x111josh Posted July 4, 2009 ID:95626 Share Posted July 4, 2009 i ran the RootRepeal search like i was told to on another page and as i am not a computer whiz and dont want to damage my computer in any way i would like you to look at my report and tell me what needs deleting.ROOTREPEAL © AD, 2007-2009==================================================Scan Time: 2009/07/04 14:38Program Version: Version 1.3.0.0Windows Version: Windows XP Media Center Edition SP3==================================================Hidden/Locked Files-------------------Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: C:\WINDOWS\system32\SKYNET.datStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\SKYNETdveaopuq.datStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\SKYNETkauwcdgm.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\SKYNETmbwnxaac.datStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\SKYNETnpoxhraq.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETetrptimnkx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETevnnsecvsf.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETewfgnbgseh.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETeyvruppbhe.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfbfhjcgqer.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETferbiqplxx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfhouoipjpk.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfnyobpeuwf.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfovgevyqou.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfposnrvukw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETftapibhhww.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETftccspyfnc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfungxsshtj.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfuwbaqeayn.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETfvknuoqemc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETgatqkikqeq.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETgggspwnlfx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETgglthowcbv.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETgqitmcabss.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETguucyvqfls.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNEThwncbuvoqb.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETiapkbxpypk.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETicqqoibcet.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETihdefebmky.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpivljnohyt.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpjgbcorirw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETprfthksmdd.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpurnubvvdw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqappdcrpok.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqescyqfqug.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqgfehnbvea.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqopuykpxjb.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqptlnsviuy.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETqvjbcwdjde.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETrhlxqcpkrx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETrhxjwxtoix.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETrivmdatmff.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETruouqqlkbc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETryjbntysid.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETsgtxrrqtdg.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETskaectooul.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETsmhwuwajlr.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETsnbsuyxxwc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETssnyhbobsy.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETsvmucriunp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETswpwvywnqu.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETsxxadlmbdp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETtmvppadtqc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETtnwxweeciq.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETtrpepufnid.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETubalgtoxty.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETudlmvljgly.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETuefuarvhil.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETuiynorafjm.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETacqbxotjup.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETaihimbwrtw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETakbplyoilt.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbcjxyecbqn.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbdwfhqbwhp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbndjmqweyg.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbowxjyptbw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETboxntqntih.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbqtvyrsvnc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbtgfoydwmp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbwjokuygvh.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbwqvrxeiso.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbwwnotrbax.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETbyqwnxwasm.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcdijmjuxwb.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcdonrnrtrg.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcmoelxnewx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcqmxfhqfnv.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcqwkeefqko.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcrviwqqfni.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETcsmqacfkqx.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETctcyxwvhhr.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETddsfivqlcn.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETdgdnfmtuny.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETdqrdmbbjwi.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETekyfwbvjtc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETepsxctgidb.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETesbhgfdtxy.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETesqviarjxm.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETijxgnmcivi.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmjgebmafki.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpfhxjipomr.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETunflnvfsdf.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\TempRecStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmpC651.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETimotrfgbvs.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETjbpcrhyniv.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETjcngaseuil.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETjpgmtfgggi.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkgqsvjwipr.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkhslhbcgxw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkpxeyjxqop.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkrkpafomeq.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkwlskocvow.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETkyraupfrlw.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETlcvdajyxhh.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETltcoftexil.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmegyvkqeei.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmeyhafvurq.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmitqdrbcxo.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETunsurxovcy.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETupabjxxhyp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETurovmpljim.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETuydiubdhfv.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETuygcffgktd.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETvcbakynqsk.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETvicfrxoupj.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETwgjwtiinuo.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETwjncvefgej.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETwsnosyhbxn.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETwtacotcxnc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETxiqmylbeea.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETxtqqtoiqhp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETxvcdtebesb.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETydaecmsshr.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETyhnvprdyul.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETyljlopohqp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETypaepisocq.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\Temporary Internet FilesStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_169300280905.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_172888438339.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_34843820849.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_482116482486.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_6701453802.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_728517101847.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmp0_732455768556.bk.oldStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\tmpA701.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\wawrhpkruf.exeStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c115816.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c16583.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c44075.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c49997.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c56220.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c65152.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c70178.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c78115.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c94894.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\x1c98268.dllStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\xdtjd6r8fyase45y5isss42.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\xdtjd6r8fyase45y5isss44.exeStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\{6226BA26-C017-4007-928C-DE9715C6FA67}Status: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_227545745599.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_262056469407.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_341072147205.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_58595781066.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_635873492021.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_773245570571.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_785073403698.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_797343774174.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\txpxr_828302802795.b1kStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmqadqkpjio.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmrtkncpmsj.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETmutejjimyk.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETnciadrruyp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETnmvjryjfcp.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETnnautywtyf.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETodaujyakih.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNEToerhfhycms.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETofllkhfqpd.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETomcuecjmkd.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETontnvtmsfj.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETopqbdeyivi.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETowgyfpeopc.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETowiuuiuvop.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpbnpqfanmd.tmpStatus: Invisible to the Windows API!Path: C:\WINDOWS\Temp\SKYNETpceotiecff.tmpStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Josh's Account\My Documents\skynet.txtStatus: Invisible to the Windows API!Path: C:\Documents and Settings\Josh's Account\Recent\skynet.lnkStatus: Invisible to the Windows API!Path: C:\WINDOWS\system32\drivers\SKYNETayvomhcr.sysStatus: Invisible to the Windows API!Path: c:\documents and settings\josh's account\local settings\application data\google\chrome\user data\default\current sessionStatus: Size mismatch (API: 147209, Raw: 146565)Path: C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\User Data\Default\PreferencesStatus: Could not get file information (Error 0xc0000008)Path: C:\Documents and Settings\Josh's Account\Local Settings\Apps\2.0\66B2YOAZ.LQL\JN01ZGEK.NHK\manifests\clickonce_bootstrap.exe.cdf-msStatus: Locked to the Windows API!Path: C:\Documents and Settings\Josh's Account\Local Settings\Apps\2.0\66B2YOAZ.LQL\JN01ZGEK.NHK\manifests\clickonce_bootstrap.exe.manifestStatus: Locked to the Windows API!Path: C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00064aStatus: Visible to the Windows API, but not on disk.Path: C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\User Data\Default\Cache\f_00064bStatus: Visible to the Windows API, but not on disk.==EOF==thanks in advance, Josh. Link to post Share on other sites More sharing options...
x111josh Posted July 4, 2009 Author ID:95667 Share Posted July 4, 2009 I also ran a HijackThis scan and saved a logfile... here it is.Logfile of Trend Micro HijackThis v2.0.2Scan saved at 18:26:33, on 04/07/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\csrss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\ccProxy.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\lxdjcoms.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Spyware Doctor\pctsAuxs.exeC:\Program Files\Spyware Doctor\pctsSvc.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\WINDOWS\ehome\mcrdsvc.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\ctfmon.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\RTHDCPL.EXEC:\Program Files\Synaptics\SynTP\Toshiba.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Toshiba\Toshiba Applet\thotkey.exeC:\WINDOWS\system32\TPSMain.exeC:\Program Files\TOSHIBA\ConfigFree\NDSTray.exeC:\Program Files\TOSHIBA\Tvs\TvsTray.exeC:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exeC:\WINDOWS\system32\TPSBattM.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Lexmark 1400 Series\lxdjamon.exeC:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\Spyware Doctor\pctsTray.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeC:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Registry Mechanic\RegMech.exeC:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeC:\Program Files\Windows Live\Contacts\wlcomm.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Josh's Account\My Documents\Downloads\RootRepeal\RootRepeal.exeC:\WINDOWS\system32\notepad.exeC:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXEC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\WINDOWS\System32\spool\DRIVERS\W32X86\3\lxdjPSWX.EXEC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\wbem\wmiprvse.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO1 - Hosts: 193.125.23.12 updates.sald.comO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dllO3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dllO3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exeO4 - HKLM\..\Run: [TPSMain] TPSMain.exeO4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exeO4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exeO4 - HKLM\..\Run: [TFncKy] TFncKy.exeO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [iS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {F073BDC9-0D67-4ff0-879E-27241C843828} /MODE CfgWiz /CMDLINE "REBOOT"O4 - HKLM\..\Run: [sSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe"O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [lxdjamon] "C:\Program Files\Lexmark 1400 Series\lxdjamon.exe"O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [iSTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\wrfgs.exeO4 - HKLM\..\Run: [PerfectOptimizer] C:\Program Files\Perfect Optimizer\PerfectOptimizer.exeO4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /HO4 - HKUS\S-1-5-21-3302858070-2627837727-3129192433-500\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe (User 'Administrator')O4 - HKUS\S-1-5-21-3302858070-2627837727-3129192433-500\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Administrator')O4 - HKUS\S-1-5-21-3302858070-2627837727-3129192433-500\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Administrator')O4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exeO8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?95313124e5994561b0b22a57295b4caO8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?95313124e5994561b0b22a57295b4caO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exeO23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeO23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exeO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdjserv.exeO23 - Service: lxdj_device - - C:\WINDOWS\system32\lxdjcoms.exeO23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exeO23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXEO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exeO23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exeO23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exeO23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe--End of file - 14749 byteswould be really greatful for some advice on how to get rid of this damn skynet virus.thanks, Josh. Link to post Share on other sites More sharing options...
Fatdcuk Posted July 4, 2009 ID:95669 Share Posted July 4, 2009 Hi Josh and welcome to the MBAM forums Locate in Rootrepeal hidden files scan the following line only.Highlight it and select wipe filePath: C:\WINDOWS\system32\drivers\SKYNETayvomhcr.sysStatus: Invisible to the Windows API!Reboot immediately!Install, update and run MBAM Quick scan.Please allow it to delete what it finds, reboot and then post back the MBAM scan log for that removal.Thanks in advance Link to post Share on other sites More sharing options...
x111josh Posted July 4, 2009 Author ID:95679 Share Posted July 4, 2009 hi and thanks,i wiped the file you said to, and then ran the quick check, which seems to have worked thanks for the help.. and here is the MBAM log file...Malwarebytes' Anti-Malware 1.38Database version: 2362Windows 5.1.2600 Service Pack 304/07/2009 19:40:59mbam-log-2009-07-04 (19-40-59).txtScan type: Quick ScanObjects scanned: 98938Time elapsed: 9 minute(s), 9 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 155Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:c:\WINDOWS\Temp\SKYNETetrptimnkx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETevnnsecvsf.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETewfgnbgseh.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETeyvruppbhe.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfbfhjcgqer.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETferbiqplxx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfhouoipjpk.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfnyobpeuwf.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfovgevyqou.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfposnrvukw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETftapibhhww.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETftccspyfnc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfungxsshtj.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfuwbaqeayn.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETfvknuoqemc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETgatqkikqeq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETgggspwnlfx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETgglthowcbv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETgqitmcabss.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETguucyvqfls.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNEThwncbuvoqb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETiapkbxpypk.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETicqqoibcet.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETihdefebmky.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpivljnohyt.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpjgbcorirw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETprfthksmdd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpurnubvvdw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqappdcrpok.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqescyqfqug.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqgfehnbvea.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqopuykpxjb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqptlnsviuy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETqvjbcwdjde.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETrhlxqcpkrx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETrhxjwxtoix.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETrivmdatmff.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETruouqqlkbc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETryjbntysid.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETsgtxrrqtdg.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETskaectooul.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETsmhwuwajlr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETsnbsuyxxwc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETssnyhbobsy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETsvmucriunp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETswpwvywnqu.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETsxxadlmbdp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETtmvppadtqc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETtnwxweeciq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETtrpepufnid.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETubalgtoxty.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETudlmvljgly.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETuefuarvhil.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETuiynorafjm.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETacqbxotjup.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETaihimbwrtw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETakbplyoilt.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbcjxyecbqn.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbdwfhqbwhp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbndjmqweyg.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbowxjyptbw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETboxntqntih.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbqtvyrsvnc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbtgfoydwmp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbwjokuygvh.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbwqvrxeiso.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbwwnotrbax.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETbyqwnxwasm.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcdijmjuxwb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcdonrnrtrg.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcmoelxnewx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcqmxfhqfnv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcqwkeefqko.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcrviwqqfni.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETcsmqacfkqx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETctcyxwvhhr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETddsfivqlcn.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETdgdnfmtuny.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETdqrdmbbjwi.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETekyfwbvjtc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETepsxctgidb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETesbhgfdtxy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETesqviarjxm.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETijxgnmcivi.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmjgebmafki.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpfhxjipomr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETunflnvfsdf.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETimotrfgbvs.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETjbpcrhyniv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETjcngaseuil.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETjpgmtfgggi.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkgqsvjwipr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkhslhbcgxw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkpxeyjxqop.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkrkpafomeq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkwlskocvow.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETkyraupfrlw.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETlcvdajyxhh.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETltcoftexil.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmegyvkqeei.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmeyhafvurq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmitqdrbcxo.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETunsurxovcy.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETupabjxxhyp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETurovmpljim.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETuydiubdhfv.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETuygcffgktd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETvcbakynqsk.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETvicfrxoupj.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETwdnoabvglx.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETwgjwtiinuo.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETwjncvefgej.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETwsnosyhbxn.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETwtacotcxnc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETxiqmylbeea.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETxtqqtoiqhp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETxvcdtebesb.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETydaecmsshr.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETyljlopohqp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETypaepisocq.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_172888438339.bk.old (Trojan.Downloader) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_34843820849.bk.old (Trojan.Downloader) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_482116482486.bk.old (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_6701453802.bk.old (Trojan.Downloader) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_728517101847.bk.old (Trojan.Downloader) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\tmp0_732455768556.bk.old (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\xdtjd6r8fyase45y5isss44.exe (Trojan.Downloader) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_227545745599.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_262056469407.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_341072147205.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_58595781066.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_635873492021.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_773245570571.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_785073403698.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_797343774174.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\txpxr_828302802795.b1k (Backdoor.Bot) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmqadqkpjio.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmrtkncpmsj.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETmutejjimyk.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETnciadrruyp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETnmvjryjfcp.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETnnautywtyf.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETodaujyakih.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNEToerhfhycms.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETofllkhfqpd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETomcuecjmkd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETontnvtmsfj.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETopqbdeyivi.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETowgyfpeopc.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETowiuuiuvop.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpbnpqfanmd.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\Temp\SKYNETpceotiecff.tmp (Trojan.TDSS) -> Quarantined and deleted successfully.c:\WINDOWS\system32\SKYNETkauwcdgm.dll (Trojan.Agent) -> Quarantined and deleted successfully.c:\WINDOWS\system32\SKYNETnpoxhraq.dll (Trojan.Agent) -> Quarantined and deleted successfully.c:\WINDOWS\system32\drivers\SKYNETayvomhcr.sys (Trojan.Agent) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
Fatdcuk Posted July 4, 2009 ID:95682 Share Posted July 4, 2009 Worked like a charm ok just need to see a couple more reports from the machine.STEP 01Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofixPlease ensure you read this guide carefully and install the Recovery Console first.NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the programAdditional links to download the tool:ComboFix.exeComboFix.exeComboFix.exehttp://www.forospyware.com/sUBs/ComboFix.exe' rel="external nofollow">Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.Once installed, you should see a blue screen prompt that says:The Recovery Console was successfully installed.Please continue as follows:Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Click Yes to allow ComboFix to continue scanning for malware.When the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
x111josh Posted July 4, 2009 Author ID:95709 Share Posted July 4, 2009 hi, every time i try to download combofix and install it, an error message appears saying that i may have not downloaded it from a proper source and it may have been tampered with :Sso as my computer is not running smoothly i would prefer not to try an unsure programme and damage my pc.thanks for all the help anyway you have been brilliant! Link to post Share on other sites More sharing options...
Fatdcuk Posted July 4, 2009 ID:95713 Share Posted July 4, 2009 Hi Josh please understand that thoes are the official links to ComboFix and our trustworthy download.There is more than a very high probability that malware is still active on your PC and causing the error messages inorder to steer you away fro running the tool!Please try to run combofix from safe mode,and if you really are'nt happy with this advice please post most recent HiJackThis log.Thanks in advance Link to post Share on other sites More sharing options...
x111josh Posted July 4, 2009 Author ID:95719 Share Posted July 4, 2009 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 00:00:12, on 05/07/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\lxdjcoms.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\Synaptics\SynTP\Toshiba.exeC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Toshiba\Toshiba Applet\thotkey.exeC:\WINDOWS\system32\TPSMain.exeC:\Program Files\TOSHIBA\ConfigFree\NDSTray.exeC:\Program Files\TOSHIBA\Tvs\TvsTray.exeC:\WINDOWS\system32\TPSBattM.exeC:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Lexmark 1400 Series\lxdjamon.exeC:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Windows Live\Contacts\wlcomm.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO1 - Hosts: 193.125.23.12 updates.sald.comO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)O2 - BHO: (no name) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - (no file)O2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exeO4 - HKLM\..\Run: [TPSMain] TPSMain.exeO4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exeO4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exeO4 - HKLM\..\Run: [TFncKy] TFncKy.exeO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [lxdjamon] "C:\Program Files\Lexmark 1400 Series\lxdjamon.exe"O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\wrfgs.exeO4 - HKLM\..\Run: [PerfectOptimizer] C:\Program Files\Perfect Optimizer\PerfectOptimizer.exeO4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exeO8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?95313124e5994561b0b22a57295b4caO8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?95313124e5994561b0b22a57295b4caO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdjserv.exeO23 - Service: lxdj_device - - C:\WINDOWS\system32\lxdjcoms.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe--End of file - 10293 bytes Link to post Share on other sites More sharing options...
Fatdcuk Posted July 5, 2009 ID:95791 Share Posted July 5, 2009 Hi ya Josh,Well just looking at your HJT log there is not anything that appears out of place.The only problem is HJT only looks in certain location where as ComboFix gives me data from other area's.First off have HiJackThis Fixcheck the following lines only.O1 - Hosts: 193.125.23.12 updates.sald.comO2 - BHO: (no name) - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - (no file)O2 - BHO: (no name) - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - (no file)O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)Please now rerun the RootRepeal hidden files scan and post back the log generated. Link to post Share on other sites More sharing options...
x111josh Posted July 5, 2009 Author ID:95800 Share Posted July 5, 2009 ok, i deleted the files you told me to, then ran RootRepeal hidden/locked file search and this is the report:ROOTREPEAL © AD, 2007-2009==================================================Scan Time: 2009/07/05 14:59Program Version: Version 1.3.0.0Windows Version: Windows XP Media Center Edition SP3==================================================Hidden/Locked Files-------------------Path: C:\hiberfil.sysStatus: Locked to the Windows API!Path: c:\documents and settings\josh's account\local settings\temp\etilqs_mp1bjsvmyhn3oadmw2bgStatus: Allocation size mismatch (API: 8192, Raw: 0)Path: c:\documents and settings\josh's account\local settings\temp\etilqs_nemzku02aycuousamf2cStatus: Allocation size mismatch (API: 32768, Raw: 0)Path: C:\Documents and Settings\Josh's Account\Local Settings\Apps\2.0\66B2YOAZ.LQL\JN01ZGEK.NHK\manifests\clickonce_bootstrap.exe.cdf-msStatus: Locked to the Windows API!Path: C:\Documents and Settings\Josh's Account\Local Settings\Apps\2.0\66B2YOAZ.LQL\JN01ZGEK.NHK\manifests\clickonce_bootstrap.exe.manifestStatus: Locked to the Windows API! Link to post Share on other sites More sharing options...
Fatdcuk Posted July 5, 2009 ID:95803 Share Posted July 5, 2009 Hi Josh,I do apologise but i did miss something suspicious in your HijackThis log, i saw it lastnight but forgot about it when i replied this morning.O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\wrfgs.exeI nned you to search your system32 folder to see if this file is present.If it is please can you zip it up and upload/attach to your next post. Link to post Share on other sites More sharing options...
x111josh Posted July 5, 2009 Author ID:95806 Share Posted July 5, 2009 I have found it and zipped it up... but I am unsure where it goes when zipped?also how do iI attach it to a post...thanks, Josh. Link to post Share on other sites More sharing options...
x111josh Posted July 5, 2009 Author ID:95807 Share Posted July 5, 2009 file:///C:/WINDOWS/system32/wrfgs.zipthere lol im an idiot found it straight away Link to post Share on other sites More sharing options...
Fatdcuk Posted July 5, 2009 ID:95814 Share Posted July 5, 2009 Nope its not uploaded unfortunetly,When you reply goto more options instead of fast reply,Underneath the text entry box look for browse option and select that.Navigate to the zipped file and select upload.Once upload is complete you then goto add reply to send the new post which will have the file uploaded attached Link to post Share on other sites More sharing options...
x111josh Posted July 5, 2009 Author ID:95822 Share Posted July 5, 2009 wrfgs.zipis that it?...wrfgs.zip Link to post Share on other sites More sharing options...
Fatdcuk Posted July 5, 2009 ID:95825 Share Posted July 5, 2009 Hi Josh,This is definetly looking like a suspect file,its packed with Armadillo packers which means it's a PITA for code analysis,1 thing is sure it's certainly behaving like malware on initial testing.I will be preparing attack defs for MBAM for this file and its legacy functions so what i will do is post back to this topic(in the next 12 hours) when the MBAM database has been updated to attack and remove it Link to post Share on other sites More sharing options...
x111josh Posted July 5, 2009 Author ID:95862 Share Posted July 5, 2009 ok thanks mate. Link to post Share on other sites More sharing options...
Fatdcuk Posted July 6, 2009 ID:95916 Share Posted July 6, 2009 Hi ya Josh,Please update MBAM and run a Quick scan and allow it to delete what it finds then reboot.Please post back the MBAM scan log and a fresh HJT log. Link to post Share on other sites More sharing options...
x111josh Posted July 6, 2009 Author ID:96078 Share Posted July 6, 2009 fresh HijackThis Log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 15:11:54, on 06/07/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\lxdjcoms.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\eHome\ehmsas.exeC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Toshiba\Toshiba Applet\thotkey.exeC:\WINDOWS\system32\TPSMain.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\TOSHIBA\ConfigFree\NDSTray.exeC:\Program Files\Synaptics\SynTP\Toshiba.exeC:\Program Files\TOSHIBA\Tvs\TvsTray.exeC:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\WINDOWS\system32\TPSBattM.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Lexmark 1400 Series\lxdjamon.exeC:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\Windows Live\Messenger\msnmsgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Spybot - Search & Destroy\TeaTimer.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\Malwarebytes' Anti-Malware\mbam.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exeO4 - HKLM\..\Run: [TPSMain] TPSMain.exeO4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exeO4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exeO4 - HKLM\..\Run: [TFncKy] TFncKy.exeO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [lxdjamon] "C:\Program Files\Lexmark 1400 Series\lxdjamon.exe"O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [PerfectOptimizer] C:\Program Files\Perfect Optimizer\PerfectOptimizer.exeO4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exeO8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?95313124e5994561b0b22a57295b4caO8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?95313124e5994561b0b22a57295b4caO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdjserv.exeO23 - Service: lxdj_device - - C:\WINDOWS\system32\lxdjcoms.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe--End of file - 9672 bytesAnd MBAM Log File:Malwarebytes' Anti-Malware 1.38Database version: 2379Windows 5.1.2600 Service Pack 306/07/2009 15:20:45mbam-log-2009-07-06 (15-20-45).txtScan type: Quick ScanObjects scanned: 98279Time elapsed: 7 minute(s), 56 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Fatdcuk Posted July 6, 2009 ID:96087 Share Posted July 6, 2009 Hi Josh,HijackThis is now showing clear of anything suspicious which is good.However i personally am not happy to give you the all clear without seeing ComboFix logs as it looks in a lot more places than HJT for suspect data/files etcI would strongly suggest giving ComboFix one more attempt. Delete the existing downloaded CF file and then repeat the original instructions for combofix.Thanks in advance. Link to post Share on other sites More sharing options...
x111josh Posted July 6, 2009 Author ID:96176 Share Posted July 6, 2009 ok, but just so you know i go on holiday early tomorrow.. so cant run the scans just yet.. although i will try soon as i am back in a week and hopefully post the reports then...just so you know Link to post Share on other sites More sharing options...
Fatdcuk Posted July 6, 2009 ID:96189 Share Posted July 6, 2009 Np Josh,Have a great break and post back when your ready to go again Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted July 14, 2009 Root Admin ID:98249 Share Posted July 14, 2009 Please post a status update on this. Thanks. Link to post Share on other sites More sharing options...
x111josh Posted July 16, 2009 Author ID:99310 Share Posted July 16, 2009 hi, just had time to run combofix and here is the report log:ComboFix 09-07-14.08 - Josh's Account 16/07/2009 11:35.1.2 - NTFSx86Microsoft Windows XP Professional 5.1.2600.3.1252.44.1033.18.1014.431 [GMT 1:00]Running from: c:\documents and settings\Josh's Account\My Documents\Downloads\ComboFix.exe.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\program files\IEToolbarc:\windows\blac5828.exec:\windows\Install.txtc:\windows\irc.txtc:\windows\kb913800.exec:\windows\system32\a9b9e352-c8bf-9c5b-0a1b-f9ed8b613bd3.exec:\windows\system32\fzijnpklimqhath.exe.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_MSNCACHE-------\Legacy_SOPIDKC((((((((((((((((((((((((( Files Created from 2009-06-16 to 2009-07-16 ))))))))))))))))))))))))))))))).2009-07-15 13:35 . 2009-07-15 13:35 -------- d-----w- c:\program files\Sky Broadband2009-07-05 14:58 . 2009-07-05 14:58 327163 ----a-w- c:\windows\system32\wrfgs.zip2009-07-04 19:48 . 2009-07-04 19:48 -------- d--h--w- c:\windows\PIF2009-07-04 17:26 . 2009-07-04 17:26 -------- d-----w- c:\program files\Trend Micro2009-07-03 13:30 . 2009-07-03 13:34 -------- d-----w- c:\program files\Windows Live Safety Center2009-07-02 23:44 . 2009-07-05 14:56 -------- d-----w- C:\Temp2009-07-02 10:54 . 2009-07-02 10:54 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\Malwarebytes2009-07-02 10:54 . 2009-06-17 10:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2009-07-02 10:54 . 2009-07-02 10:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes2009-07-02 10:54 . 2009-06-17 10:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys2009-07-02 10:54 . 2009-07-02 10:54 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware2009-06-30 19:54 . 2009-07-04 18:13 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP2009-06-26 13:13 . 2008-04-13 18:45 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys2009-06-26 13:13 . 2008-04-13 18:45 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys2009-06-25 15:30 . 2009-06-25 15:31 -------- d-----w- c:\program files\Common Files\3DO Shared2009-06-25 15:30 . 2009-06-25 15:31 -------- d-----w- c:\program files\3DO2009-06-23 20:49 . 2001-08-17 12:48 12160 -c--a-w- c:\windows\system32\dllcache\mouhid.sys2009-06-23 20:49 . 2001-08-17 12:48 12160 ----a-w- c:\windows\system32\drivers\mouhid.sys2009-06-23 20:49 . 2008-04-13 18:45 10368 -c--a-w- c:\windows\system32\dllcache\hidusb.sys2009-06-23 20:49 . 2008-04-13 18:45 10368 ----a-w- c:\windows\system32\drivers\hidusb.sys2009-06-22 17:05 . 2009-06-22 17:05 -------- d-----w- c:\documents and settings\Josh's Account\Local Settings\Application Data\Identities2009-06-22 10:53 . 2009-06-22 10:53 93 ----a-w- c:\windows\system32\SKYNET.dat.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2009-07-16 10:17 . 2009-05-28 17:11 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\LimeWire2009-07-15 23:16 . 2009-06-03 16:52 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\Apple Computer2009-07-15 21:11 . 2009-05-22 22:37 -------- d-----w- c:\program files\LG PC Suite II2009-07-04 21:27 . 2006-09-14 11:17 -------- d-----w- c:\program files\Common Files\Symantec Shared2009-07-04 21:27 . 2006-09-14 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec2009-07-04 17:11 . 2009-05-26 16:05 -------- d-----w- c:\program files\Lx_cats2009-06-09 21:23 . 2009-05-28 17:09 -------- d-----w- c:\program files\LimeWire2009-06-03 16:51 . 2009-06-03 16:49 -------- d-----w- c:\program files\iTunes2009-06-03 16:51 . 2009-06-03 16:49 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}2009-06-03 16:50 . 2009-06-03 16:50 -------- d-----w- c:\program files\iPod2009-06-03 16:49 . 2009-06-03 16:46 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer2009-06-03 16:48 . 2009-06-03 16:48 -------- d-----w- c:\program files\Bonjour2009-06-03 16:47 . 2009-06-03 16:46 -------- d-----w- c:\program files\QuickTime2009-06-03 16:45 . 2009-06-03 16:45 -------- d-----w- c:\program files\Apple Software Update2009-06-03 16:43 . 2009-06-03 16:43 -------- d-----w- c:\program files\Common Files\Apple2009-06-03 16:43 . 2009-06-03 16:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple2009-05-30 11:50 . 2009-05-30 11:50 75048 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 8.2.0.23\SetupAdmin.exe2009-05-29 12:09 . 2009-05-29 12:04 -------- d-----w- c:\program files\Spybot - Search & Destroy2009-05-29 12:08 . 2009-05-29 12:04 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy2009-05-28 11:21 . 2006-09-13 15:30 38848 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT2009-05-27 11:34 . 2009-05-27 11:31 112718508 ----a-w- c:\documents and settings\All Users\SPL31B.tmp2009-05-26 15:56 . 2009-05-26 15:53 -------- d-----w- c:\program files\Lexmark 1400 Series2009-05-24 18:10 . 2006-09-13 13:59 87479 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat2009-05-24 14:37 . 2009-05-24 14:37 -------- d-----w- c:\program files\Microsoft ActiveSync2009-05-23 15:15 . 2009-05-23 15:15 -------- d-----w- c:\program files\Windows Media Connect 22009-05-23 12:00 . 2009-05-23 12:00 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.22009-05-23 11:53 . 2009-05-23 11:53 -------- d-----w- c:\program files\MSXML 4.02009-05-22 22:39 . 2009-05-22 22:39 -------- d-----w- c:\program files\LG Electronics2009-05-22 22:39 . 2006-09-13 15:27 -------- d--h--w- c:\program files\InstallShield Installation Information2009-05-22 22:37 . 2009-05-22 22:37 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\LG Electronics2009-05-22 22:36 . 2009-05-22 22:36 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\InstallShield2009-05-22 16:05 . 2009-05-22 16:03 410984 ----a-w- c:\windows\system32\deploytk.dll2009-05-22 16:05 . 2006-09-13 14:35 -------- d-----w- c:\program files\Java2009-05-22 16:04 . 2009-05-22 16:02 152576 ----a-w- c:\documents and settings\Josh's Account\Application Data\Sun\Java\jre1.6.0_13\lzma.dll2009-05-22 15:14 . 2009-05-22 15:14 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!2009-05-22 15:06 . 2009-05-22 15:06 -------- d-----w- c:\program files\Messenger Plus! Live2009-05-22 01:11 . 2006-09-14 11:10 -------- d-----w- c:\program files\X10 Hardware2009-05-22 01:11 . 2006-09-13 13:55 -------- d-----w- c:\program files\Windows Plus2009-05-22 01:11 . 2006-09-14 12:05 -------- d-----w- c:\program files\Windows Desktop Search2009-05-22 01:10 . 2006-09-14 08:22 -------- d-----w- c:\program files\Synaptics2009-05-22 01:10 . 2006-09-14 10:05 -------- d-----w- c:\program files\Sonic2009-05-22 01:09 . 2006-09-14 08:24 -------- d-----w- c:\program files\Realtek2009-05-22 01:09 . 2006-09-14 12:03 -------- d-----w- c:\program files\MSN Toolbar Suite2009-05-22 01:09 . 2006-09-14 11:15 -------- d-----w- c:\program files\Microsoft.NET2009-05-22 01:08 . 2006-09-13 14:01 -------- d-----w- c:\program files\microsoft frontpage2009-05-22 01:08 . 2006-09-14 08:28 -------- d-----w- c:\program files\ltmoh2009-05-22 01:08 . 2006-09-14 09:58 -------- d-----w- c:\program files\InterVideo2009-05-22 01:07 . 2006-09-14 11:10 -------- d-----w- c:\program files\Common Files\X102009-05-22 01:06 . 2006-09-13 14:35 -------- d-----w- c:\program files\Common Files\Java2009-05-22 01:06 . 2006-09-14 10:04 -------- d-----w- c:\program files\Common Files\InterVideo2009-05-22 01:06 . 2006-09-13 14:06 -------- d-----w- c:\program files\Common Files\InstallShield2009-05-22 01:06 . 2006-09-14 11:06 -------- d-----w- c:\program files\Common Files\Adobe2009-05-22 00:59 . 2006-09-14 12:23 -------- d-----w- c:\documents and settings\LocalService\Application Data\X10 Commander2009-05-22 00:55 . 2009-05-21 17:59 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\Windows Desktop Search2009-05-22 00:55 . 2009-05-21 17:59 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\toshiba2009-05-22 00:55 . 2009-05-21 17:59 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\Sonic2009-05-22 00:55 . 2009-05-21 17:58 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Windows Desktop Search2009-05-22 00:55 . 2009-05-21 17:58 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\toshiba2009-05-22 00:55 . 2009-05-21 17:58 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Symantec2009-05-22 00:55 . 2009-05-21 17:58 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Sonic2009-05-22 00:55 . 2006-09-14 12:07 -------- d-----w- c:\documents and settings\Administrator\Application Data\Windows Desktop Search2009-05-22 00:55 . 2006-09-14 11:11 -------- d-----w- c:\documents and settings\Administrator\Application Data\Sonic2009-05-22 00:55 . 2006-09-14 09:57 -------- d-----w- c:\documents and settings\Administrator\Application Data\toshiba2009-05-21 18:25 . 2009-05-21 18:25 -------- d-----w- c:\program files\Microsoft2009-05-21 18:25 . 2009-05-21 18:25 -------- d-----w- c:\program files\Windows Live2009-05-21 18:25 . 2009-05-21 18:25 -------- d-----w- c:\program files\Windows Live SkyDrive2009-05-21 18:21 . 2009-05-21 18:21 -------- d-----w- c:\program files\Common Files\Windows Live2009-05-21 18:01 . 2009-05-21 18:01 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Intel2009-05-21 18:01 . 2009-05-21 18:01 -------- d-----w- c:\documents and settings\LocalService\Application Data\Intel2009-05-21 18:01 . 2009-05-21 18:01 -------- d-----w- c:\documents and settings\Josh's Account\Application Data\Intel2009-05-21 18:01 . 2009-05-21 18:01 -------- d-----w- c:\documents and settings\Administrator\Application Data\Intel2009-05-21 18:01 . 2009-05-21 18:01 21419 ----a-w- c:\windows\system32\drivers\AegisP.sys2009-05-21 18:01 . 2009-05-21 18:01 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Intel2009-05-21 18:00 . 2009-05-21 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Intel2009-05-21 18:00 . 2006-09-13 15:17 -------- d-----w- c:\program files\Intel2009-05-21 18:00 . 2009-05-21 18:00 0 --sha-r- c:\windows\system32\drivers\TOSHIBA_Satellite A100_04547-EN_PSAA8E-17X04.MRK2009-05-21 17:59 . 2006-09-14 07:46 -------- d-----w- c:\program files\Toshiba2009-05-07 15:32 . 2006-09-13 12:42 345600 ----a-w- c:\windows\system32\localspl.dll2009-04-29 04:46 . 2006-09-13 12:42 666624 ----a-w- c:\windows\system32\wininet.dll2009-04-29 04:46 . 2006-09-13 12:42 81920 ----a-w- c:\windows\system32\ieencode.dll2009-04-17 12:26 . 2006-09-13 12:42 1847168 ----a-w- c:\windows\system32\win32k.sys.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2005-04-11 65536]"Google Update"="c:\documents and settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-05-21 133104]"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-02-06 3885408]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-02 761948]"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-08-25 356352]"Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2006-02-02 73728]"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940]"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-08-01 802816]"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-08-01 696320]"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-22 148888]"lxdjamon"="c:\program files\Lexmark 1400 Series\lxdjamon.exe" [2007-04-30 20480]"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-12 118784]"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-05-30 292136]"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-05-05 16206848]"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2005-12-13 88204]"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-08-03 266240]"NDSTray.exe"="NDSTray.exe" [bU]"TFncKy"="TFncKy.exe" [bU]c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Desktop Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2006-3-26 257752][hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2006-03-13 233472][HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Messenger\\msmsgs.exe"="c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe"="c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="c:\\WINDOWS\\system32\\lxdjcoms.exe"="c:\\Program Files\\Lexmark 1400 Series\\App4R.exe"="c:\\Program Files\\Lexmark 1400 Series\\lxdjamon.exe"="c:\\WINDOWS\\system32\\lxdjcfg.exe"="c:\\Program Files\\LimeWire\\LimeWire.exe"="c:\\Program Files\\Bonjour\\mDNSResponder.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjpswx.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjjswx.exe"="c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\lxdjtime.exe"=R3 X10Hid;X10 Hid Device;c:\windows\system32\drivers\x10hid.sys [14/09/2006 12:10 7040]S2 lxdjCATSCustConnectService;lxdjCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\lxdjserv.exe [12/06/2007 00:17 99248].- - - - ORPHANS REMOVED - - - -HKLM-Run-PerfectOptimizer - c:\program files\Perfect Optimizer\PerfectOptimizer.exe.------- Supplementary Scan -------.uStart Page = hxxp://www.sky.comuInternet Settings,ProxyOverride = *.localuSearchURL,(Default) = hxxp://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRIE: &MSN Search - c:\program files\MSN Toolbar Suite\msntb.dll/search.htmIE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000IE: Open in new background tab - c:\program files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?95313124e5994561b0b22a57295b4caIE: Open in new foreground tab - c:\program files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?95313124e5994561b0b22a57295b4caIE: {{08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com.**************************************************************************catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2009-07-16 11:45Windows 5.1.2600 Service Pack 3 NTFSscanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************.--------------------- DLLs Loaded Under Running Processes ---------------------- - - - - - - > 'winlogon.exe'(880)c:\windows\system32\Ati2evxx.dll- - - - - - - > 'explorer.exe'(2808)c:\windows\system32\WPDShServiceObj.dllc:\windows\system32\TPwrCfg.DLLc:\windows\system32\TPwrReg.dllc:\windows\system32\TPSTrace.DLLc:\windows\system32\PortableDeviceTypes.dllc:\windows\system32\PortableDeviceApi.dll.------------------------ Other Running Processes ------------------------.c:\program files\Intel\Wireless\Bin\EvtEng.exec:\program files\Intel\Wireless\Bin\S24EvMon.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\program files\Bonjour\mDNSResponder.exec:\program files\Toshiba\ConfigFree\CFSvcs.exec:\windows\ehome\ehrecvr.exec:\windows\ehome\ehSched.exec:\program files\Java\jre6\bin\jqs.exec:\windows\system32\lxdjcoms.exec:\program files\Intel\Wireless\Bin\RegSrvc.exec:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exec:\progra~1\COMMON~1\X10\Common\X10nets.exec:\windows\ehome\mcrdsvc.exec:\windows\system32\dllhost.exec:\windows\system32\wscntfy.exec:\program files\Toshiba\ConfigFree\NDSTray.exec:\windows\ehome\ehmsas.exec:\program files\Synaptics\SynTP\Toshiba.exec:\windows\system32\TPSBattM.exec:\program files\iPod\bin\iPodService.exec:\program files\Intel\Wireless\Bin\Dot1XCfg.exe.**************************************************************************.Completion time: 2009-07-16 11:51 - machine was rebootedComboFix-quarantined-files.txt 2009-07-16 10:51Pre-Run: 60,797,706,240 bytes freePost-Run: 60,833,288,192 bytes freeWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect257 --- E O F --- 2009-07-04 18:52I also ran HijackThis and here is the log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:53:21, on 16/07/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\EvtEng.exeC:\Program Files\Intel\Wireless\Bin\S24EvMon.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeC:\WINDOWS\eHome\ehRecvr.exeC:\WINDOWS\eHome\ehSched.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\WINDOWS\system32\lxdjcoms.exeC:\Program Files\Intel\Wireless\Bin\RegSrvc.exeC:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeC:\PROGRA~1\COMMON~1\X10\Common\x10nets.exeC:\WINDOWS\system32\dllhost.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\ehome\ehtray.exeC:\WINDOWS\system32\igfxtray.exeC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\WINDOWS\RTHDCPL.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Toshiba\Toshiba Applet\thotkey.exeC:\WINDOWS\system32\TPSMain.exeC:\Program Files\TOSHIBA\ConfigFree\NDSTray.exeC:\WINDOWS\eHome\ehmsas.exeC:\Program Files\TOSHIBA\Tvs\TvsTray.exeC:\Program Files\Synaptics\SynTP\Toshiba.exeC:\WINDOWS\System32\DLA\DLACTRLW.EXEC:\Program Files\Intel\Wireless\bin\ZCfgSvc.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Intel\Wireless\Bin\ifrmewrk.exeC:\WINDOWS\system32\TPSBattM.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\Lexmark 1400 Series\lxdjamon.exeC:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\system32\wuauclt.exeC:\WINDOWS\explorer.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Chrome\Application\chrome.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sky.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.co.uk/0SEENGB/SAOS01?FORM=TOOLBRR1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.sky.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: dsWebAllowBHO Class - {2F85D76C-0569-466F-A488-493E6BD0E955} - C:\Program Files\Windows Desktop Search\dsWebAllow.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLLO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: MSN Search Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dllO2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllO3 - Toolbar: MSN Search Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Toolbar Suite\msntb.dllO4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exeO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exeO4 - HKLM\..\Run: [TPSMain] TPSMain.exeO4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exeO4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exeO4 - HKLM\..\Run: [TFncKy] TFncKy.exeO4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXEO4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/WirelessO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [lxdjamon] "C:\Program Files\Lexmark 1400 Series\lxdjamon.exe"O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exeO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exeO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Josh's Account\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exeO4 - Global Startup: Windows Desktop Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exeO8 - Extra context menu item: &MSN Search - res://C:\Program Files\MSN Toolbar Suite\msntb.dll/search.htmO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/229?95313124e5994561b0b22a57295b4caO8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\MSN Toolbar Suite\en-gb\msntabres.dll.mui/230?95313124e5994561b0b22a57295b4caO9 - Extra button: Sky - {08E730A4-FB02-45BD-A900-01E4AD8016F6} - http://www.sky.com (file missing)O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase1140.cabO23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exeO23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: lxdjCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdjserv.exeO23 - Service: lxdj_device - - C:\WINDOWS\system32\lxdjcoms.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exeO23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exeO23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exeO23 - Service: X10 Device Network Service (x10nets) - X10 - C:\PROGRA~1\COMMON~1\X10\Common\x10nets.exe--End of file - 9917 bytesif you want another log of something else i have missed just tell me Link to post Share on other sites More sharing options...
Fatdcuk Posted July 16, 2009 ID:99326 Share Posted July 16, 2009 Hi ya Josh,All is looking a lot better Any more issue's ? Link to post Share on other sites More sharing options...
Recommended Posts