

2009-01-14 10:15 --------- d-----w c:\documents and settings\All Users\Application Data\hpqLog

2009-01-14 05:10 --------- d-----w c:\windows\system32\config\systemprofile\Application Data\Symantec

2009-01-14 05:10 --------- d-----w c:\program files\AIM6

2009-01-14 05:10 --------- d-----w c:\documents and settings\Administrator\Application Data\IObit

2009-01-13 02:50 --------- d--h--w c:\program files\InstallShield Installation Information

2005-04-26 13:59 442,368 -c--a-w c:\documents and settings\ATIMCatW\ATIMCatW.exe

2004-01-26 03:29 127,488 -c--a-w c:\documents and settings\ATIMCatW\makensisw.exe

2008-09-13 00:18 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008091220080913\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]

"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

"rundll32.exe"="c:\documents and settings\Administrator\Application Data\Macromedia\Common\2cfd402c1.dll" [2009-02-27 64512]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-17 1830128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-03 761948]

"Recguard"="c:\windows\Sminst\Recguard.exe" [2005-12-20 1187840]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-03-07 131072]

"PTHOSTTR"="c:\program files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2006-02-14 122880]

"hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-02-14 454656]

"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]

"AccelerometerSysTrayApplet"="c:\windows\system32\AccelerometerSt.exe" [2006-01-16 53248]

"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2006-02-22 40960]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"rundll32.exe"="c:\documents and settings\NetworkService\Application Data\Macromedia\Common\2cfd402c1.dll" [2009-02-27 64512]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]

2005-07-25 10:41 40960 c:\program files\HPQ\IAM\Bin\AsWlnPkg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]

2005-08-19 05:52 389120 c:\windows\system32\IfxWlxEN.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"wave1"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"midi1"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"mixer1"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"aux1"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"midi2"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"wave2"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"aux2"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

"mixer2"= c:\docume~1\ADMINI~1\APPLIC~1\MACROM~1\Common\2cfd402c1.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli AsWlnPkg

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]

backup=c:\windows\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^DVD Check.lnk]

backup=c:\windows\pss\DVD Check.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]

backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG8_TRAY

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IPHSend

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ViewMgr

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]

--a------ 2009-01-30 23:10 509784 c:\program files\Lavasoft\Ad-Aware\AAWTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CognizanceTS]

--a--c--- 2003-12-22 10:12 17920 c:\progra~1\HPQ\IAM\Bin\AsTsVcc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]

--a------ 2008-04-13 16:12 15360 c:\windows\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]

--a--c--- 2006-03-09 16:38 806912 c:\windows\CREATOR\Remind_XP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rundll32.exe]

--a------ 2009-02-27 07:09 64512 c:\documents and settings\Administrator\Application Data\Macromedia\Common\2cfd402c1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

-----c--- 2006-10-18 20:05 204288 c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]

--a--c--- 2005-07-22 22:25 28160 c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"PCA"=2 (0x2)

"TuneUp.Defrag"=3 (0x3)

"WMPNetworkSvc"=2 (0x2)

"Microsoft Office Groove Audit Service"=3 (0x3)

"ose"=3 (0x3)

"odserv"=3 (0x3)

"LightScribeService"=2 (0x2)

"btwdins"=2 (0x2)

"Ati HotKey Poller"=2 (0x2)

"Apple Mobile Device"=2 (0x2)

"iPod Service"=3 (0x3)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]

"WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

"AppleSyncNotifier"=c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe

"ATICCC"="c:\program files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

"DLA"=c:\windows\System32\DLA\DLACTRLW.EXE

"WatchDog"=c:\program files\InterVideo\DVD Check\DVDCheck.exe

"MsmqIntCert"=regsvr32 /s mqrt.dll

"MSConfig"=c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto

"Scheduler"=c:\windows\SMINST\Scheduler.exe

"SoundMAX"=c:\program files\Analog Devices\SoundMAX\Smax4.exe /tray

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe"

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe"

"SoundMAXPnP"=c:\program files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"9939:TCP"= 9939:TCP:BitComet 9939 TCP

"9939:UDP"= 9939:UDP:BitComet 9939 UDP

"5000:TCP"= 5000:TCP:BitComet 5000 TCP

"5000:UDP"= 5000:UDP:BitComet 5000 UDP

"60000:TCP"= 60000:TCP:BitComet 60000 TCP

"60000:UDP"= 60000:UDP:BitComet 60000 UDP

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-23 64160]

R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2005-10-25 35488]

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-02-17 8944]

R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-02-17 55024]

R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [2004-08-04 14336]

R3 GTIPCI21;GTIPCI21;c:\windows\system32\drivers\gtipci21.sys [2006-05-23 87936]

R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2005-06-10 35968]

R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-02-17 7408]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - SASDIFSV

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

Cognizance REG_MULTI_SZ ASChannel

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

.

Contents of the 'Scheduled Tasks' folder

2009-02-28 c:\windows\Tasks\Ad-Aware Update (Weekly).job

- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-30 23:10]

2009-02-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-03-02 c:\windows\Tasks\zzqeqbbc.job

- c:\windows\system32\ssQggfDw.dll []

.

- - - - ORPHANS REMOVED - - - -

BHO-{40ADB85C-D0FD-40DB-9D3F-DE377A033375} - (no file)

BHO-{ED7D33A1-11AA-4203-8A5F-068B8288FA8E} - (no file)

Notify-geBQGWnL - geBQGWnL.dll

Notify-qoMgfFUN - qoMgfFUN.dll

SafeBoot-Lavasoft Ad-Aware Service

.

------- Supplementary Scan -------

.

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/

uInternet Settings,ProxyOverride = *.local

IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm

IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm

IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2us1ruko.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/

FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\2us1ruko.default\extensions\NPDyyno@dyyno.com\plugins\npDyyno.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll

FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll

---- FIREFOX POLICIES ----

FF - user.js: network.http.max-persistent-connections-per-server - 4

FF - user.js: content.max.tokenizing.time - 1800000

FF - user.js: content.notify.interval - 600000

FF - user.js: content.switch.threshold - 600000

FF - user.js: nglayout.initialpaint.delay - 600

FF - user.js: network.http.max-connections-per-server - 8

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-01 19:23:18

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe?????? ???@???????????????@? ????L??????(?@???????@

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(932)

c:\program files\HPQ\IAM\bin\OCGINA.DLL

c:\program files\HPQ\IAM\bin\ItMsg.dll

c:\program files\HPQ\IAM\bin\HPBrand.dll

c:\program files\HPQ\IAM\bin\ItTal.dll

c:\program files\HPQ\IAM\bin\ItReports.DLL

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\Ati2evxx.dll

c:\program files\HPQ\IAM\Bin\AsWlnPkg.dll

c:\program files\HPQ\IAM\Bin\TokenAuth.dll

c:\program files\HPQ\IAM\Bin\ittalsnap.DLL

c:\program files\HPQ\IAM\Bin\AuthWiz.dll

c:\program files\HPQ\IAM\Bin\BioAuth.dll

c:\program files\HPQ\IAM\Bin\ItVCard.dll

c:\program files\HPQ\IAM\Bin\ASChnl.dll

c:\program files\HPQ\IAM\Bin\ItDAC.dll

c:\program files\HPQ\IAM\Bin\ItAuth.dll

c:\windows\system32\xenroll.dll

c:\program files\Bonjour\mdnsNSP.dll

c:\windows\system32\IFXTSP.dll

c:\windows\system32\MSVCR71.dll

c:\windows\system32\IfxSpArc.dll

c:\windows\system32\IFXTCSps.dll

c:\program files\HPQ\IAM\Bin\ITVCClient.dll

c:\program files\HPQ\IAM\Bin\STEngine.dll

c:\program files\HPQ\IAM\Bin\TpmAuth.dll

c:\windows\system32\IfxWlxEN.dll

c:\windows\system32\IfxSpMps.dll

- - - - - - - > 'lsass.exe'(988)

c:\program files\HPQ\IAM\bin\AsWlnPkg.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\system32\IFXTCS.exe

c:\program files\Lavasoft\Ad-Aware\AAWService.exe

c:\windows\system32\scardsvr.exe

c:\windows\system32\msdtc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\IFXSPMGT.exe

c:\program files\ProtectTools\Embedded Security Software\PSDsrvc.EXE

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\windows\system32\wbem\unsecapp.exe

c:\program files\HPQ\IAM\Bin\asghost.exe

c:\program files\ProtectTools\Embedded Security Software\PSDrt.exe

c:\program files\ProtectTools\Embedded Security Software\SpTNA.exe

c:\program files\HPQ\HP ProtectTools Security Manager\PTServs.exe

c:\progra~1\HPQ\Shared\HPQTOA~1.EXE

.

**************************************************************************

.

Completion time: 2009-03-01 19:26:23 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-02 03:26:21

Pre-Run: 3,846,176,768 bytes free

Post-Run: 3,737,051,136 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

293 --- E O F --- 2009-02-24 23:24:11

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:27:26 PM, on 3/1/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\IFXTCS.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\IFXSPMGT.exe

C:\Program Files\ProtectTools\Embedded Security Software\PSDsrvc.EXE

C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe

C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

C:\Program Files\HPQ\IAM\bin\asghost.exe

C:\Program Files\ProtectTools\Embedded Security Software\PSDrt.exe

C:\Program Files\ProtectTools\Embedded Security Software\SpTna.exe

C:\Program Files\HPQ\HP ProtectTools Security Manager\PTServs.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\HPQ\HP ProtectTools Security Manager\PTHOSTTR.EXE

C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\AccelerometerSt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Windows Media Player\WMPNSCFG.exe

C:\PROGRA~1\HPQ\Shared\HPQTOA~1.EXE

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\Explorer.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896