Recurring rouge .DLLs and registry 'Trojan Agents'

Trun0-Jay · March 31, 2009

I've had this problem for the past two days, and I'm 90% certain is came off the back off Spyware Protect 2009

To cut to the chase, I'm getting rather oddly named .dlls appearing in my WINDOWS folder, which are then spawning registry changes (which are all currently being denied access by Spybot)

Malware bytes detects both issues, and I remove them via the restart option, but another just takes its place, differently named.

I've found no information on any of these .dlls, but if it perhaps helps, here's the list of every one so far.

oxidinir.dll
ucexowexuluq.dll
ebetidaciroj.dll
ezibugidixenibek.dll
usuxuzedesuvar.dll
ahibahuk.dll
iwabowixanimi.dll
And the registry value they all share:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxasotovuni

Below is a Malwarebytes developer log running on the latest update, and below that, a hijack this log

I hope you can help me with this issue, and appreciate any recieved.

Thank you

-----------------------------------------------------------------------

Malwarebytes' Anti-Malware 1.35

Database version: 1923

Windows 5.1.2600 Service Pack 3

31/03/2009 13:31:07

mbam-log-2009-03-31 (13-31-07).txt

Scan type: Quick Scan

Objects scanned: 79924

Time elapsed: 58 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pxasotovuni (Trojan.Agent) -> Delete on reboot. [3857535134305383807566791534727079851301414438586445483634456446343641424738615

24839535634513861467468838084807185615674796980888461368683837079855570838474807

9

6151867993113232323011838679697777201915708970113232323215697777323270]

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\atotikapaw.dll (Trojan.Agent) -> Delete on reboot. [3857535134305383807566791534727079851301414438586445483634456446343641424738615

24839535634513861467468838084807185615674796980888461368683837079855570838474807

9

6151867993113232323011838679697777201915708970113232323215697777323270]

---------------------------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 13:29:52, on 31/03/2009

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16791)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Kontiki\KService.exe

C:\WINDOWS\system32\libusbd-nt.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\Program Files\Common Files\Motive\McciCMService.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\Drivers\WTSRV.EXE

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgtray.exe

C:\WINDOWS\system32\WISPTIS.EXE

C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe

C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe

C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\Documents and Settings\Jordan\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O1 - Hosts: ::1 localhost

O1 - Hosts: 91.212.65.122 browser-security.microsoft.com

O1 - Hosts: 91.212.65.122 spyware-protector-2009.com

O1 - Hosts: 91.212.65.122 www.spyware-protector-2009.com

O1 - Hosts: 91.212.65.122 secure.spyware-protector-2009.com

O1 - Hosts: 91.212.65.122 knocker

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup

O4 - HKLM\..\Run: [WTClient] WTClient.exe

O4 - HKLM\..\Run: [MP10_EnsureFileVer] C:\WINDOWS\inf\unregmp2.exe /EnsureFileVersions

O4 - HKLM\..\Run: [btbb_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe"

O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] "C:\Program Files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [Pxasotovuni] rundll32.exe "C:\WINDOWS\atotikapaw.dll",e

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Google Media Scanner] "C:\Program Files\Google\Google Media Server\GoogleMediaScanner.exe"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll

O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: avgrsstx.dll C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google MediaServer - Unknown owner - C:\Program Files\Google\Google Media Server\GoogleMediaServer.exe (file missing)

O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe

O23 - Service: LibUsb-Win32 - Daemon, Version 0.1.10.1 (libusbd) - http://libusb-win32.sourceforge.net - C:\WINDOWS\system32\libusbd-nt.exe

O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe

O23 - Service: McciCMService - Motive Communications, Inc. - C:\Program Files\Common Files\Motive\McciCMService.exe

O23 - Service: RaySat_3dsmax8 Server (mi-raysat_3dsmax8) - Unknown owner - C:\Program Files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

O23 - Service: WinTab Service (WinTabService) - Tablet Driver - C:\WINDOWS\System32\Drivers\WTSRV.EXE

--

End of file - 11127 bytes

miekiemoes · March 31, 2009

Hi,

No need to post the developers log for that...

I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

Then, * Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Trun0-Jay · March 31, 2009

I'm currently running combofix on the computer, however it seems to have encountered something strange.

The program ran its scan as usual, but when it created a log, it mentioned that one didn't exist and would you like to create another.

I clicked yes and now all that remains on my screen is my wallpaper and a notepad document labelled 'log' with nothing on it.

What should I do?

miekiemoes · March 31, 2009

That's strange. Did you disable your AVG before as I posted in the instructions? This because Antivirus scanners may interfere with it and cause problems.

Also, make sure that Combofix was executed from your desktop and not anywhere else, because that may also explain a lot

Please reboot and try again - or run from Windows safe mode.

The log from Combofix should be located on your C:\ with the name Combofix.txt

Edit.. and disable Teatimer as well.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

Trun0-Jay · March 31, 2009

Ok, thank you for your paitence and please disregard my last post.

I'm not sure what happened to get to the point of a blank log, but when i checked my documents through 'file' there is certainly a combofix file in C:

I'm going to reboot and post that log now.

miekiemoes · March 31, 2009

If there's a C:\Combofix.txt file, then please post the contents

Trun0-Jay · March 31, 2009

Here's the Combofix.txt file as requested.

------------------------------------------

ComboFix 09-03-30.02 - Jordan 2009-03-31 15:11:43.1 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1398 [GMT 1:00]

Running from: c:\documents and settings\Jordan\Desktop\ComboFix.exe

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

* Created a new restore point

.

((((((((((((((((((((((((( Files Created from 2009-02-28 to 2009-03-31 )))))))))))))))))))))))))))))))

.

2009-03-29 21:08 . 2009-03-29 21:08 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware

2009-03-29 21:08 . 2009-03-29 21:08 <DIR> d-------- c:\documents and settings\Jordan\Application Data\Malwarebytes

2009-03-29 21:08 . 2009-03-29 21:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes

2009-03-29 21:08 . 2009-03-26 16:49 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-29 21:08 . 2009-03-26 16:49 15,504 --a------ c:\windows\system32\drivers\mbam.sys

2009-03-16 19:00 . 2009-03-16 19:00 <DIR> d-------- c:\documents and settings\Jordan\Application Data\HP

2009-03-16 18:57 . 2009-03-16 18:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\WEBREG

2009-03-16 18:50 . 2001-08-17 14:53 6,784 --a------ c:\windows\system32\drivers\serscan.sys

2009-03-16 18:50 . 2001-08-17 14:53 6,784 --a--c--- c:\windows\system32\dllcache\serscan.sys

2009-03-16 18:34 . 2009-03-22 00:21 <DIR> d-------- c:\documents and settings\Jordan\Application Data\HPAppData

2009-03-16 18:26 . 2009-03-16 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard

2009-03-16 18:26 . 2007-01-17 17:37 49,920 -ra------ c:\windows\system32\drivers\HPZid412.sys

2009-03-16 18:26 . 2007-01-17 17:37 16,496 -ra------ c:\windows\system32\drivers\HPZipr12.sys

2009-03-16 18:25 . 2007-11-07 03:10 271,704 -ra------ c:\windows\system32\hpzids01.dll

2009-03-16 18:25 . 2007-12-03 19:57 118,272 --a------ c:\windows\system32\hpz3l5mu.dll

2009-03-16 18:25 . 2007-01-17 17:37 21,568 -ra------ c:\windows\system32\drivers\HPZius12.sys

2009-03-16 18:24 . 2007-10-31 11:35 729,088 -ra------ c:\windows\system32\hpwwiax4.dll

2009-03-16 18:24 . 2007-10-31 11:35 593,920 -ra------ c:\windows\system32\hpwtscl3.dll

2009-03-16 18:24 . 2007-01-17 17:37 364,544 -ra------ c:\windows\system32\hppldcoi.dll

2009-03-16 18:24 . 2007-01-17 17:37 309,760 -ra------ c:\windows\system32\difxapi.dll

2009-03-16 18:24 . 2007-01-17 17:31 294,912 -ra------ c:\windows\system32\hpovst11.dll

2009-03-16 18:17 . 2009-03-16 18:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant

2009-03-16 18:15 . 2009-03-16 18:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\HP

2009-03-16 18:14 . 2009-03-16 18:14 <DIR> d-------- c:\program files\Common Files\HP

2009-03-16 18:14 . 2009-03-16 18:14 <DIR> d-------- c:\program files\Common Files\Hewlett-Packard

2009-03-16 18:13 . 2009-03-16 18:13 <DIR> d-------- c:\program files\Hewlett-Packard

2009-03-16 18:12 . 2009-03-16 18:12 <DIR> d-------- c:\windows\yellowtail+1

2009-03-16 18:12 . 2007-11-07 03:04 1,373,528 -ra------ c:\windows\hpzshl01.exe

2009-03-16 18:12 . 2007-11-07 03:15 1,140,056 -ra------ c:\windows\hpzmsi01.exe

2009-03-16 18:12 . 2008-01-08 13:46 12,038 -ra------ c:\windows\hpwscr20.dat

2009-03-16 18:11 . 2009-03-16 18:17 <DIR> d-------- c:\program files\HP

2009-03-16 18:11 . 2008-04-13 19:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys

2009-03-16 18:11 . 2008-04-13 19:47 25,856 --a--c--- c:\windows\system32\dllcache\usbprint.sys

2009-03-16 18:11 . 2008-04-13 19:45 15,104 --a------ c:\windows\system32\drivers\usbscan.sys

2009-03-16 18:11 . 2008-04-13 19:45 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys

2009-03-16 18:03 . 2009-03-16 18:56 178,362 --a------ c:\windows\hpwins20.dat

2009-03-16 18:03 . 2008-01-08 13:42 2,428 -ra------ c:\windows\hpwmdl20.dat

2009-03-13 21:05 . 2009-03-13 21:05 <DIR> d-------- c:\documents and settings\Jordan\Application Data\The Creative Assembly

2009-03-13 21:04 . 2008-10-10 05:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll

2009-03-13 21:04 . 2008-10-10 05:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll

2009-03-13 21:04 . 2008-10-27 11:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll

2009-03-13 06:08 . 2009-03-13 06:09 <DIR> d-------- c:\documents and settings\Jordan\Application Data\Bioshock

2009-03-13 03:36 . 2009-03-13 03:37 <DIR> d-------- c:\program files\Safari

2009-03-13 03:03 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll

2009-03-13 03:03 . 2009-01-15 13:19 23,848 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys

2009-03-13 03:02 . 2009-03-13 03:03 <DIR> d-------- c:\program files\iTunes

2009-03-13 03:02 . 2009-03-13 03:02 <DIR> d-------- c:\program files\iPod

2009-03-13 03:02 . 2009-03-13 03:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

2009-03-13 02:56 . 2009-03-13 03:02 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer

2009-03-13 02:53 . 2009-03-13 02:54 <DIR> d-------- c:\program files\Apple Software Update

2009-03-13 02:52 . 2009-03-13 03:02 <DIR> d-------- c:\program files\Common Files\Apple

2009-03-09 04:43 . 2009-03-09 04:43 <DIR> d-------- c:\program files\OpenAL

2009-03-07 02:04 . 2009-03-30 17:14 <DIR> d-------- c:\documents and settings\Jordan\Tracing

2009-03-07 01:59 . 2009-03-07 01:59 <DIR> d-------- c:\program files\Microsoft

2009-03-07 01:58 . 2009-03-07 01:58 <DIR> d-------- c:\program files\Windows Live SkyDrive

2009-02-24 19:06 . 2009-02-24 22:34 <DIR> d-------- c:\documents and settings\Jordan\Application Data\U3

2009-02-17 00:33 . 2009-02-17 00:33 <DIR> d-------- c:\program files\Common Files\Windows Live

2009-02-11 23:36 . 2009-02-11 23:36 0 -ra------ C:\logwmemory.bin

2009-02-11 23:26 . 2009-02-11 23:26 <DIR> d-------- c:\documents and settings\Jordan\Application Data\Soldat

2009-02-11 02:10 . 2008-10-10 05:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll

2009-02-11 02:10 . 2008-10-27 11:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll

2009-02-11 02:10 . 2008-10-27 11:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll

2009-02-11 02:10 . 2008-10-27 11:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll

2009-02-06 19:52 . 2009-02-06 19:52 49,504 --a------ c:\windows\system32\sirenacm.dll

2009-02-04 03:55 . 2009-02-04 03:55 <DIR> d-------- C:\Sprays

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-03-31 14:19 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki

2009-03-31 01:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater

2009-03-30 17:30 --------- d-----w c:\documents and settings\Jordan\Application Data\uTorrent

2009-03-30 13:19 --------- d-----w c:\documents and settings\All Users\Application Data\avg8

2009-03-30 03:41 --------- d-----w c:\documents and settings\Jordan\Application Data\Skype

2009-03-29 22:52 --------- d-----w c:\documents and settings\Jordan\Application Data\skypePM

2009-03-27 14:56 --------- d-----w c:\program files\Steam

2009-03-19 00:22 --------- d-----w c:\documents and settings\Jordan\Application Data\vlc

2009-03-18 22:07 --------- d-----w c:\program files\VideoLAN

2009-03-13 23:45 --------- d-----w c:\documents and settings\Jordan\Application Data\Apple Computer

2009-03-13 02:00 --------- d-----w c:\program files\Bonjour

2009-03-13 01:59 --------- d-----w c:\program files\QuickTime

2009-03-07 00:57 --------- d-----w c:\program files\Windows Live

2009-03-07 00:55 --------- d-----w c:\program files\Unreal Tournament 3

2009-03-06 23:48 --------- d-----w c:\program files\Creative

2009-03-06 23:48 --------- d-----w c:\documents and settings\All Users\Application Data\Creative

2009-03-04 22:18 --------- d-----w c:\documents and settings\Jordan\Application Data\dvdcss

2009-01-31 14:01 --------- d-----w c:\documents and settings\Jordan\Application Data\Motive

2009-01-31 14:00 325,128 ----a-w c:\windows\system32\drivers\avgldx86.sys

2009-01-31 14:00 107,272 ----a-w c:\windows\system32\drivers\avgtdix.sys

2009-01-31 13:55 --------- d--h--w c:\program files\InstallShield Installation Information

2009-01-30 23:27 --------- d-----w c:\program files\Defraggler

2009-01-30 16:33 --------- d-----w c:\program files\EA GAMES

2009-01-30 16:33 --------- d-----w c:\documents and settings\Jordan\Application Data\My Battle for Middle-earth Files

2008-07-14 01:22 122,880 ----a-w c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-31 1601304]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]

"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-07-14 29744]

"MP10_EnsureFileVer"="c:\windows\inf\unregmp2.exe" [2008-04-14 208896]

"btbb_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb\BTHelpNotifier.exe" [2007-11-01 1475072]

"btbb_wcm_McciTrayApp"="c:\program files\BT Broadband Desktop Help\btbb_wcm\McciTrayApp.exe" [2007-11-29 1474048]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-11 342312]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]

"Pxasotovuni"="c:\windows\onoyoradiyub.dll" [2008-04-14 156160]

"WTClient"="WTClient.exe" [2007-04-11 c:\windows\system32\WTClient.exe]

"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]

2009-01-31 15:00 10520 c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli lintus.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Jordan^Start Menu^Programs^Startup^GIGABYTE VGA Utility.lnk]

path=c:\documents and settings\Jordan\Start Menu\Programs\Startup\GIGABYTE VGA Utility.lnk

backup=c:\windows\pss\GIGABYTE VGA Utility.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]

--a------ 2007-06-01 10:21 153136 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]

--a------ 2005-08-11 09:30 249856 c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]

--a------ 2005-08-11 09:30 81920 c:\program files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LiveMonitor]

--a------ 2008-04-30 18:30 498176 c:\program files\MSI\Live Update 3\LMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]

--a------ 2007-03-01 15:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]

--a------ 2008-10-07 14:33 13574144 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]

--a------ 2008-10-07 14:33 86016 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

--a------ 2008-03-25 04:28 144784 c:\program files\Java\jre1.6.0_06\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

--a------ 2005-05-03 18:43 69632 c:\windows\Alcmtr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]

--a------ 2008-10-07 14:33 1630208 c:\windows\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]

--a------ 2008-04-10 16:52 16861184 c:\windows\RTHDCPL.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=

"c:\\Program Files\\Autodesk\\3dsMax8\\3dsmax.exe"=

"c:\\Program Files\\Autodesk\\backburner\\monitor.exe"=

"c:\\Program Files\\Autodesk\\backburner\\manager.exe"=

"c:\\Program Files\\Autodesk\\backburner\\server.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\UT2003\\System\\UT2003.exe"=

"c:\\Documents and Settings\\Jordan\\My Documents\\Downloads\\Counter-Strike 1.6 + Half-Life\\hl.exe"=

"c:\\Program Files\\Steam\\steamapps\\trun0jay\\counter-strike source\\hl2.exe"=

"c:\\Program Files\\Steam\\steamapps\\trun0jay\\half-life 2 deathmatch\\hl2.exe"=

"c:\\Program Files\\Steam\\steamapps\\trun0jay\\day of defeat source\\hl2.exe"=

"c:\\Program Files\\Kontiki\\KService.exe"=

"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=

"c:\\Program Files\\MAX-FX Tools\\MaxEd\\MaxED.exe"=

"c:\\Program Files\\Steam\\steam.exe"=

"c:\\Program Files\\Bethesda Softworks\\Fallout 3\\Fallout3.exe"=

"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX9.exe"=

"c:\\Program Files\\CAPCOM\\LOSTPLANETCOLONIES\\LostPlanetColoniesDX10.exe"=

"c:\\Program Files\\Steam\\steamapps\\trun0jay\\team fortress 2\\hl2.exe"=

"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\warhammer 40,000 dawn of war ii - beta\\DOW2.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\peggle extreme\\PeggleExtreme.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\empire total war demo\\Empire.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=

"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=

"c:\\Program Files\\Google\\Google Desktop Search\\GoogleDesktop.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\bioshock demo\\Builds\\Release\\Bioshock.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\unreal tournament 3\\Binaries\\UT3.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\srcds.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\left 4 dead\\left4dead.exe"=

"c:\\Program Files\\Steam\\steamapps\\common\\world in conflict - demo\\wic.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-06-16 325128]

R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-06-16 107272]

R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-07-02 903960]

R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-07-02 298264]

R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe --> system32\libusbd-nt.exe [?]

R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2008-08-25 33792]

R3 PTSimBus;PenTablet Bus Enumerator;c:\windows\system32\drivers\PTSimBus.sys [2007-06-07 18944]

R3 PTSimHid;PenTablet Simulated HID MiniDriver;c:\windows\system32\drivers\PTSimHid.sys [2007-04-23 10752]

S2 Google MediaServer;Google MediaServer;"c:\program files\Google\Google Media Server\GoogleMediaServer.exe" --> c:\program files\Google\Google Media Server\GoogleMediaServer.exe [?]

S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-07-14 29744]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HPService REG_MULTI_SZ HPSLPSVC

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]

\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b99ed17c-b3f8-11dd-88a0-001d923bd5ed}]

\Shell\AutoRun\command - E:\wdsync.exe

.

Contents of the 'Scheduled Tasks' folder

2009-03-13 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 13:34]

2009-03-31 c:\windows\Tasks\Google Software Updater.job

- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-03-24 03:30]

2009-03-24 c:\windows\Tasks\WebReg Officejet J4680 Series.job

- c:\program files\HP\Digital Imaging\bin\hpqwrg.exe [2007-10-14 21:40]

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-Google Media Scanner - c:\program files\Google\Google Media Server\GoogleMediaScanner.exe

Notify-dimsntfy - (no file)

MSConfigStartUp-DelReg - c:\program files\MSI\DualCoreCenter\DelReg.exe

.

------- Supplementary Scan -------

.

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\Jordan\Application Data\Mozilla\Firefox\Profiles\1qky7s9r.default\

FF - prefs.js: browser.startup.homepage - hxxps://twitter.com/home

FF - component: c:\documents and settings\Jordan\Application Data\Mozilla\Firefox\Profiles\1qky7s9r.default\extensions\{7378B8C2-FC38-41b8-A8C9-875D1F5B0A24}\components\NativeComponent.dll

FF - component: c:\documents and settings\Jordan\Application Data\Mozilla\Firefox\Profiles\1qky7s9r.default\extensions\piclens@cooliris.com\components\coolirisstub.dll

FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll

FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll

FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll

FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npBBCPlugin.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll

FF - plugin: c:\windows\system32\npmirage.dll

FF - plugin: c:\windows\system32\npwmsdrm.dll

---- FIREFOX POLICIES ----

FF - user.js: general.useragent.extra.zencast - );user_pref(general.useragent.extra.zencast, .

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-03-31 15:19:29

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(772)

c:\windows\lintus.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\system32\CTSVCCDA.EXE

c:\program files\Kontiki\KService.exe

c:\windows\system32\libusbd-nt.exe

c:\program files\AVG\AVG8\avgrsx.exe

c:\progra~1\AVG\AVG8\avgnsx.exe

c:\program files\Common Files\Motive\McciCMService.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Autodesk\3dsMax8\mentalray\satellite\raysat_3dsmax8server.exe

c:\windows\system32\nvsvc32.exe

c:\windows\system32\wdfmgr.exe

c:\windows\system32\drivers\WTSrv.exe

c:\program files\AVG\AVG8\avgcsrvx.exe

c:\windows\system32\WISPTIS.EXE

c:\windows\system32\rundll32.exe

c:\windows\system32\wscntfy.exe

c:\program files\iPod\bin\iPodService.exe

c:\program files\HP\Digital Imaging\bin\hpqste08.exe

c:\program files\HP\Digital Imaging\bin\hpqbam08.exe

c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe

.

**************************************************************************

.

Completion time: 2009-03-31 15:22:55 - machine was rebooted

ComboFix-quarantined-files.txt 2009-03-31 14:22:52

Pre-Run: 71,502,016,512 bytes free

Post-Run: 72,029,327,360 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

307 --- E O F --- 2009-03-07 00:43:55

miekiemoes · March 31, 2009

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::
c:\windows\onoyoradiyub.dll
Collect::[8]
c:\windows\lintus.dll
Registry::
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Pxasotovuni"=-

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again.

Then, please visit this site:

http://www.bleepingcomputer.com/submit-malware.php?channel=8

Where it says: "Browse to the file you want to submit", use the Browse button to navigate to the following file: C:\Qoobox\Quarantine\[8]-Submit_date_time.zip (date_time will be replaced with the date and time when this file was created)

Then click the "Send File" button below in order to upload it.

After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Trun0-Jay · March 31, 2009

The file was uploaded to Bleeping Computer.

Below is the Combofix log

------------------------------

ComboFix 09-03-30.04 - Jordan 2009-03-31 16:18:53.2 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1543 [GMT 1:00]

Running from: c:\documents and settings\Jordan\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Jordan\Desktop\CFScript.txt

AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

* Created a new restore point

FILE ::

c:\windows\onoyoradiyub.dll

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))