FORMULA_SIN Posted March 5, 2009 ID:61572 Share Posted March 5, 2009 basically i have the same problem as use Hilary had.here is my COMBFIX LOG...please help...thanks in advance=======================================ComboFix 09-03-04.01 - Michael 2009-03-04 23:01:39.1 - FAT32x86Microsoft Windows XP Professional 5.1.2600.3.950.1.1033.18.1535.896 [GMT -8:00]執行位置: c:\documents and settings\Michael\Desktop\ComboFix.exeAV: NOD32防毒系統 2.51 *On-access scanning enabled* (Updated)FW: Norton Internet Worm Protection *disabled* * 成功創造新還原點 * Resident AV is active注意 - 這台電腦沒有安裝恢復控制台 .((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))).c:\docume~1\Michael\LOCALS~1\Temp\tmp2.tmpc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat----- BITS: Possible infected sites -----hxxp://vestepau.cn.((((((((((((((((((((((((( 2009-02-05 至 2009-03-05 的新的檔案 ))))))))))))))))))))))))))))))).2009-03-04 22:42 . 2009-03-04 22:42 <DIR> d-------- c:\program files\a-squared Free2009-03-02 18:53 . 2008-04-13 17:12 26,112 --a------ c:\windows\system32\stu2.exe2009-02-28 22:41 . 2009-02-28 22:41 <DIR> d-------- c:\program files\FormatFactory2009-02-28 22:41 . 2009-02-28 22:41 <DIR> d-------- c:\documents and settings\Michael\Application Data\Desktopicon2009-02-27 23:54 . 2009-02-27 23:54 <DIR> d-------- C:\Downloads2009-02-20 17:33 . 2009-02-20 17:33 <DIR> d-------- c:\program files\7-Zip2009-02-16 18:06 . 2008-04-13 11:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys2009-02-16 18:06 . 2008-04-13 11:45 26,112 --a------ c:\windows\system32\dllcache\usbser.sys2009-02-16 18:06 . 2009-02-16 18:06 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf2009-02-16 18:06 . 2009-02-16 18:06 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf2009-02-16 18:02 . 2009-02-16 18:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Suite2009-02-15 22:43 . 2009-02-15 22:43 664 --a------ c:\windows\system32\d3d9caps.dat2009-02-15 22:40 . 2009-02-15 22:40 <DIR> d-------- c:\program files\Windows Media Connect 22009-02-15 22:27 . 2009-02-15 22:27 <DIR> d-------- c:\program files\MSXML 6.02009-02-15 22:27 . 2009-02-15 22:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Installations2009-02-15 22:25 . 2009-02-15 22:25 <DIR> d-------- c:\program files\Common Files\muvee Technologies2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\windows\Globalization2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\program files\Common Files\Nokia2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\documents and settings\Michael\Application Data\Nokia2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\Nokia2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\DIFX2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\Common Files\PCSuite2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\documents and settings\Michael\Application Data\PC Suite2009-02-15 22:23 . 2007-11-29 10:33 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll2009-02-15 22:23 . 2007-11-29 10:39 95,744 --a------ c:\windows\system32\nmwcdcocls.dll2009-02-15 22:23 . 2007-11-29 10:32 48,128 --a------ c:\windows\system32\nmwcdcls.dll2009-02-15 22:23 . 2007-09-17 14:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys2009-02-15 22:23 . 2007-11-29 10:39 19,328 --a------ c:\windows\system32\drivers\ccdcmbo.sys2009-02-15 22:23 . 2007-11-29 10:39 16,896 --a------ c:\windows\system32\drivers\ccdcmb.sys2009-02-15 22:23 . 2007-11-29 10:39 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys2009-02-15 22:23 . 2007-11-29 10:39 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys2009-02-15 22:22 . 2009-02-15 22:22 <DIR> d-------- c:\windows\system32\drivers\UMDF2009-02-15 22:15 . 2009-02-15 22:15 <DIR> d-------- c:\program files\MSBuild2009-02-15 22:14 . 2009-02-15 22:14 <DIR> d-------- c:\windows\system32\XPSViewer2009-02-15 22:13 . 2009-02-15 22:13 <DIR> d-------- c:\program files\Reference Assemblies2009-02-15 22:13 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll2009-02-07 22:06 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys2009-02-07 22:06 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys2009-02-07 22:06 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys2009-02-07 22:06 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\dllcache\kbdhid.sys2009-02-07 22:06 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys2009-02-07 22:06 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\dllcache\hidusb.sys.(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-03-03 02:53 17,920 ----a-w c:\windows\system32\userinit.exe2009-01-21 03:27 502,368 ----a-w c:\windows\system32\drivers\amon.sys2009-01-21 03:27 270,336 ----a-w c:\windows\system32\imon.dll2009-01-21 03:27 --------- d-----w c:\program files\Eset2009-01-21 03:18 --------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-01-21 03:18 --------- d-----w c:\documents and settings\Michael\Application Data\Malwarebytes2009-01-21 03:18 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes2009-01-21 02:38 --------- d-----w c:\program files\ATS22009-01-21 02:13 --------- d-----w c:\program files\BeatTrojan20082009-01-21 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files2009-01-17 05:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll2009-01-15 00:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-01-15 00:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys2008-12-19 09:10 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe2008-12-19 05:25 634,024 ----a-w c:\windows\system32\dllcache\iexplore.exe2008-12-19 05:23 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys2008-12-07 23:22 410,984 ----a-w c:\windows\system32\deploytk.dll2008-09-17 04:49 358 ----a-w c:\program files\Shortcut to Skype.lnk2008-02-28 04:13 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat2008-07-30 05:42 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008072920080730\index.dat.------- Sigcheck -------2009-03-02 18:53 17920 3d2deea032afd945261542b345733a5f c:\windows\system32\userinit.exe2004-08-04 20:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe2008-04-13 17:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe.((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))..*注意* 空白與合法缺省登錄將不會被顯示 REGEDIT4[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]@="{666C7836-A9B6-4AB4-94ED-DC238C81E925}"[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]2006-04-02 17:08 381952 -ra------ c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-01-19 4670968]"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-20 342848][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]"HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-23 106496]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-02-08 7405568]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-02-08 86016]"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]"CognizanceTS"="c:\progra~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 17920]"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2006-05-30 811008]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-03 61440]"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-14 90112]"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-02 802816]"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 696320]"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]"RemoteControl"="c:\program files\ASUSTek\ASUSDVD\PDVDServ.exe" [2005-01-12 32768]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-10-11 180269]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-07 136600]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\qttask.exe" [2008-05-27 413696]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064]"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-07-22 909392]"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-07-17 177448]"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-01-20 921600]"nwiz"="nwiz.exe" [2006-02-08 c:\windows\system32\nwiz.exe]"RTHDCPL"="RTHDCPL.EXE" [2006-08-13 c:\windows\RTHDCPL.exe]"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]"SMSERIAL"="sm56hlpr.exe" [2006-01-19 c:\windows\sm56hlpr.exe]c:\documents and settings\All Users\Start Menu\Programs\Startup\MultiFrame.lnk - c:\program files\ASUS\Asus MultiFrame\MultiFrame.exe [2007-02-03 491520]Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 553021]Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]Nokia Nseries PC Suite.lnk - c:\program files\Nokia\NNPCS\RunLauncher.exe [2008-05-08 943568][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]2006-05-02 22:23 40448 c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]2006-03-10 08:20 434176 c:\windows\system32\IfxWlxEN.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=APSHook.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"VIDC.ACDV"= ACDV.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Notification Packages REG_MULTI_SZ scecli ASWLNPkg[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]--------- 2008-04-13 17:12 1695232 c:\program files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]--a------ 2008-12-26 20:48 1410296 c:\program files\Steam\Steam.exe[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001"UpdatesDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="c:\\Program Files\\FreeStyle\\FSLauncher.exe"="c:\\Program Files\\Steam\\SteamApps\\formula_zero\\counter-strike source\\hl2.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"="c:\\Program Files\\DNA\\btdna.exe"="c:\\Program Files\\BitTorrent\\bittorrent.exe"="c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"="c:\\Program Files\\FlashGet\\flashget.exe"=R1 ItSDisk;ItSDisk;c:\windows\system32\drivers\itsdisk.sys [2006-05-16 17840]R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2005-11-29 36768]R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [2004-08-20 14336]R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2008-07-17 161064]R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-08-27 24652]R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-02-03 36352]S2 BeatTrojanHelperOne;BeatTrojanHelperOne;\??\c:\program files\BeatTrojan2008\BeatTrojanHelperOne.sys --> c:\program files\BeatTrojan2008\BeatTrojanHelperOne.sys [?]S2 木馬清除大師即時監控;木馬清除大師即時監控; [x]S3 ipswuio;ipswuio;c:\windows\system32\drivers\ipswuio.sys [2007-02-03 34944][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]Cognizance REG_MULTI_SZ ASChannel.- - - - ORPHANS REMOVED - - - -HKLM-Run-Zshutdown - c:\sysprep\patch\sysprep.cmd.------- 而外的掃描 -------.uStart Page = hxxp://www.google.com/ig?hl=enuInternet Settings,ProxyOverride = *.localIE: &使用 FlashGet 下載 - c:\program files\FlashGet\jc_link.htmIE: &全部使用 FlashGet 下載 - c:\program files\FlashGet\jc_all.htmIE: 下載編碼內容(S&martGet) - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_text.htmlIE: 使用S&martGet下載 - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_link.htmIE: 全部使用Smart&Get下載 - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_all.htmLSP: c:\windows\system32\imon.dll.**************************************************************************catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-03-04 23:08:17Windows 5.1.2600 Service Pack 3 FAT NTAPI掃描被隱藏的進程 。。。 掃描被隱藏的啟動組 。。。 掃描被隱藏的文件 。。。 掃描完成被隱藏的檔案: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\(g?nd?Y+^sSBf綮呃].--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-1555759637-3371167190-2748196404-1004\Software\ACD Systems\EditLib\Presets\p_/*?IQ]"上次使用"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"僅限調亮"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"僅限調暗"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"預設值"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e,3c, 63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,3c,\"調亮/調暗"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\.--------------------- 運行進程下的動態鏈接庫 ---------------------- - - - - - - > 'winlogon.exe'(996)c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dllc:\windows\system32\IfxWlxEN.dllc:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsChnl.dllc:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItMsg.dll- - - - - - - > 'lsass.exe'(1052)c:\program files\ASUS Security Center\ASUS Security Protect Manager\bin\ASWLNPkg.dllc:\windows\system32\imon.dllc:\program files\Eset\pr_imon.dll.------------------------ 其他運行進程 ------------------------.c:\program files\INTEL\WIRELESS\BIN\EVTENG.EXEc:\windows\SYSTEM32\DLLHOST.EXEc:\program files\INTEL\WIRELESS\BIN\S24EVMON.EXEc:\program files\a-squared Free\a2service.exec:\program files\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXEc:\program files\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXEc:\program files\BONJOUR\MDNSRESPONDER.EXEc:\program files\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXEc:\windows\SYSTEM32\IFXSPMGT.EXEc:\windows\SYSTEM32\IFXTCS.EXEc:\program files\JAVA\JRE6\BIN\JQS.EXEc:\program files\ESET\NOD32KRN.EXEc:\windows\SYSTEM32\NVSVC32.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\PSDSRVC.EXEc:\program files\INTEL\WIRELESS\BIN\REGSRVC.EXEc:\program files\ALCOHOL SOFT\ALCOHOL 120\STARWIND\STARWINDSERVICEAE.EXEc:\program files\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXEc:\windows\SYSTEM32\SCARDSVR.EXEc:\program files\ASUS SECURITY CENTER\ASUS SECURITY PROTECT MANAGER\BIN\ASGHOST.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\PSDRT.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\SPTNA.EXEc:\windows\system32\conime.exec:\windows\SYSTEM32\RUNDLL32.EXEc:\windows\SYSTEM32\RUNDLL32.EXEc:\windows\ATK0100\ATKOSD.exec:\windows\system32\ACEngSvr.exec:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exec:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEc:\program files\iPod\bin\iPodService.exec:\program files\Intel\Wireless\Bin\Dot1XCfg.exec:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exec:\windows\system32\wscntfy.exec:\program files\Symantec\LiveUpdate\AUpdate.exec:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE.**************************************************************************.完成時間: 2009-03-04 23:09:43 - 電腦已重新啟動ComboFix-quarantined-files.txt 2009-03-05 07:09:42Pre-Run: 11,974,082,560 bytes freePost-Run: 14,773,452,800 bytes free285 --- E O F --- 2009-02-26 06:08:57 Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 5, 2009 Author ID:61573 Share Posted March 5, 2009 by the way, i did not install Recovery Console when i ran combofix....please advise....this is driving me insane...basically i have the same problem as use Hilary had.here is my COMBFIX LOG...please help...thanks in advance=======================================ComboFix 09-03-04.01 - Michael 2009-03-04 23:01:39.1 - FAT32x86Microsoft Windows XP Professional 5.1.2600.3.950.1.1033.18.1535.896 [GMT -8:00]執行位置: c:\documents and settings\Michael\Desktop\ComboFix.exeAV: NOD32防毒系統 2.51 *On-access scanning enabled* (Updated)FW: Norton Internet Worm Protection *disabled* * 成功創造新還原點 * Resident AV is active注意 - 這台電腦沒有安裝恢復控制台 .((((((((((((((((((((((((((((((((((((((( 被刪除的檔案 ))))))))))))))))))))))))))))))))))))))))))))))))).c:\docume~1\Michael\LOCALS~1\Temp\tmp2.tmpc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.datc:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat----- BITS: Possible infected sites -----hxxp://vestepau.cn.((((((((((((((((((((((((( 2009-02-05 至 2009-03-05 的新的檔案 ))))))))))))))))))))))))))))))).2009-03-04 22:42 . 2009-03-04 22:42 <DIR> d-------- c:\program files\a-squared Free2009-03-02 18:53 . 2008-04-13 17:12 26,112 --a------ c:\windows\system32\stu2.exe2009-02-28 22:41 . 2009-02-28 22:41 <DIR> d-------- c:\program files\FormatFactory2009-02-28 22:41 . 2009-02-28 22:41 <DIR> d-------- c:\documents and settings\Michael\Application Data\Desktopicon2009-02-27 23:54 . 2009-02-27 23:54 <DIR> d-------- C:\Downloads2009-02-20 17:33 . 2009-02-20 17:33 <DIR> d-------- c:\program files\7-Zip2009-02-16 18:06 . 2008-04-13 11:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys2009-02-16 18:06 . 2008-04-13 11:45 26,112 --a------ c:\windows\system32\dllcache\usbser.sys2009-02-16 18:06 . 2009-02-16 18:06 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf2009-02-16 18:06 . 2009-02-16 18:06 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf2009-02-16 18:02 . 2009-02-16 18:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Suite2009-02-15 22:43 . 2009-02-15 22:43 664 --a------ c:\windows\system32\d3d9caps.dat2009-02-15 22:40 . 2009-02-15 22:40 <DIR> d-------- c:\program files\Windows Media Connect 22009-02-15 22:27 . 2009-02-15 22:27 <DIR> d-------- c:\program files\MSXML 6.02009-02-15 22:27 . 2009-02-15 22:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Installations2009-02-15 22:25 . 2009-02-15 22:25 <DIR> d-------- c:\program files\Common Files\muvee Technologies2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\windows\Globalization2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\program files\Common Files\Nokia2009-02-15 22:24 . 2009-02-15 22:24 <DIR> d-------- c:\documents and settings\Michael\Application Data\Nokia2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\Nokia2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\DIFX2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\program files\Common Files\PCSuite2009-02-15 22:23 . 2009-02-15 22:23 <DIR> d-------- c:\documents and settings\Michael\Application Data\PC Suite2009-02-15 22:23 . 2007-11-29 10:33 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll2009-02-15 22:23 . 2007-11-29 10:39 95,744 --a------ c:\windows\system32\nmwcdcocls.dll2009-02-15 22:23 . 2007-11-29 10:32 48,128 --a------ c:\windows\system32\nmwcdcls.dll2009-02-15 22:23 . 2007-09-17 14:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys2009-02-15 22:23 . 2007-11-29 10:39 19,328 --a------ c:\windows\system32\drivers\ccdcmbo.sys2009-02-15 22:23 . 2007-11-29 10:39 16,896 --a------ c:\windows\system32\drivers\ccdcmb.sys2009-02-15 22:23 . 2007-11-29 10:39 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys2009-02-15 22:23 . 2007-11-29 10:39 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys2009-02-15 22:22 . 2009-02-15 22:22 <DIR> d-------- c:\windows\system32\drivers\UMDF2009-02-15 22:15 . 2009-02-15 22:15 <DIR> d-------- c:\program files\MSBuild2009-02-15 22:14 . 2009-02-15 22:14 <DIR> d-------- c:\windows\system32\XPSViewer2009-02-15 22:13 . 2009-02-15 22:13 <DIR> d-------- c:\program files\Reference Assemblies2009-02-15 22:13 . 2006-06-29 13:07 14,048 --------- c:\windows\system32\spmsg2.dll2009-02-07 22:06 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys2009-02-07 22:06 . 2008-04-13 11:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys2009-02-07 22:06 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\drivers\kbdhid.sys2009-02-07 22:06 . 2008-04-13 11:39 14,592 --a------ c:\windows\system32\dllcache\kbdhid.sys2009-02-07 22:06 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\drivers\hidusb.sys2009-02-07 22:06 . 2008-04-13 11:45 10,368 --a------ c:\windows\system32\dllcache\hidusb.sys.(((((((((((((((((((((((((((((((((((((((( 在三個月內被修改的檔案 )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-03-03 02:53 17,920 ----a-w c:\windows\system32\userinit.exe2009-01-21 03:27 502,368 ----a-w c:\windows\system32\drivers\amon.sys2009-01-21 03:27 270,336 ----a-w c:\windows\system32\imon.dll2009-01-21 03:27 --------- d-----w c:\program files\Eset2009-01-21 03:18 --------- d-----w c:\program files\Malwarebytes' Anti-Malware2009-01-21 03:18 --------- d-----w c:\documents and settings\Michael\Application Data\Malwarebytes2009-01-21 03:18 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes2009-01-21 02:38 --------- d-----w c:\program files\ATS22009-01-21 02:13 --------- d-----w c:\program files\BeatTrojan20082009-01-21 01:56 --------- d-----w c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files2009-01-17 05:35 3,594,752 ----a-w c:\windows\system32\dllcache\mshtml.dll2009-01-15 00:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys2009-01-15 00:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys2008-12-19 09:10 70,656 ----a-w c:\windows\system32\dllcache\ie4uinit.exe2008-12-19 09:10 13,824 ------w c:\windows\system32\dllcache\ieudinit.exe2008-12-19 05:25 634,024 ----a-w c:\windows\system32\dllcache\iexplore.exe2008-12-19 05:23 161,792 ----a-w c:\windows\system32\dllcache\ieakui.dll2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys2008-12-07 23:22 410,984 ----a-w c:\windows\system32\deploytk.dll2008-09-17 04:49 358 ----a-w c:\program files\Shortcut to Skype.lnk2008-02-28 04:13 32 ----a-w c:\documents and settings\All Users\Application Data\ezsid.dat2008-07-30 05:42 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008072920080730\index.dat.------- Sigcheck -------2009-03-02 18:53 17920 3d2deea032afd945261542b345733a5f c:\windows\system32\userinit.exe2004-08-04 20:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe2008-04-13 17:12 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\ServicePackFiles\i386\userinit.exe.((((((((((((((((((((((((((((((((((((( 重要登入點 ))))))))))))))))))))))))))))))))))))))))))))))))))..*注意* 空白與合法缺省登錄將不會被顯示 REGEDIT4[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Secure Disks]@="{666C7836-A9B6-4AB4-94ED-DC238C81E925}"[HKEY_CLASSES_ROOT\CLSID\{666C7836-A9B6-4AB4-94ED-DC238C81E925}]2006-04-02 17:08 381952 -ra------ c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\SFSShell.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-01-19 4670968]"EA Core"="c:\program files\Electronic Arts\EADM\Core.exe" [2008-07-21 2752512]"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2009-01-20 342848][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]"HControl"="c:\windows\ATK0100\HControl.exe" [2006-02-23 106496]"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-02-08 7405568]"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-02-08 86016]"ASUS Live Update"="c:\program files\ASUS\ASUS Live Update\ALU.exe" [2006-02-21 180224]"CognizanceTS"="c:\progra~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll" [2003-12-22 17920]"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2005-10-17 987136]"ACMON"="c:\program files\ASUS\Splendid\ACMON.exe" [2006-05-30 811008]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521]"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-03 61440]"Power_Gear"="c:\program files\ASUS\Power4 Gear\BatteryLife.exe" [2006-03-14 90112]"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-02 802816]"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-02 696320]"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]"IMEKRMIG6.1"="c:\windows\ime\imkr6_1\IMEKRMIG.EXE" [2004-08-04 44032]"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]"RemoteControl"="c:\program files\ASUSTek\ASUSDVD\PDVDServ.exe" [2005-01-12 32768]"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-10-11 180269]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-07 136600]"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]"QuickTime Task"="c:\program files\K-Lite Codec Pack\QuickTime\qttask.exe" [2008-05-27 413696]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-10 289064]"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [2008-07-22 909392]"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2008-07-17 177448]"nod32kui"="c:\program files\Eset\nod32kui.exe" [2009-01-20 921600]"nwiz"="nwiz.exe" [2006-02-08 c:\windows\system32\nwiz.exe]"RTHDCPL"="RTHDCPL.EXE" [2006-08-13 c:\windows\RTHDCPL.exe]"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]"SMSERIAL"="sm56hlpr.exe" [2006-01-19 c:\windows\sm56hlpr.exe]c:\documents and settings\All Users\Start Menu\Programs\Startup\MultiFrame.lnk - c:\program files\ASUS\Asus MultiFrame\MultiFrame.exe [2007-02-03 491520]Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-06-07 553021]Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]Nokia Nseries PC Suite.lnk - c:\program files\Nokia\NNPCS\RunLauncher.exe [2008-05-08 943568][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard]2006-05-02 22:23 40448 c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IfxWlxEN]2006-03-10 08:20 434176 c:\windows\system32\IfxWlxEN.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]"AppInit_DLLs"=APSHook.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"VIDC.ACDV"= ACDV.dll[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]Notification Packages REG_MULTI_SZ scecli ASWLNPkg[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]--------- 2008-04-13 17:12 1695232 c:\program files\Messenger\msmsgs.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]--a------ 2008-12-26 20:48 1410296 c:\program files\Steam\Steam.exe[HKEY_LOCAL_MACHINE\software\microsoft\security center]"AntiVirusDisableNotify"=dword:00000001"UpdatesDisableNotify"=dword:00000001[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]"DisableMonitoring"=dword:00000001[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="c:\\Program Files\\FreeStyle\\FSLauncher.exe"="c:\\Program Files\\Steam\\SteamApps\\formula_zero\\counter-strike source\\hl2.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="c:\\Program Files\\Skype\\Phone\\Skype.exe"="c:\\Program Files\\DNA\\btdna.exe"="c:\\Program Files\\BitTorrent\\bittorrent.exe"="c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"="c:\\Program Files\\FlashGet\\flashget.exe"=R1 ItSDisk;ItSDisk;c:\windows\system32\drivers\itsdisk.sys [2006-05-16 17840]R1 PersonalSecureDrive;PersonalSecureDrive;c:\windows\system32\drivers\psd.sys [2005-11-29 36768]R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [2004-08-20 14336]R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [2008-07-17 161064]R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-08-27 24652]R3 IFXTPM;IFXTPM;c:\windows\system32\drivers\ifxtpm.sys [2007-02-03 36352]S2 BeatTrojanHelperOne;BeatTrojanHelperOne;\??\c:\program files\BeatTrojan2008\BeatTrojanHelperOne.sys --> c:\program files\BeatTrojan2008\BeatTrojanHelperOne.sys [?]S2 木馬清除大師即時監控;木馬清除大師即時監控; [x]S3 ipswuio;ipswuio;c:\windows\system32\drivers\ipswuio.sys [2007-02-03 34944][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]Cognizance REG_MULTI_SZ ASChannel.- - - - ORPHANS REMOVED - - - -HKLM-Run-Zshutdown - c:\sysprep\patch\sysprep.cmd.------- 而外的掃描 -------.uStart Page = hxxp://www.google.com/ig?hl=enuInternet Settings,ProxyOverride = *.localIE: &使用 FlashGet 下載 - c:\program files\FlashGet\jc_link.htmIE: &全部使用 FlashGet 下載 - c:\program files\FlashGet\jc_all.htmIE: 下載編碼內容(S&martGet) - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_text.htmlIE: 使用S&martGet下載 - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_link.htmIE: 全部使用Smart&Get下載 - c:\documents and settings\Michael\Desktop\SmartGet1.45.2\SmartGet1.45.2\dl_all.htmLSP: c:\windows\system32\imon.dll.**************************************************************************catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-03-04 23:08:17Windows 5.1.2600 Service Pack 3 FAT NTAPI掃描被隱藏的進程 。。。 掃描被隱藏的啟動組 。。。 掃描被隱藏的文件 。。。 掃描完成被隱藏的檔案: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\(g?nd?Y+^sSBf綮呃].--------------------- LOCKED REGISTRY KEYS ---------------------[HKEY_USERS\S-1-5-21-1555759637-3371167190-2748196404-1004\Software\ACD Systems\EditLib\Presets\p_/*?IQ]"上次使用"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"僅限調亮"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"僅限調暗"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\"預設值"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e,3c, 63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,3c,\"調亮/調暗"=hex:3c,3f,78,6d,6c,20,76,65,72,73,69,6f,6e,3d,22,31,2e,30,22,3f,3e, 3c,63,6f,6d,6d,61,6e,64,3e,3c,6e,61,6d,65,3e,4c,43,45,3c,2f,6e,61,6d,65,3e,\.--------------------- 運行進程下的動態鏈接庫 ---------------------- - - - - - - > 'winlogon.exe'(996)c:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dllc:\windows\system32\IfxWlxEN.dllc:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsChnl.dllc:\program files\ASUS Security Center\ASUS Security Protect Manager\Bin\ItMsg.dll- - - - - - - > 'lsass.exe'(1052)c:\program files\ASUS Security Center\ASUS Security Protect Manager\bin\ASWLNPkg.dllc:\windows\system32\imon.dllc:\program files\Eset\pr_imon.dll.------------------------ 其他運行進程 ------------------------.c:\program files\INTEL\WIRELESS\BIN\EVTENG.EXEc:\windows\SYSTEM32\DLLHOST.EXEc:\program files\INTEL\WIRELESS\BIN\S24EVMON.EXEc:\program files\a-squared Free\a2service.exec:\program files\COMMON FILES\APPLE\MOBILE DEVICE SUPPORT\BIN\APPLEMOBILEDEVICESERVICE.EXEc:\program files\SYMANTEC\LIVEUPDATE\ALUSCHEDULERSVC.EXEc:\program files\BONJOUR\MDNSRESPONDER.EXEc:\program files\WIDCOMM\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXEc:\windows\SYSTEM32\IFXSPMGT.EXEc:\windows\SYSTEM32\IFXTCS.EXEc:\program files\JAVA\JRE6\BIN\JQS.EXEc:\program files\ESET\NOD32KRN.EXEc:\windows\SYSTEM32\NVSVC32.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\PSDSRVC.EXEc:\program files\INTEL\WIRELESS\BIN\REGSRVC.EXEc:\program files\ALCOHOL SOFT\ALCOHOL 120\STARWIND\STARWINDSERVICEAE.EXEc:\program files\COMMON FILES\SYMANTEC SHARED\CCPD-LC\SYMLCSVC.EXEc:\windows\SYSTEM32\SCARDSVR.EXEc:\program files\ASUS SECURITY CENTER\ASUS SECURITY PROTECT MANAGER\BIN\ASGHOST.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\PSDRT.EXEc:\program files\INFINEON\SECURITY PLATFORM SOFTWARE\SPTNA.EXEc:\windows\system32\conime.exec:\windows\SYSTEM32\RUNDLL32.EXEc:\windows\SYSTEM32\RUNDLL32.EXEc:\windows\ATK0100\ATKOSD.exec:\windows\system32\ACEngSvr.exec:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exec:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEc:\program files\iPod\bin\iPodService.exec:\program files\Intel\Wireless\Bin\Dot1XCfg.exec:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exec:\windows\system32\wscntfy.exec:\program files\Symantec\LiveUpdate\AUpdate.exec:\progra~1\Symantec\LIVEUP~1\LUCOMS~1.EXE.**************************************************************************.完成時間: 2009-03-04 23:09:43 - 電腦已重新啟動ComboFix-quarantined-files.txt 2009-03-05 07:09:42Pre-Run: 11,974,082,560 bytes freePost-Run: 14,773,452,800 bytes free285 --- E O F --- 2009-02-26 06:08:57 Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 5, 2009 Author ID:61574 Share Posted March 5, 2009 here is my MBAM log===============================Malwarebytes' Anti-Malware 1.33Database version: 1673Windows 5.1.2600 Service Pack 32009/3/4 下午 11:27:50mbam-log-2009-03-04 (23-27-43).txtScan type: Quick ScanObjects scanned: 56650Time elapsed: 2 minute(s), 35 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 2Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 5, 2009 Author ID:61725 Share Posted March 5, 2009 help anyone??? please Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 7, 2009 Root Admin ID:62432 Share Posted March 7, 2009 Please update MBAM and scan again.YOUR VERSIONMalwarebytes' Anti-Malware 1.33Database version: 1673CURRENT VERSIONMalwarebytes' Anti-Malware 1.34Database version: 1825Update and Scan with Malwarebytes' Anti-MalwareStart MalwareBytes AntiMalware (Vista users must Right click and choose RunAs Admin)Please DO NOT run MBAM in Safe Mode unless requested to, you MUST run it in normal Windows mode.Update Malwarebytes' Anti-Malware Select the Update tabClick Update[*]When the update is complete, select the Scanner tab[*]Select Perform quick scan, then click Scan.[*]When the scan is complete, click OK, then Show Results to view the results.[*]Be sure that everything is checked, and click Remove Selected.[*]When completed, a log will open in Notepad. please copy and paste the log into your next reply If you accidently close it, the log file is saved here and will be named like this:C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txtThen post back the MBAM log and a new Hijackthis log. Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 8, 2009 Author ID:62653 Share Posted March 8, 2009 here are the logsMBAM:Malwarebytes' Anti-Malware 1.34Database version: 1825Windows 5.1.2600 Service Pack 33/7/2009 7:47:48 AMmbam-log-2009-03-07 (07-47-43).txtScan type: Quick ScanObjects scanned: 70756Time elapsed: 2 minute(s), 38 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 2Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\userinit.exe -> No action taken.HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: system32\userinit.exe -> No action taken.Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)============================================================Hijackthis:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:48:20 AM, on 3/7/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exec:\WINDOWS\system32\IFXSPMGT.exec:\WINDOWS\system32\IFXTCS.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\nvsvc32.exec:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXEC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Viewpoint\Common\ViewpointService.exec:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exec:\Program Files\Infineon\Security Platform Software\PSDrt.exec:\Program Files\Infineon\Security Platform Software\SpTna.exeC:\WINDOWS\system32\SVCHOST.EXEC:\WINDOWS\Explorer.EXEC:\WINDOWS\ATK0100\HControl.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\RTHDCPL.EXEC:\Program Files\ASUS\ASUS Live Update\ALU.exeC:\WINDOWS\sm56hlpr.exeC:\Program Files\Wireless Console 2\wcourier.exeC:\Program Files\ASUS\Splendid\ACMON.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\ASUS\Power4 Gear\BatteryLife.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\system32\ACEngSvr.exeC:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Electronic Arts\EADM\Core.exeC:\Program Files\DNA\btdna.exeC:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dllO2 - BHO: Java Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 8, 2009 Author ID:62672 Share Posted March 8, 2009 i think i fixed it..i renamed the userinit.exe to userinit.bad.exe.....then i detele it mannual...then i went and copy the original userinit.exe from the Windows XP CD...quick scan show no infection....doing a full scan now... Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 8, 2009 Root Admin ID:62726 Share Posted March 8, 2009 Yes, that is good. Many users don't have access to the CD.You should run an Anti-Virus scan to make sure nothing else is left over. I would recommend you update your current AV and do a scan, then do one with another scanner online to make sure.Please run an Online Anti-Virus scan with either the Java or ActiveX version of KasperskyJava VersionRun Kaspersky Online AV ScannerPlease go to Kaspersky website and perform an online antivirus scan.Read through the requirements and privacy statement and click on Accept button.It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.When the downloads have finished, click on Settings.Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programsArchivesMail databases[*]Click on My Computer under Scan and then put the kettle on![*]Once the scan is complete, it will display the results. Click on View Scan Report.[*]You will see a list of infected items there. Click on Save Report As....[*]Save this report to a convenient place like your Desktop. Change the Files of type to Text file (.txt) before clicking on the Save button.[*]Copy and paste the report into your next reply along with a fresh HJT log and a description of how your PC is behaving.ActiveX versionRun Kaspersky Online AV ScannerUsing Internet Explorer Go to http://www.kaspersky.com/kos/eng/partner/d...kavwebscan.html and click the Accept button at the end of the page.Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%. Read the Requirements and limitations before you click Accept. Allow the ActiveX download if necessary. Once the database has downloaded, click Next. Click Scan Settings and change the "Scan using the following antivirus database" from standard to extended and then click OK. Click on "My Computer" and then put the kettle on!When the scan has completed, click Save Report As... Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt) Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.Copy and paste the report into your next reply along with a fresh HJT log and a description of how your PC is behaving. Link to post Share on other sites More sharing options...
FORMULA_SIN Posted March 8, 2009 Author ID:62884 Share Posted March 8, 2009 hi advance,here is the online scan...--------------------------------------------------------------------------------KASPERSKY ONLINE SCANNER 7 REPORT Sunday, March 8, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Sunday, March 08, 2009 21:18:47 Records in database: 1880883--------------------------------------------------------------------------------Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yesScan area - My Computer: C:\ D:\ E:\Scan statistics: Files scanned: 95897 Threat name: 1 Infected objects: 1 Suspicious objects: 0 Duration of the scan: 00:59:55File name / Threat name / Threats countC:\Program Files\Eset\infected\12JKLMDA.NQF Infected: Trojan.Win32.FraudPack.kho 1The selected area was scanned.=============================================================hi jack thisLogfile of Trend Micro HijackThis v2.0.2Scan saved at 4:14:59 PM, on 3/8/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16791)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeC:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exec:\WINDOWS\system32\IFXSPMGT.exec:\WINDOWS\system32\IFXTCS.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\nvsvc32.exec:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXEC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Viewpoint\Common\ViewpointService.exec:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\AsGHost.exec:\Program Files\Infineon\Security Platform Software\PSDrt.exec:\Program Files\Infineon\Security Platform Software\SpTna.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ATK0100\HControl.exeC:\WINDOWS\system32\RUNDLL32.EXEC:\WINDOWS\system32\rundll32.exeC:\WINDOWS\RTHDCPL.EXEC:\Program Files\ASUS\ASUS Live Update\ALU.exeC:\WINDOWS\sm56hlpr.exeC:\Program Files\Wireless Console 2\wcourier.exeC:\WINDOWS\ATK0100\ATKOSD.exeC:\Program Files\ASUS\Splendid\ACMON.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\ASUS\Power4 Gear\BatteryLife.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\WINDOWS\system32\ACEngSvr.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exeC:\Program Files\Eset\nod32kui.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Electronic Arts\EADM\Core.exeC:\Program Files\DNA\btdna.exeC:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exeC:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exeC:\PROGRA~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXEC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Java\jre6\bin\java.exeC:\WINDOWS\system32\NOTEPAD.EXEC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dllO2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dllO4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exeO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInitO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [skyTel] SkyTel.EXEO4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exeO4 - HKLM\..\Run: [sMSERIAL] sm56hlpr.exeO4 - HKLM\..\Run: [CognizanceTS] rundll32.exe c:\PROGRA~1\ASUSSE~1\ASUSSE~1\Bin\ASTSVCC.dll,RegisterModuleO4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exeO4 - HKLM\..\Run: [ACMON] C:\Program Files\ASUS\Splendid\ACMON.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [ABLKSR] C:\windows\ABLKSR\ABLKSR.exeO4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXEO4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\ASUSTek\ASUSDVD\PDVDServ.exe"O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [MaxMenuMgr] "C:\Program Files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe"O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /bootO4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe -silentO4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"O4 - Global Startup: MultiFrame.lnk = ?O4 - Global Startup: Bluetooth.lnk = ?O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exeO9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLLO9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exeO9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exeO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO14 - IERESET.INF: START_PAGE_URL=http://www.asus.comO16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab55200.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cabO16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cabO16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab55762.cabO16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab55579.cabO16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cabO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO20 - AppInit_DLLs: APSHook.dllO20 - Winlogon Notify: OneCard - c:\Program Files\ASUS Security Center\ASUS Security Protect Manager\Bin\ASWLNPkg.dllO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exeO23 - Service: Bonjour ?? (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exeO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: Seagate Service (FreeAgentGoNext Service) - Seagate Technology LLC - C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: Security Platform Management Service (IFXSpMgtSrv) - Infineon Technologies AG - c:\WINDOWS\system32\IFXSPMGT.exeO23 - Service: Trusted Platform Core Service (IFXTCS) - Infineon Technologies AG - c:\WINDOWS\system32\IFXTCS.exeO23 - Service: iPod ?? (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Personal Secure Drive Service (PersonalSecureDriveService) - Infineon Technologies AG - c:\Program Files\Infineon\Security Platform Software\PSDsrvc.EXEO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exeO23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exeO23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe--End of file - 12316 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted March 9, 2009 Root Admin ID:62973 Share Posted March 9, 2009 Looks good. That file was just one that ESET AV already removed.Please empty the Quarantine from ESET NOD32 and from MBAM if there are any. Then I'll leave you with this as you appear to be clean now.Please remove Combofix. Click on START - RUN and type in Combofix.exe /U (there is a space between combofix.exe and the /U ) and click OK and remove CF.Great, all looks good now.I'll close your post soon so that other don't post into it and leave you with this information and suggestions.So how did I get infected in the first place?At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:Remove all but the most recent Restore Point on Windows XPYou should Create a New Restore Point to prevent possible reinfection from an old one.Some of the malware you picked up could have been saved in System Restore.Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.The easiest and safest way to do this is:Go to Start > Programs > Accessories > System Tools and click "System Restore".If the shortcut is missing you can also click on START > RUN > and type in %SystemRoot%\system32\restore\rstrui.exe and click OKChoose the radio button marked "Create a Restore Point" on the first screen then click "Next".Give the new Restore Point a name, then click "Create".The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.Then use the Disk Cleanup to remove all but the most recently created Restore Point.Go to Start > Run and type: Cleanmgr.exeSelect the drive where Windows is installed and click "Ok". Disk Cleanup will scan your files for several minutes, then open.Click the "More Options" tab, then click the "Clean up" button under System Restore.Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"Click Yes, then click Ok.Click Yes again when prompted with "Are you sure you want to perform these actions?"Disk Cleanup will remove the files and close automatically.On the Disk Cleanup tab, if the System Restore: Obsolete Data Stores entry is available remove them also.These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.Additional informationMicrosoft KB article: How to turn off and turn on System Restore in Windows XPBert Kinney's site: All about Windows System RestoreHere are some free programs I recommend that could help you improve your computer's security.Install SpyWare BlasterDownload it from hereFind here the tutorial on how to use Spyware Blaster here Install WinPatrolDownload it from hereHere you can find information about how WinPatrol works hereInstall FireTrust SiteHoundYou can find information and download it from hereInstall hpHosts Download it from herehpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad, tracking and malicious websites. This prevents your computer from connecting to these untrusted sites by redirecting them to 127.0.0.1 which is your own local computer.hpHosts Support ForumUpdate your Antivirus programs and other security products regularly to avoid new threats that could infect your system.You can use one of these sites to check if any updates are needed for your pc.Secunia Software InspectorF-secure Health CheckVisit Microsoft often to get the latest updates for your computer.http://www.update.microsoft.comNote 1: If you are running Windows XP SP2, you should upgrade to SP3.Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.The security suite can then be reinstalled afterwards.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must. I recommend Online Armor FreeA little outdated but good reading on how to prevent MalwareKeep safe online and happy surfing.Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post InstructionsAlso don't forget that we offer FREE assistance with General PC questions and repair here PC Help If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org Link to post Share on other sites More sharing options...
Recommended Posts