Jump to content

Help w/leftover bug


Recommended Posts

Hi,

I recently removed a tojan from my computer, and noticed whenever I do a scan It shows I have

C:\WINDOWS\system32\Drivers\str.sys (Rootkit.Agent) left behind. I've restarted, and yet nothing happens, it doesn't get removed. If I could get some assistance on removing this I would appreciate it. I believe I have attached all the required files. I will wait on what to do next. :-)

DDS (Ver_09-12-01.01) - NTFSx86

Run by HP_Administrator at 1:50:49.46 on Sun 12/20/2009

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2691 [GMT -7:00]

AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}

AV: CA Anti-Virus *On-access scanning enabled* (Outdated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

FW: CA Personal Firewall *enabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe

C:\WINDOWS\system32\dllhost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe

C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\QuickTime\QTTask.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\HP_Administrator\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: PC Tools Browser Guard BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: PC Tools Browser Guard: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\spyware doctor\bdt\PCTBrowserDefender.dll

TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File

uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear

mRun: [cafwc] c:\program files\ca\ca internet security suite\ca personal firewall\cafw.exe -cl

mRun: [capfasem] c:\program files\ca\ca internet security suite\ca personal firewall\capfasem.exe

mRun: [capfupgrade] c:\program files\ca\ca internet security suite\ca personal firewall\capfupgrade.exe

mRun: [nwiz] nwiz.exe /install

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [KernelFaultCheck] c:\windows\system32\dumprep 0 -k

mRun: [CAVRID] "c:\program files\ca\etrust ez armor\etrust ez antivirus\CAVRID.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime

mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"

dRun: [calc] rundll32.exe c:\docume~1\locals~1\ntuser.dll,_IWMPEvents@0

uPolicies-system: EnableProfileQuota = 1 (0x1)

mPolicies-system: EnableLUA = 0 (0x0)

IE: &Search

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: c:\windows\system32\VetRedir.dll

Trusted Zone: trymedia.com

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlcm.cab

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=67633

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256005454166

DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - hxxp://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Notify: igfxcui - igfxdev.dll

Notify: PFW - UmxWnp.Dll

AppInit_DLLs: dasulelo.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

LSA: Authentication Packages = msv1_0 relog_ap

LSA: Notification Packages = scecli diveduha.dll

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\kjaqrh10.default\

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZKfox001(2)&fl=0&ptb=4afBF.FNrf8pnKueTkzVeQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=

FF - plugin: c:\documents and settings\hp_administrator\application data\mozilla\firefox\profiles\kjaqrh10.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\hp_administrator\application data\mozilla\plugins\npPxPlay.dll

FF - plugin: c:\program files\mozilla firefox\plugins\nppbss.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [2008-6-24 93712]

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-24 207792]

R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2008-6-24 63504]

R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2008-6-24 45584]

R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2008-6-24 115216]

R1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\vet-filt.sys [2008-3-26 26352]

R1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\vet-rec.sys [2008-3-26 21104]

R1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\vetefile.sys [2009-10-19 739696]

R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\vetfddnt.sys [2008-3-26 21488]

R1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2008-3-26 32240]

R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-5-12 611664]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\spyware doctor\bdt\BDTUpdateService.exe [2009-12-4 112592]

R2 CAISafe;CAISafe;c:\program files\ca\etrust ez armor\etrust ez antivirus\isafe.exe [2008-5-27 144960]

R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2008-6-24 134648]

R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2008-6-24 66576]

R2 UmxAgent;HIPS Event Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxAgent.exe [2007-10-18 1010192]

R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\ca\sharedcomponents\hipsengine\UmxCfg.exe [2007-10-18 801296]

R2 UmxPol;HIPS Policy Manager;c:\program files\ca\sharedcomponents\hipsengine\UmxPol.exe [2008-6-24 281104]

R2 WinDefend;Windows Defender;c:\program files\windows defender\MsMpEng.exe [2006-11-3 13592]

R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2008-6-24 88816]

R3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\veteboot.sys [2009-10-19 133520]

S0 uahgsyu;uahgsyu;c:\windows\system32\drivers\wuvt.sys --> c:\windows\system32\drivers\wuvt.sys [?]

S1 hxmvipne;hxmvipne;\??\c:\windows\system32\drivers\hxmvipne.sys --> c:\windows\system32\drivers\hxmvipne.sys [?]

S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\sasdifsv.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\saskutil.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASKUTIL.sys [?]

S1 xedfuwan;xedfuwan;\??\c:\windows\system32\drivers\xedfuwan.sys --> c:\windows\system32\drivers\xedfuwan.sys [?]

S2 hjzxg;hjzxg;c:\windows\system32\drivers\svprb.sys [2009-11-23 71424]

S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-3-6 12032]

S3 LycoFltr;Lycosa Keyboard;c:\windows\system32\drivers\lycosa.sys --> c:\windows\system32\drivers\Lycosa.sys [?]

S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-6-24 38224]

S3 PCD5SRVC{8A863ACB-F5F6CC6A-05010004};PCD5SRVC{8A863ACB-F5F6CC6A-05010004} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2006-5-10 21248]

S3 PPCtlPriv;PPCtlPriv; [x]

S3 SASENUM;SASENUM;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\sasenum.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASENUM.SYS [?]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-24 359624]

S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-6-24 1141712]

S3 SSDefrag;SSDefrag;c:\windows\system32\drivers\SSDefrag.sys [2009-10-13 34560]

S4 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [2007-4-15 2560]

S4 McrdSvc;Media Center Extender Service; [x]

S4 Mhnscamess80c8;Mhnscamess80c8; [x]

S4 VETMSGNT;VET Message Service;c:\program files\ca\etrust ez armor\etrust ez antivirus\vetmsg.exe [2009-9-17 238832]

S4 WUSB54GSCSVC;WUSB54GSCSVC; [x]

UnknownUnknown ijnkigfhagonyv;ijnkigfhagonyv; [x]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1

VBEFile=NOTEPAD.EXE %1

VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-12-20 08:34:52 20 ----a-w- c:\documents and settings\hp_administrator\defogger_reenable

2009-12-20 07:50:26 574 ----a-w- C:\cleanup.bat

2009-12-20 07:50:26 19286 ----a-w- C:\cleanup.exe

2009-12-20 07:50:26 135168 ----a-w- C:\zip.exe

2009-12-05 10:18:55 0 d-----w- c:\docume~1\hp_adm~1\applic~1\FreeFixer

2009-12-05 10:18:43 0 d-----w- c:\program files\FreeFixer

2009-12-04 20:31:34 767952 ----a-w- c:\windows\BDTSupport.dll

2009-12-04 20:31:33 882 ----a-w- c:\windows\RegSDImport.xml

2009-12-04 20:31:33 880 ----a-w- c:\windows\RegISSImport.xml

2009-12-04 20:31:33 149456 ----a-w- c:\windows\SGDetectionTool.dll

2009-12-04 20:31:33 131 ----a-w- c:\windows\IDB.zip

2009-12-04 20:31:32 165840 ----a-w- c:\windows\PCTBDRes.dll

2009-12-04 20:31:32 1640400 ----a-w- c:\windows\PCTBDCore.dll

2009-12-04 20:31:32 1152444 ----a-w- c:\windows\UDB.zip

2009-12-04 20:31:15 7387 ----a-w- c:\windows\system32\drivers\pctgntdi.cat

2009-12-04 20:31:04 7412 ----a-w- c:\windows\system32\drivers\PCTAppEvent.cat

2009-12-04 20:31:04 7383 ----a-w- c:\windows\system32\drivers\pctcore.cat

2009-12-04 20:30:55 7383 ----a-w- c:\windows\system32\drivers\pctplsg.cat

2009-12-04 20:26:35 0 d-----w- c:\program files\Free Window Registry Repair

2009-12-04 20:16:34 0 d-----w- c:\windows\system32\MpEngineStore

2009-12-04 09:43:41 0 d-----w- c:\program files\RegCleaner

2009-12-04 09:41:11 696832 ----a-w- c:\windows\isRS-000.tmp

2009-11-23 19:22:33 71424 ----a-w- c:\windows\system32\drivers\svprb.sys

2009-11-21 20:47:18 0 d-----w- c:\documents and settings\all users\57b4834

==================== Find3M ====================

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2

2009-12-20 08:40:07 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1

2009-12-20 08:40:07 463850 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0

2009-12-05 09:58:04 739696 ----a-w- c:\windows\system32\drivers\vetefile.sys

2009-12-05 09:58:04 32240 ----a-w- c:\windows\system32\drivers\vetmonnt.sys

2009-12-05 09:58:04 26352 ----a-w- c:\windows\system32\drivers\vet-filt.sys

2009-12-05 09:58:04 21488 ----a-w- c:\windows\system32\drivers\vetfddnt.sys

2009-12-05 09:58:04 21104 ----a-w- c:\windows\system32\drivers\vet-rec.sys

2009-12-05 09:58:04 133520 ----a-w- c:\windows\system32\drivers\veteboot.sys

2009-12-03 23:14:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-03 23:13:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-10 17:06:25 42952 ---ha-w- c:\windows\system32\mlfcache.dat

2009-11-09 18:20:12 207792 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2009-10-30 18:11:00 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2009-10-11 11:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-09-28 01:20:04 2173544 ----a-w- c:\windows\system32\nvcplui.exe

2009-09-28 01:20:00 81920 ----a-w- c:\windows\system32\nvwddi.dll

2009-09-28 01:19:52 3166208 ----a-w- c:\windows\system32\nvwss.dll

2009-09-28 01:19:50 4026368 ----a-w- c:\windows\system32\nvvitvs.dll

2009-09-28 01:19:48 3547136 ----a-w- c:\windows\system32\nvgames.dll

2009-09-28 01:19:48 188416 ----a-w- c:\windows\system32\nvmccss.dll

2009-09-28 01:19:48 1286144 ----a-w- c:\windows\system32\nvmobls.dll

2009-09-28 01:19:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

2009-09-28 01:19:46 4935680 ----a-w- c:\windows\system32\nvdisps.dll

2009-09-28 01:19:46 172100 ----a-w- c:\windows\system32\nvsvc32.exe

2009-09-28 01:19:46 143360 ----a-w- c:\windows\system32\nvcolor.exe

2009-09-28 01:19:46 13918208 ----a-w- c:\windows\system32\nvcpl.dll

2009-09-28 01:19:40 229376 ----a-w- c:\windows\system32\nvmccs.dll

2009-09-27 23:12:22 888832 ----a-w- c:\windows\system32\nvapi.dll

2009-09-27 23:12:22 7655872 ----a-w- c:\windows\system32\dllcache\nv4_mini.sys

2009-09-27 23:12:22 5900416 ----a-w- c:\windows\system32\nv4_disp.dll

2009-09-27 23:12:22 490088 ----a-w- c:\windows\system32\nvudisp.exe

2009-09-27 23:12:22 2194024 ----a-w- c:\windows\system32\nvcuvid.dll

2009-09-27 23:12:22 2007040 ----a-w- c:\windows\system32\nvcuda.dll

2009-09-27 23:12:22 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-09-27 23:12:22 170600 ----a-w- c:\windows\system32\nvcodins.dll

2009-09-27 23:12:22 170600 ----a-w- c:\windows\system32\nvcod.dll

2009-09-27 23:12:22 1604482 ----a-w- c:\windows\system32\nvdata.bin

2009-09-27 23:12:22 10756096 ----a-w- c:\windows\system32\nvoglnt.dll

2009-09-25 22:20:28 41872 ----a-w- c:\windows\system32\xfcodec.dll

2009-09-24 16:24:18 490088 ----a-w- c:\windows\system32\NVUNINST.EXE

2007-02-25 01:38:05 251 ----a-w- c:\program files\wt3d.ini

2007-08-17 21:35:52 8 --sh--r- c:\windows\system32\7DEDB14EE2.sys

2007-08-17 21:35:52 10856 --sha-w- c:\windows\system32\KGyGaAvL.sys

2007-08-10 23:58:04 777 --sha-w- c:\windows\system32\mmf.sys

2009-09-20 05:24:32 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009091920090920\index.dat

============= FINISH: 1:54:27.00 ===============

Attach.txt

ARK.txt

Link to post
Share on other sites

Hello colonelva

Welcome to Malwarebytes.

=====================

One or more of the identified infections is a backdoor trojan or rootkit.

This type of infection has the capabilities to allows hacker to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identity Theft, Internet Fraud and CC Fraud?

When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

Link to post
Share on other sites

Sure.

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Link to post
Share on other sites

Download Combofix from any of the links below. You must rename it before saving it. Rename it to kahdah then save it to your desktop.

Link 1

Link 2

--------------------------------------------------------------------

Double click on kahdah.exe & follow the prompts.

  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt

Link to post
Share on other sites

Found a link that worked, hopefully it's the right stuff

Start Time= Sun 12/20/2009 20:44:14.53

QuickScan did not find any signs of infected files

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2009-12-20 20:42:22 683 ( A.... ) "C:\Combo.bat"

2009-12-20 20:35:34 ( .D... ) "C:\Program Files\SUPERAntiSpyware"

2009-12-20 08:17:52 ( .D... ) "C:\Program Files\FileHippo.com"

2009-12-20 00:50:28 135168 ( A.... ) "C:\zip.exe"

2009-12-20 00:50:28 19286 ( A.... ) "C:\cleanup.exe"

2009-12-20 00:50:28 574 ( A.... ) "C:\cleanup.bat"

2009-12-05 18:33:10 ( .D... ) "C:\Program Files\Safari"

2009-12-05 03:18:56 ( .D... ) "C:\Documents and Settings\HP_Administrator\Application Data\FreeFixer"

2009-12-05 03:18:44 ( .D... ) "C:\Program Files\FreeFixer"

2009-12-05 02:16:36 ( .D... ) "C:\Program Files\Windows Defender"

2009-12-04 13:26:36 ( .D... ) "C:\Program Files\Free Window Registry Repair"

2009-12-04 13:10:24 ( .D... ) "C:\Program Files\Windows Live Safety Center"

2009-12-04 02:43:42 ( .D... ) "C:\Program Files\RegCleaner"

2009-11-10 10:28:16 149456 ( A.... ) "C:\WINDOWS\SGDetectionTool.dll"

2009-11-10 10:28:10 1640400 ( A.... ) "C:\WINDOWS\PCTBDCore.dll"

2009-11-10 10:28:10 165840 ( A.... ) "C:\WINDOWS\PCTBDRes.dll"

2009-11-10 10:26:26 767952 ( A.... ) "C:\WINDOWS\BDTSupport.dll"

2009-11-07 11:42:56 ( .D... ) "C:\Documents and Settings\HP_Administrator\Application Data\Google"

2009-11-05 09:36:22 26768832 ( A.... ) "C:\WINDOWS\system32\MRT.exe"

2009-11-02 14:32:52 ( .D... ) "C:\Program Files\Trend Micro"

2009-11-01 12:51:16 ( .D... ) "C:\Program Files\PC Drivers HeadQuarters"

2009-10-27 11:49:16 ( .D... ) "C:\Program Files\vso"

2009-10-21 14:26:52 ( .D... ) "C:\Program Files\Bonjour"

2009-10-11 04:17:34 149280 ( A.... ) "C:\WINDOWS\system32\javaws.exe"

2009-10-11 04:17:32 145184 ( A.... ) "C:\WINDOWS\system32\javaw.exe"

2009-10-11 04:17:32 145184 ( A.... ) "C:\WINDOWS\system32\java.exe"

2009-10-11 04:17:28 411368 ( A.... ) "C:\WINDOWS\system32\deploytk.dll"

2009-09-27 18:20:04 2173544 ( A.... ) "C:\WINDOWS\system32\nvcplui.exe"

2009-09-27 18:20:00 81920 ( A.... ) "C:\WINDOWS\system32\nvwddi.dll"

2009-09-27 18:19:52 3166208 ( A.... ) "C:\WINDOWS\system32\nvwss.dll"

2009-09-27 18:19:50 4026368 ( A.... ) "C:\WINDOWS\system32\nvvitvs.dll"

2009-09-27 18:19:48 3547136 ( A.... ) "C:\WINDOWS\system32\nvgames.dll"

2009-09-27 18:19:48 1286144 ( A.... ) "C:\WINDOWS\system32\nvmobls.dll"

2009-09-27 18:19:48 188416 ( A.... ) "C:\WINDOWS\system32\nvmccss.dll"

2009-09-27 18:19:46 13918208 ( A.... ) "C:\WINDOWS\system32\nvcpl.dll"

2009-09-27 18:19:46 4935680 ( A.... ) "C:\WINDOWS\system32\nvdisps.dll"

2009-09-27 18:19:46 172100 ( A.... ) "C:\WINDOWS\system32\nvsvc32.exe"

2009-09-27 18:19:46 143360 ( A.... ) "C:\WINDOWS\system32\nvcolor.exe"

2009-09-27 18:19:46 86016 ( A.... ) "C:\WINDOWS\system32\nvmctray.dll"

2009-09-27 18:19:40 229376 ( A.... ) "C:\WINDOWS\system32\nvmccs.dll"

2009-09-27 16:12:22 10756096 ( A.... ) "C:\WINDOWS\system32\nvoglnt.dll"

2009-09-27 16:12:22 5900416 ( A.... ) "C:\WINDOWS\system32\nv4_disp.dll"

2009-09-27 16:12:22 2194024 ( A.... ) "C:\WINDOWS\system32\nvcuvid.dll"

2009-09-27 16:12:22 2007040 ( A.... ) "C:\WINDOWS\system32\nvcuda.dll"

2009-09-27 16:12:22 1714792 ( A.... ) "C:\WINDOWS\system32\nvcuvenc.dll"

2009-09-27 16:12:22 888832 ( A.... ) "C:\WINDOWS\system32\nvapi.dll"

2009-09-27 16:12:22 490088 ( A.... ) "C:\WINDOWS\system32\nvudisp.exe"

2009-09-27 16:12:22 170600 ( A.... ) "C:\WINDOWS\system32\nvcodins.dll"

2009-09-27 16:12:22 170600 ( A.... ) "C:\WINDOWS\system32\nvcod.dll"

2009-09-25 15:20:28 41872 ( A.... ) "C:\WINDOWS\system32\xfcodec.dll"

2009-09-24 09:24:18 490088 ( A.... ) "C:\WINDOWS\system32\NVUNINST.EXE"

2007-02-24 18:38:06 251 ( A.... ) "C:\Program Files\wt3d.ini"

((((((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"cafwc"="C:\\Program Files\\CA\\CA Internet Security Suite\\CA Personal Firewall\\cafw.exe -cl"

"capfasem"="C:\\Program Files\\CA\\CA Internet Security Suite\\CA Personal Firewall\\capfasem.exe"

"capfupgrade"="C:\\Program Files\\CA\\CA Internet Security Suite\\CA Personal Firewall\\capfupgrade.exe"

"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup"

"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit"

"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre6\\bin\\jusched.exe\""

"CAVRID"="\"C:\\Program Files\\CA\\eTrust EZ Armor\\eTrust EZ Antivirus\\CAVRID.exe\""

"Windows Defender"="\"C:\\Program Files\\Windows Defender\\MSASCui.exe\" -hide"

"AppleSyncNotifier"="C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleSyncNotifier.exe"

"Adobe Reader Speed Launcher"="\"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe\""

"Adobe ARM"="\"C:\\Program Files\\Common Files\\Adobe\\ARM\\1.0\\AdobeARM.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]

"Installed"="1"

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]

"Installed"="1"

"NoChange"="1"

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

"Installed"="1"

@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]

"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]

"NVIDIA nTune"="\"C:\\Program Files\\NVIDIA Corporation\\nTune\\nTuneCmd.exe\" clear"

"FileHippo.com"="\"C:\\Program Files\\FileHippo.com\\UpdateChecker.exe\" /background"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run\AdobeUpdater]

@=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"EnableProfileQuota"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"calc"="rundll32.exe C:\\DOCUME~1\\LOCALS~1\\ntuser.dll,_IWMPEvents@0"

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]

"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]

"calc"="rundll32.exe C:\\DOCUME~1\\LOCALS~1\\ntuser.dll,_IWMPEvents@0"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]

"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]

"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"

"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

"{091EB208-39DD-417D-A5DD-7E2C2D8FB9CB}"="Microsoft AntiMalware ShellExecuteHook"

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^..]

"path"="C:\\Documents and Settings\\HP_Administrator\\Start Menu\\Programs\\Startup\\.."

"backup"="C:\\WINDOWS\\pss\\..Startup"

"location"="Startup"

"command"="C:\\Documents and Settings\\HP_Administrator\\Start Menu\\Programs\\Startup\\.."

"item"="."

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"=""

"hkey"="HKLM"

"command"=""

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="LinksysAgent"

"hkey"="HKCU"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="AOLSoftware"

"hkey"="HKLM"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="KHALMNPR"

"hkey"="HKLM"

"command"="KHALMNPR.EXE"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="msmsgs"

"hkey"="HKCU"

"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"=""

"hkey"="HKLM"

"command"=""

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="SMSystemAnalyzer"

"hkey"="HKLM"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="realsched"

"hkey"="HKLM"

"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="ca"

"hkey"="HKLM"

"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"PnkBstrB"=dword:00000002

"WMPNetworkSvc"=dword:00000003

"vsmon"=dword:00000002

"VETMSGNT"=dword:00000002

"PnkBstrA"=dword:00000002

"Pml Driver HPZ12"=dword:00000003

"ose"=dword:00000003

"NVSvc"=dword:00000002

"McrdSvc"=dword:00000002

"LightScribeService"=dword:00000002

"LicCtrlService"=dword:00000002

"iPod Service"=dword:00000003

"IDriverT"=dword:00000003

"IAANTMON"=dword:00000002

"ELService"=dword:00000002

"ehRecvr"=dword:00000002

"Diskeeper"=dword:00000002

"AOL ACS"=dword:00000002

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\AppleSoftwareUpdate.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

C:\WINDOWS\tasks\MP Scheduled Scan.job

Completion time: Sun 12/20/2009 20:48:53.60

ComboFix ver 06.06.17 - This logfile is located at C:\ComboFix.txt

Link to post
Share on other sites

Please do not run any other version of Combofix unless I or another helper give you the link.

These versions should not be available and will basically not fix anything or cause some machine damage.

I see that you have also used the Avenger that tool can cause some serious damage if used incorrectly.

Please do not proceed until I answer you.

Are you still up to date with CA Internet Security suite do you plan on keeping it?

Please remove Spyware Doctor if you haven't done so already.

If you want to go to something else that is free protection then I recommend Microsoft Security Essentials

============

Please disable all protection and do the following:

1. Please download The Avenger2 by Swandog46 to your Desktop.

  • Right click on the Avenger.zip folder and select "Extract All..."
  • Follow the prompts and extract the avenger folder to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
uahgsyu
hxmvipne
ijnkigfhagonyv

Files to delete:
c:\windows\system32\drivers\wuvt.sys
c:\windows\system32\drivers\hxmvipne.sys
C:\WINDOWS\system32\drivers\whcazqoonmob.sys
C:\WINDOWS\system32\drivers\str.sys
C:\DOCUME~1\LOCALS~1\ntuser.dll

Registry keys to delete:
HKLM\SYSTEM\ControlSet003\Services\gasfkywelnqueu
HKLM\SYSTEM\ControlSet001\Services\gasfkywelnqueu

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, open the avenger folder and start The Avenger program by clicking on its icon.

  • Right click on the window under Input script here:, and select Paste.
  • You can also Paste the text copied to the clipboard into this window by pressing (Ctrl+V), or click on the third button under the menu to paste it from the clipboard.
  • Click on Execute
  • Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:

[*]It will Restart your computer. ( In cases where the code to execute contains "Drivers to Delete" or "Drivers to Disable", The Avenger will actually restart your system twice.)

[*]On reboot, it will briefly open a black command window on your desktop, this is normal.

[*]After the restart, it creates a log file that should open with the results of Avenger

Link to post
Share on other sites

Ok thanks again for the replies. When I pasted and hit execute I got the following error message. C:\cleanup.exe

Windows cannot access the specified path / file you may no thave the appropriate permissions.

Then the system ran and shut down, only once mind you. Now when i go to the location for the txt folder nothing is there, no text. :-( Thanks for taking time to help me :-)

Link to post
Share on other sites

Ok do the following only for the programs that say access denied when try to run them:

Click Here and download this program.

Save it to the desktop.

Drag only the files that cannot be ran on to the program you just downloaded.

A box will popup and say ok.

Do the for the following files on your desktop drag combofix.exe into inherit.exe and it will say ok.

Also drag these files onto the inherit as well:

C:\zip.exe

C:\cleanup.exe

After that try to run Combofix again and post the log once it completes.

If combofix will not run then run the Avenger script once more that I gave you and then post that log.

Let me know how it goes.

Link to post
Share on other sites

I apologize for it taking so long, the GMER kept freezing up the comp :-).. Thank you for patiently waiting. Ill post the contents now.

DDS (Ver_09-12-01.01) - NTFSx86

Run by HP_Administrator at 14:58:49.73 on Tue 12/22/2009

Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_17

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2676 [GMT -7:00]

AV: CA Anti-Virus *On-access scanning enabled* (Outdated) {17CFD1EA-56CF-40B5-A06B-BD3A27397C93}

FW: CA Personal Firewall *enabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

svchost.exe

C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe

C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe

C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Bonjour\mDNSResponder.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe

C:\WINDOWS\eHome\ehSched.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\CDBurnerXP\NMSAccessU.exe

svchost.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\dllhost.exe

C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe

C:\WINDOWS\System32\svchost.exe -k HTTPFilter

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Documents and Settings\HP_Administrator\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page =

uSearch Bar = hxxp://www.google.com/ie

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {C4069E3A-68F1-403E-B40E-20066696354B} - No File

TB: {472734EA-242A-422B-ADF8-83D1E48CC825} - No File

uRun: [NVIDIA nTune] "c:\program files\nvidia corporation\ntune\nTuneCmd.exe" clear

uRun: [FileHippo.com] "c:\program files\filehippo.com\UpdateChecker.exe" /background

mRun: [cafwc] c:\program files\ca\ca internet security suite\ca personal firewall\cafw.exe -cl

mRun: [capfasem] c:\program files\ca\ca internet security suite\ca personal firewall\capfasem.exe

mRun: [capfupgrade] c:\program files\ca\ca internet security suite\ca personal firewall\capfupgrade.exe

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [sunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"

mRun: [CAVRID] "c:\program files\ca\etrust ez armor\etrust ez antivirus\CAVRID.exe"

mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide

mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

dRun: [calc] rundll32.exe c:\docume~1\locals~1\ntuser.dll,_IWMPEvents@0

uPolicies-system: EnableProfileQuota = 1 (0x1)

mPolicies-system: EnableLUA = 0 (0x0)

IE: &Search

IE: {E2D4D26B-0180-43a4-B05F-462D6D54C789} - c:\windows\pchealth\helpctr\vendors\cn=hewlett-packard,l=cupertino,s=ca,c=us\iebutton\support.htm

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll

LSP: c:\windows\system32\VetRedir.dll

Trusted Zone: trymedia.com

DPF: {01113300-3E00-11D2-8470-0060089874ED} - hxxp://supportcenter.rr.com/sdccommon/download/tgctlcm.cab

DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://go.microsoft.com/fwlink/?linkid=67633

DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab

DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll

DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase8942.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1256005454166

DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab

DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab

DPF: {B06CE1BC-5D9D-4676-BD28-1752DBF394E0} - hxxp://www.worldwinner.com/games/v41/hangman/hangman.cab

DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab

DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab

DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} - hxxp://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} - hxxp://www.creative.com/su2/CTL_V02002/ocx/15030/CTPID.cab

Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

Notify: igfxcui - igfxdev.dll

Notify: PFW - UmxWnp.Dll

AppInit_DLLs: dasulelo.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\wifd1f~1\MpShHook.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Authentication Packages = msv1_0 relog_ap

LSA: Notification Packages = scecli diveduha.dll

Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\hp_adm~1\applic~1\mozilla\firefox\profiles\kjaqrh10.default\

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZKfox001(2)&fl=0&ptb=4afBF.FNrf8pnKueTkzVeQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=

FF - plugin: c:\documents and settings\hp_administrator\application data\mozilla\firefox\profiles\kjaqrh10.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\hp_administrator\application data\mozilla\plugins\npPxPlay.dll

FF - plugin: c:\program files\mozilla firefox\plugins\nppbss.dll

FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll

FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}

FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);

============= SERVICES / DRIVERS ===============

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [2008-6-24 93712]

R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [2008-6-24 63504]

R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [2008-6-24 45584]

R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [2008-6-24 115216]

R1 VET-FILT;VET File System Filter;c:\windows\system32\drivers\vet-filt.sys [2008-3-26 26352]

R1 VET-REC;VET File System Recognizer;c:\windows\system32\drivers\vet-rec.sys [2008-3-26 21104]

R1 VETEFILE;VET File Scan Engine;c:\windows\system32\drivers\vetefile.sys [2009-10-19 739696]

R1 VETFDDNT;VET Floppy Boot Sector Monitor;c:\windows\system32\drivers\vetfddnt.sys [2008-3-26 21488]

R1 VETMONNT;VET File Monitor;c:\windows\system32\drivers\vetmonnt.sys [2008-3-26 32240]

R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [2008-6-24 134648]

R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [2008-6-24 66576]

R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [2008-6-24 88816]

R3 VETEBOOT;VET Boot Scan Engine;c:\windows\system32\drivers\veteboot.sys [2009-10-19 133520]

S0 gvnumtxh;gvnumtxh;c:\windows\system32\drivers\gmrpkdj.sys --> c:\windows\system32\drivers\gmrpkdj.sys [?]

S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\sasdifsv.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\saskutil.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASKUTIL.sys [?]

S1 xedfuwan;xedfuwan;\??\c:\windows\system32\drivers\xedfuwan.sys --> c:\windows\system32\drivers\xedfuwan.sys [?]

S2 hjzxg;hjzxg;c:\windows\system32\drivers\svprb.sys [2009-11-23 71424]

S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2008-3-6 12032]

S3 LycoFltr;Lycosa Keyboard;c:\windows\system32\drivers\lycosa.sys --> c:\windows\system32\drivers\Lycosa.sys [?]

S3 PCD5SRVC{8A863ACB-F5F6CC6A-05010004};PCD5SRVC{8A863ACB-F5F6CC6A-05010004} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\pc-doc~1\PCD5SRVC.pkms [2006-5-10 21248]

S3 SASENUM;SASENUM;\??\c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\sasenum.sys --> c:\docume~1\hp_adm~1\locals~1\temp\rar$ex00.016\SASENUM.SYS [?]

S3 SSDefrag;SSDefrag;c:\windows\system32\drivers\SSDefrag.sys [2009-10-13 34560]

S4 Mhnscamess80c8;Mhnscamess80c8; [x]

============== File Associations ===============

JSEFile=NOTEPAD.EXE %1

VBEFile=NOTEPAD.EXE %1

VBSFile=NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-12-21 19:43:32 498 ----a-w- C:\backup.reg

2009-12-21 03:35:33 0 d-----w- c:\program files\SUPERAntiSpyware

2009-12-20 15:17:51 0 d-----w- c:\program files\FileHippo.com

2009-12-20 08:34:52 20 ----a-w- c:\documents and settings\hp_administrator\defogger_reenable

2009-12-20 07:50:26 574 ----a-w- C:\cleanup.bat

2009-12-20 07:50:26 19286 ----a-w- C:\cleanup.exe

2009-12-20 07:50:26 135168 ----a-w- C:\zip.exe

2009-12-05 10:18:55 0 d-----w- c:\docume~1\hp_adm~1\applic~1\FreeFixer

2009-12-05 10:18:43 0 d-----w- c:\program files\FreeFixer

2009-12-04 20:26:35 0 d-----w- c:\program files\Free Window Registry Repair

2009-12-04 20:16:34 0 d-----w- c:\windows\system32\MpEngineStore

2009-12-04 09:43:41 0 d-----w- c:\program files\RegCleaner

2009-12-04 09:41:11 696832 ----a-w- c:\windows\isRS-000.tmp

2009-11-23 19:22:33 71424 ----a-w- c:\windows\system32\drivers\svprb.sys

==================== Find3M ====================

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2

2009-12-21 19:46:05 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1

2009-12-21 19:46:05 468410 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0

2009-12-05 09:58:04 739696 ----a-w- c:\windows\system32\drivers\vetefile.sys

2009-12-05 09:58:04 32240 ----a-w- c:\windows\system32\drivers\vetmonnt.sys

2009-12-05 09:58:04 26352 ----a-w- c:\windows\system32\drivers\vet-filt.sys

2009-12-05 09:58:04 21488 ----a-w- c:\windows\system32\drivers\vetfddnt.sys

2009-12-05 09:58:04 21104 ----a-w- c:\windows\system32\drivers\vet-rec.sys

2009-12-05 09:58:04 133520 ----a-w- c:\windows\system32\drivers\veteboot.sys

2009-12-03 23:14:06 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-03 23:13:56 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-11-10 17:06:25 42952 ---ha-w- c:\windows\system32\mlfcache.dat

2009-10-11 11:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-09-28 01:20:04 2173544 ----a-w- c:\windows\system32\nvcplui.exe

2009-09-28 01:20:00 81920 ----a-w- c:\windows\system32\nvwddi.dll

2009-09-28 01:19:52 3166208 ----a-w- c:\windows\system32\nvwss.dll

2009-09-28 01:19:50 4026368 ----a-w- c:\windows\system32\nvvitvs.dll

2009-09-28 01:19:48 3547136 ----a-w- c:\windows\system32\nvgames.dll

2009-09-28 01:19:48 188416 ----a-w- c:\windows\system32\nvmccss.dll

2009-09-28 01:19:48 1286144 ----a-w- c:\windows\system32\nvmobls.dll

2009-09-28 01:19:46 86016 ----a-w- c:\windows\system32\nvmctray.dll

2009-09-28 01:19:46 4935680 ----a-w- c:\windows\system32\nvdisps.dll

2009-09-28 01:19:46 172100 ----a-w- c:\windows\system32\nvsvc32.exe

2009-09-28 01:19:46 143360 ----a-w- c:\windows\system32\nvcolor.exe

2009-09-28 01:19:46 13918208 ----a-w- c:\windows\system32\nvcpl.dll

2009-09-28 01:19:40 229376 ----a-w- c:\windows\system32\nvmccs.dll

2009-09-27 23:12:22 888832 ----a-w- c:\windows\system32\nvapi.dll

2009-09-27 23:12:22 7655872 ----a-w- c:\windows\system32\dllcache\nv4_mini.sys

2009-09-27 23:12:22 5900416 ----a-w- c:\windows\system32\nv4_disp.dll

2009-09-27 23:12:22 490088 ----a-w- c:\windows\system32\nvudisp.exe

2009-09-27 23:12:22 2194024 ----a-w- c:\windows\system32\nvcuvid.dll

2009-09-27 23:12:22 2007040 ----a-w- c:\windows\system32\nvcuda.dll

2009-09-27 23:12:22 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-09-27 23:12:22 170600 ----a-w- c:\windows\system32\nvcodins.dll

2009-09-27 23:12:22 170600 ----a-w- c:\windows\system32\nvcod.dll

2009-09-27 23:12:22 1604482 ----a-w- c:\windows\system32\nvdata.bin

2009-09-27 23:12:22 10756096 ----a-w- c:\windows\system32\nvoglnt.dll

2009-09-25 22:20:28 41872 ----a-w- c:\windows\system32\xfcodec.dll

2009-09-24 16:24:18 490088 ----a-w- c:\windows\system32\NVUNINST.EXE

2007-02-25 01:38:05 251 ----a-w- c:\program files\wt3d.ini

2007-08-17 21:35:52 8 --sh--r- c:\windows\system32\7DEDB14EE2.sys

2007-08-17 21:35:52 10856 --sha-w- c:\windows\system32\KGyGaAvL.sys

2007-08-10 23:58:04 777 --sha-w- c:\windows\system32\mmf.sys

2009-09-20 05:24:32 32768 --sha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012009091920090920\index.dat

============= FINISH: 15:06:25.68 ===============

Ark.zip

Attach.zip

Link to post
Share on other sites

Ok I would still like to run Combofix.

Let's try this.

First make sure to disable Windows Defender and Ca Security Suite prior to doing the below even while downloading Combofix.

Delete the version you have of Combofix on your desktop and do the following:

If you do not know how then you can refer to this link:

http://www.bleepingcomputer.com/forums/topic114351.html

================

Then Download Combofix from any of the links below. You must rename it before saving it. Rename it to kahdah then save it to your desktop.

Link 1

Link 2

--------------------------------------------------------------------

Double click on kahdah.exe & follow the prompts.

  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt

If it doesn't work still then let me know.

Also let me know if you get any alerts from your protection suites.

Link to post
Share on other sites

Please save this file to your desktop. Click on Start->Run, and copy-paste the following command (the bolded text) into the "Open" box, and click OK. When it's finished, there will be a log called Win32kDiag.txt on your desktop. Please open it with notepad and post the contents here.

"%userprofile%\desktop\win32kdiag.exe" -f -r

Link to post
Share on other sites

Here you go. I know it's the holidays, so I completely understand if it takes longer to get back to me.. Hope you enjoy your holidays.. Ill be working :-)

Running from: C:\Documents and Settings\HP_Administrator\desktop\win32kdiag.exe

Log file at : C:\Documents and Settings\HP_Administrator\Desktop\Win32kDiag.txt

Removing all found mount points.

Attempting to reset file permissions.

WARNING: Could not get backup privileges!

Searching 'C:\WINDOWS'...

Finished!

Link to post
Share on other sites

I will be here everyday I am sure as I am addicted to removing malware :P

I hope you enjoy your holidays as well.

I think that CA security suite is blocking Combofix from running.

Please uninstall it before running Combofix once more.

Right click on the Ca icon in your system tray.

Choose Snooze Antivirus.

Then right click on it again then choose Snooze Antispyware.

Then download Combofix and then run it an follow the prompts post the log when it completes.

Link to post
Share on other sites

You my friend are a smart person :-).. Here's the log

Also when I tried removing CA it kept telling me I couldn't as only the administrator can do that, now the problem is I'm logged in to the administrator account :-(

ComboFix 09-12-23.02 - HP_Administrator 12/24/2009 2:58.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2858 [GMT -7:00]

Running from: c:\documents and settings\HP_Administrator\Desktop\kahdah.exe

FW: CA Personal Firewall *enabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\cleanup.exe

C:\LOG.TXT

c:\windows\kb913800.exe

D:\Autorun.inf

c:\windows\system32\proquota.exe . . . is missing!!

.

((((((((((((((((((((((((( Files Created from 2009-11-24 to 2009-12-24 )))))))))))))))))))))))))))))))

.

2009-12-21 19:43 . 2009-12-21 19:43 498 ----a-w- C:\backup.reg

2009-12-21 03:35 . 2009-12-21 03:35 -------- d-----w- c:\program files\SUPERAntiSpyware

2009-12-20 15:17 . 2009-12-20 15:17 -------- d-----w- c:\program files\FileHippo.com

2009-12-20 07:50 . 2009-12-21 19:43 574 ----a-w- C:\cleanup.bat

2009-12-20 07:50 . 2009-12-21 19:43 135168 ----a-w- C:\zip.exe

2009-12-06 01:33 . 2009-12-06 01:33 -------- d-----w- c:\program files\Safari

2009-12-05 10:20 . 2009-12-05 10:20 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\Threat Expert

2009-12-05 10:18 . 2009-12-05 10:39 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\FreeFixer

2009-12-05 10:18 . 2009-12-05 10:18 -------- d-----w- c:\documents and settings\HP_Administrator\Local Settings\Application Data\FreeFixer

2009-12-05 10:18 . 2009-12-05 10:18 -------- d-----w- c:\program files\FreeFixer

2009-12-05 09:16 . 2009-12-05 09:16 -------- d-----w- c:\program files\Windows Defender

2009-12-04 20:26 . 2009-12-04 20:26 -------- d-----w- c:\program files\Free Window Registry Repair

2009-12-04 20:16 . 2009-12-04 20:16 -------- d-----w- c:\windows\system32\MpEngineStore

2009-12-04 20:10 . 2009-12-04 20:37 -------- d-----w- c:\program files\Windows Live Safety Center

2009-12-04 09:43 . 2009-12-04 09:55 -------- d-----w- c:\program files\RegCleaner

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k7

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k6

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k5

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k4

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k3

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k2

2009-12-24 10:04 . 2008-04-02 02:39 64 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k1

2009-12-24 10:04 . 2008-04-02 02:39 474016 ----a-w- c:\windows\system32\drivers\kmxcfg.u2k0

2009-12-24 09:50 . 2007-02-19 23:56 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2009-12-23 00:18 . 2008-10-16 09:29 -------- d-----w- c:\program files\Common Files\Apple

2009-12-23 00:18 . 2007-11-15 20:59 -------- d-----w- c:\program files\iTunes

2009-12-23 00:17 . 2007-11-15 20:59 -------- d-----w- c:\program files\iPod

2009-12-21 03:32 . 2007-11-15 20:58 -------- d-----w- c:\program files\QuickTime

2009-12-21 03:31 . 2007-02-25 20:26 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard

2009-12-20 15:29 . 2007-08-09 22:26 -------- d-----w- c:\program files\Common Files\Adobe

2009-12-20 15:10 . 2009-10-13 17:28 -------- d-----w- c:\program files\Opera

2009-12-20 00:54 . 2007-10-30 21:05 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Azureus

2009-12-19 23:24 . 2009-12-19 23:24 8677824 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Azureus\tmp\AZU1977490612147678376.tmp\Vuze_4.3.0.6b_win32.exe

2009-12-16 15:20 . 2008-04-25 20:55 -------- d-----w- c:\program files\World of Warcraft

2009-12-07 20:04 . 2009-12-07 20:04 593920 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\pmv305hw-0910190-0-main.dll

2009-12-07 20:04 . 2009-12-07 20:04 319488 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\octoshape\octoshape.exe

2009-12-07 19:51 . 2007-03-24 23:41 -------- d-----w- c:\documents and settings\HP_Administrator\Application Data\Apple Computer

2009-12-06 01:31 . 2009-12-06 01:31 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.31.21.10\SetupAdmin.exe

2009-12-04 10:16 . 2009-06-24 07:39 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2009-12-04 09:41 . 2009-12-04 09:41 696832 ----a-w- c:\windows\isRS-000.tmp

2009-12-03 23:14 . 2009-06-24 07:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2009-12-03 23:13 . 2009-06-24 07:39 19160 ----a-w- c:\windows\system32\drivers\mbam.sys

2009-12-02 14:48 . 2009-01-07 03:26 -------- d-----w- c:\program files\Google

2009-11-27 02:52 . 2006-09-01 14:55 -------- d-----w- c:\program files\Java

2009-11-27 02:52 . 2009-11-27 02:52 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll

2009-11-27 02:52 . 2009-11-27 02:52 79488 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll

2009-11-23 19:22 . 2009-11-23 19:22 71424 ----a-w- c:\windows\system32\drivers\svprb.sys

2009-11-10 17:06 . 2008-02-19 10:43 42952 ---ha-w- c:\windows\system32\mlfcache.dat

2009-11-02 23:42 . 2009-11-02 23:42 4045528 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe

2009-11-02 21:32 . 2009-11-02 21:32 -------- d-----w- c:\program files\Trend Micro

2009-11-01 20:18 . 2008-02-08 03:18 -------- d-----w- c:\program files\Azureus

2009-11-01 19:52 . 2009-11-01 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\UAB

2009-11-01 19:52 . 2009-11-01 19:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters

2009-11-01 19:51 . 2009-11-01 19:51 -------- d-----w- c:\program files\PC Drivers HeadQuarters

2009-10-27 18:49 . 2009-10-27 18:49 -------- d-----w- c:\program files\vso

2009-10-17 04:26 . 2009-08-31 16:08 152576 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Sun\Java\jre1.6.0_16\lzma.dll

2009-10-14 00:58 . 2009-10-14 00:39 34560 ----a-w- c:\windows\system32\drivers\SSDefrag.sys

2009-10-14 00:10 . 2009-10-14 00:10 10686001 ----a-w- c:\documents and settings\HP_Administrator\Application Data\Azureus\plugins\azump\mplayer.exe

2009-10-11 11:17 . 2009-06-01 04:09 411368 ----a-w- c:\windows\system32\deploytk.dll

2009-09-28 01:20 . 2009-09-28 01:20 2173544 ----a-w- c:\windows\system32\nvcplui.exe

2009-09-28 01:20 . 2009-09-28 01:20 81920 ----a-w- c:\windows\system32\nvwddi.dll

2009-09-28 01:19 . 2009-09-28 01:19 3166208 ----a-w- c:\windows\system32\nvwss.dll

2009-09-28 01:19 . 2009-09-28 01:19 4026368 ----a-w- c:\windows\system32\nvvitvs.dll

2009-09-28 01:19 . 2009-09-28 01:19 3547136 ----a-w- c:\windows\system32\nvgames.dll

2009-09-28 01:19 . 2009-09-28 01:19 188416 ----a-w- c:\windows\system32\nvmccss.dll

2009-09-28 01:19 . 2009-09-28 01:19 1286144 ----a-w- c:\windows\system32\nvmobls.dll

2009-09-28 01:19 . 2009-09-28 01:19 86016 ----a-w- c:\windows\system32\nvmctray.dll

2009-09-28 01:19 . 2009-09-28 01:19 4935680 ----a-w- c:\windows\system32\nvdisps.dll

2009-09-28 01:19 . 2009-09-28 01:19 172100 ----a-w- c:\windows\system32\nvsvc32.exe

2009-09-28 01:19 . 2009-09-28 01:19 143360 ----a-w- c:\windows\system32\nvcolor.exe

2009-09-28 01:19 . 2009-09-28 01:19 13918208 ----a-w- c:\windows\system32\nvcpl.dll

2009-09-28 01:19 . 2009-09-28 01:19 229376 ----a-w- c:\windows\system32\nvmccs.dll

2009-09-27 23:12 . 2009-08-17 07:57 2194024 ----a-w- c:\windows\system32\nvcuvid.dll

2009-09-27 23:12 . 2009-08-17 07:57 1714792 ----a-w- c:\windows\system32\nvcuvenc.dll

2009-09-27 23:12 . 2009-08-17 07:57 1604482 ----a-w- c:\windows\system32\nvdata.bin

2009-09-27 23:12 . 2008-02-09 19:53 490088 ----a-w- c:\windows\system32\nvudisp.exe

2009-09-27 23:12 . 2007-12-05 08:41 2007040 ----a-w- c:\windows\system32\nvcuda.dll

2009-09-27 23:12 . 2007-10-11 20:53 10756096 ----a-w- c:\windows\system32\nvoglnt.dll

2009-09-27 23:12 . 2007-10-11 20:53 888832 ----a-w- c:\windows\system32\nvapi.dll

2009-09-27 23:12 . 2007-10-11 20:53 170600 ----a-w- c:\windows\system32\nvcodins.dll

2009-09-27 23:12 . 2007-10-11 20:53 170600 ----a-w- c:\windows\system32\nvcod.dll

2009-09-27 23:12 . 2006-08-30 17:51 7655872 ----a-w- c:\windows\system32\drivers\nv4_mini.sys

2009-09-27 23:12 . 2006-08-30 17:51 5900416 ----a-w- c:\windows\system32\nv4_disp.dll

2009-09-25 22:20 . 2009-09-25 22:20 41872 ----a-w- c:\windows\system32\xfcodec.dll

2007-02-25 01:38 . 2007-02-25 01:38 251 ----a-w- c:\program files\wt3d.ini

2007-08-17 21:35 . 2007-08-17 21:35 8 --sh--r- c:\windows\system32\7DEDB14EE2.sys

2007-08-17 21:35 . 2007-08-17 18:31 10856 --sha-w- c:\windows\system32\KGyGaAvL.sys

2007-08-10 23:58 . 2007-04-16 06:17 777 --sha-w- c:\windows\system32\mmf.sys

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NVIDIA nTune"="c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-07-03 81920]

"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2009-11-02 155648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"cafwc"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-09-11 1193200]

"capfasem"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-09-11 173296]

"capfupgrade"="c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-09-11 259312]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-28 13918208]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-28 86016]

"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2006-11-04 866584]

"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-08-13 177440]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 21:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]

2007-05-18 20:30 79368 ----a-w- c:\windows\system32\UmxWNP.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0autocheck lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]

@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]

@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^..]

path=c:\documents and settings\HP_Administrator\Start Menu\Programs\Startup\..

backup=c:\windows\pss\..Startup

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EasyLinkAdvisor

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMSystemAnalyzer

HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]

2007-04-11 22:32 56080 ----a-w- c:\windows\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]

2006-09-01 15:18 180269 ----a-w- c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]

"PnkBstrB"=2 (0x2)

"WMPNetworkSvc"=3 (0x3)

"vsmon"=2 (0x2)

"VETMSGNT"=2 (0x2)

"PnkBstrA"=2 (0x2)

"Pml Driver HPZ12"=3 (0x3)

"ose"=3 (0x3)

"NVSvc"=2 (0x2)

"McrdSvc"=2 (0x2)

"LightScribeService"=2 (0x2)

"LicCtrlService"=2 (0x2)

"iPod Service"=3 (0x3)

"IDriverT"=3 (0x3)

"IAANTMON"=2 (0x2)

"ELService"=2 (0x2)

"ehRecvr"=2 (0x2)

"Diskeeper"=2 (0x2)

"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\DISC\\DISCover.exe"=

"c:\\Program Files\\DISC\\DiscStreamHub.exe"=

"c:\\Program Files\\DISC\\myFTP.exe"=

"c:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=

"c:\\Program Files\\Xfire\\xfire.exe"=

"c:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

R0 KmxStart;KmxStart;c:\windows\system32\drivers\KmxStart.sys [6/24/2008 7:08 PM 93712]

R1 KmxAgent;KmxAgent;c:\windows\system32\drivers\KmxAgent.sys [6/24/2008 7:08 PM 63504]

R1 KmxFile;KmxFile;c:\windows\system32\drivers\KmxFile.sys [6/24/2008 7:08 PM 45584]

R1 KmxFw;KmxFw;c:\windows\system32\drivers\KmxFw.sys [6/24/2008 7:08 PM 115216]

R2 KmxCF;KmxCF;c:\windows\system32\drivers\KmxCF.sys [6/24/2008 7:08 PM 134648]

R2 KmxSbx;KmxSbx;c:\windows\system32\drivers\KmxSbx.sys [6/24/2008 7:08 PM 66576]

R2 UmxAgent;HIPS Event Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [10/18/2007 10:24 AM 1010192]

R2 UmxCfg;HIPS Configuration Interpreter;c:\program files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [10/18/2007 10:24 AM 801296]

R2 UmxPol;HIPS Policy Manager;c:\program files\CA\SharedComponents\HIPSEngine\UmxPol.exe [6/24/2008 7:10 PM 281104]

R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]

R3 KmxCfg;KmxCfg;c:\windows\system32\drivers\KmxCfg.sys [6/24/2008 7:08 PM 88816]

S0 gvnumtxh;gvnumtxh;c:\windows\system32\drivers\gmrpkdj.sys --> c:\windows\system32\drivers\gmrpkdj.sys [?]

S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASDIFSV.SYS --> c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASKUTIL.sys --> c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASKUTIL.sys [?]

S1 xedfuwan;xedfuwan;\??\c:\windows\system32\drivers\xedfuwan.sys --> c:\windows\system32\drivers\xedfuwan.sys [?]

S2 hjzxg;hjzxg;c:\windows\system32\drivers\svprb.sys [11/23/2009 12:22 PM 71424]

S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [3/6/2008 5:27 PM 12032]

S3 LycoFltr;Lycosa Keyboard;c:\windows\system32\Drivers\Lycosa.sys --> c:\windows\system32\Drivers\Lycosa.sys [?]

S3 PCD5SRVC{8A863ACB-F5F6CC6A-05010004};PCD5SRVC{8A863ACB-F5F6CC6A-05010004} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [5/10/2006 10:26 PM 21248]

S3 PPCtlPriv;PPCtlPriv; [x]

S3 SASENUM;SASENUM;\??\c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASENUM.SYS --> c:\docume~1\HP_ADM~1\LOCALS~1\Temp\Rar$EX00.016\SASENUM.SYS [?]

S3 SSDefrag;SSDefrag;c:\windows\system32\drivers\SSDefrag.sys [10/13/2009 5:39 PM 34560]

S4 LicCtrlService;LicCtrl Service;c:\windows\Runservice.exe [4/15/2007 11:17 PM 2560]

S4 Mhnscamess80c8;Mhnscamess80c8; [x]

S4 sptd;sptd;c:\windows\system32\drivers\sptd.sys [10/26/2007 7:36 AM 685816]

S4 WUSB54GSCSVC;WUSB54GSCSVC; [x]

.

------- Supplementary Scan -------

.

uStart Page =

uDefault_Search_URL = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Search

Trusted Zone: trymedia.com

DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}

FF - ProfilePath - c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\kjaqrh10.default\

FF - prefs.js: browser.startup.homepage - hxxp://espn.go.com/

FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZKfox001(2)&fl=0&ptb=4afBF.FNrf8pnKueTkzVeQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=

FF - plugin: c:\documents and settings\HP_Administrator\Application Data\Mozilla\Firefox\Profiles\kjaqrh10.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll

FF - plugin: c:\documents and settings\HP_Administrator\Application Data\Mozilla\plugins\npPxPlay.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\nppbss.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

---- FIREFOX POLICIES ----

FF - user.js: yahoo.homepage.dontask - true.

.

------- File Associations -------

.

JSEFile=NOTEPAD.EXE %1

.

- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-calc - c:\docume~1\LOCALS~1\ntuser.dll

Notify-WgaLogon - (no file)

MSConfigStartUp-MSMSGS - c:\program files\Messenger\msmsgs.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-12-24 03:07

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PCD5SRVC{8A863ACB-F5F6CC6A-05010004}]

"ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-54860643-1052671022-2426306396-1007\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-54860643-1052671022-2426306396-1007\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]

"??"=hex:c8,cb,12,45,27,de,cb,f1,7a,71,2f,7a,01,4e,b2,c4,7d,c4,33,36,f9,38,0e,

a6,de,45,0e,8c,df,f0,48,0d,ff,0e,21,0a,fd,ed,42,d9,31,15,13,06,0c,be,4c,89,\

"??"=hex:49,55,85,ec,08,2e,fb,c9,f1,32,f3,10,ca,dd,8d,b4

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222]

"1"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,c9,e0,20,43,a1,23,f2,

e3

"2"=hex:f1,df,16,de,80,08,0e,2a,78,a4,28,cb,d2,56,ff,58,ba,e9,e0,76,1f,5b,ab,

75

"3"=hex:b0,cd,e0,26,42,20,9e,7c,08,f1,c1,23,e7,41,66,ec,2b,92,4b,0d,22,14,9d,

cb,e3,f8,73,90,7d,a4,36,0d,f2,c9,99,66,1f,10,89,7d,ec,36,ce,6f,e7,65,ad,a4

[HKEY_LOCAL_MACHINE\software\LicCtrl\LicCtrl\LicCtrl\LicCtrl*lkzs$i&y@^t! #^$ g9^$&pgb SDB36o \EC1A69D1C0948222\F347AA9A592B216D597E028785020CD4]

"1"=hex:97,5e,49,d3,7c,a0,18,18,10,c9,e3,e3,c1,ae,57,ed,60,42,a5,db,24,eb,e2,

b0,0d,ef,4b,fc,af,c2,2e,ad

"2"=hex:39,fe,26,35,13,14,2d,2b,4e,eb,53,c5,fe,f3,ac,1b

"3"=hex:96,51,61,2b,93,60,6a,27,2f,77,5c,89,45,5a,16,81,3a,ed,5c,9f,3a,12,24,

f7,48,56,af,5f,6f,ec,c5,b3,a3,51,c5,f3,17,a4,70,2b,d6,f3,30,e3,42,6b,11,89,\

"4"=hex:2f,ad,a2,e7,8a,bf,05,5e

"5"=hex:bf,e5,23,7b,b0,66,d6,fc,b8,e8,6b,a0,96,52,f7,32,80,09,8f,24,b7,b3,55,

1a,98,d1,47,16,02,43,61,1c,b9,d5,8f,2a,7b,81,b1,fb,95,22,f8,b3,2c,53,9d,ae,\

"6"=hex:bf,e5,23,7b,b0,66,d6,fc,bc,64,22,fb,7e,d3,39,3e,a3,00,33,13,c0,21,f4,

51,6c,4e,0c,96,e2,dd,ad,8a,b6,c4,05,e8,5a,bd,9a,e9,d4,1a,3d,68,9d,00,32,20

"7"=hex:6b,96,68,24,0f,2f,9e,94,e8,ce,54,f3,3b,80,63,3a,1b,c3,e7,ed,44,3a,1d,

97,49,3e,e5,49,ef,df,ad,a2

"8"=hex:9d,9e,b2,b9,a7,a5,f4,ae,4d,29,c2,a3,c0,78,c4,c5,73,7e,45,c6,9f,9e,10,

63,a0,2f,06,c2,a3,e9,62,70,90,4c,ec,d6,92,e1,28,ba,e5,5d,0d,25,ef,fb,b7,21,\

"9"=hex:81,20,8f,ab,28,6a,52,9c

"18"=hex:70,56,26,33,e3,20,f8,ab

"10"=hex:8a,86,86,9a,b4,43,5e,10

"11"=hex:81,20,8f,ab,28,6a,52,9c

"12"=hex:81,20,8f,ab,28,6a,52,9c

"13"=hex:81,20,8f,ab,28,6a,52,9c

"14"=hex:81,20,8f,ab,28,6a,52,9c

"24"=hex:81,20,8f,ab,28,6a,52,9c

"26"=hex:81,20,8f,ab,28,6a,52,9c

"27"=hex:81,20,8f,ab,28,6a,52,9c

"19"=hex:81,20,8f,ab,28,6a,52,9c

"22"=hex:81,20,8f,ab,28,6a,52,9c

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]

"OODEFRAG10.00.00.01WORKSTATION"="FE88919D7E158B922DB99020D2077286374C17553329DC03FA87346C26CD9F2454C314397DF

5D743BC9775753A27DA0FEFDAA5BEFA984780AAF78B6C04A4128E7309CD33CD9AB14075C87A9A29C

D

540AEA5A4643700423F218CCDFF54C2D9E99D4094990836901FB2876C8B0DDE53393F285E73F1AFE

D

746A7F87DC4EC3EDE1D978A538892FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEB

C

9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D213B5559DB7

C

E019D40AA5C5D575E7D6A3B980874D264AD987C2AFC8486A16B834558DC0846CEAAC580A22C54825

9

735A8DE740F9C760061A85EC12395AF2ABDBDB8447D15C170DE3857B5D1702AC9C253DE556D75795

9

45350AAFC999935FEBF7DF2B8201DB94F8BE553EBC2C33A0F2A82D76D9A01A417AEBF5705767378D

A

6F1193FD260AD141F1A635CE913BCA923126884720C9A26EA97D1752F21EBDD83C3F8B4B6EA8EFD5

D

D13E3E111DE9A92163176061AB8991E557449718650FBB60E7433B6D50395242AB854632428D89E4

A

F453B392D804CF56D5FAD5FD489B56DCE2183A8C263B65C5E930F67F162B6BD003073DE03B55D166

9

4F0D3F8C67D3EB8FD79B4972349F9B4BDD5A5AD2DA7D04232AAF0B5F1F192526A22A4698FEF98C30

1

CBE7CE1221E48E8CD5580C715B4BCB9E8D059395B2A77CD13A66196A3C32B367B77ADF89164CFD75

7

561CCEF4578AB28B2905042634C598C1899A4261AFCD1739A77CB2AECFBC25AAFF174B55B1E3970C

F

129816C7DAF29ED0A57892B8107FA9844CE69362E13062B0215E5583A4D95F4FE769361254E4CEAA

D

05B043AA3AB533ACBDA6BA4112CF65AEB38661B168B9FD05616496D5FE12A224AE353B4965E7E332

D

A35C5841B3C5C13103837224DD212608C57AF643AE8065247DDCB0EBB0FA1D091113924CD4C0B134

9

34A4CA0F516D40773FB3DEDA5E6D852E802AE48D25FD8DF49C2DE32341FA61C16DE61060A7698456

C

FEC76FB2B3942E39A71F748503F812C41FBD1508DA53F486665EEE697D601655BB0E7D580562F6D6

B

467602004C76850E21FBB1BB11CAD388C621B71A94DB2A36E7EEF2ABAC34D7D97E39D0CC3C10A0C4

C

ED91CD269A194F7F016D183EB7B72356F7C452F7EBB4BBBF5F61C7E616886E9C8125137D1CEFC5F1

C

2EFE4C22924F137D11C8E244019F5239F06E4D7AAD43E97ABA97243A3CD6A9B25CDF4825F5D02D8D

4

BAAFEEDE47E4B857888B4217C5990AAD760745E4AF5FB51656778B4D2B1C86BC8B9AC3956F937EB2

0

C7497A915703FBE057F154AFA187FFAFDB2329ABBD9103B984A5BE92862F34ED5ED0D60E1080A8BF

4

A008F177603B2B5DFC8DA01DA9C8F414C92B116A849F3DCF5B9C71AD79BFB18ABF3AACCED530F2AE

C

1F76E454F090454BBEEF714010985"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(1152)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\UmxWnp.Dll

c:\windows\system32\msi.dll

- - - - - - - > 'lsass.exe'(1212)

c:\windows\system32\relog_ap.dll

- - - - - - - > 'explorer.exe'(9004)

c:\program files\Common Files\Logishrd\LVMVFM\LVPrcInj.dll

c:\progra~1\WINDOW~1\wmpband.dll

c:\windows\system32\msi.dll

c:\windows\system32\WPDShServiceObj.dll

c:\windows\system32\PortableDeviceTypes.dll

c:\windows\system32\PortableDeviceApi.dll

c:\program files\SUPERAntiSpyware\SASSEH.DLL

c:\windows\system32\browselc.dll

c:\progra~1\SPYBOT~1\SDHelper.dll

c:\program files\Microsoft Office\OFFICE11\msohev.dll

c:\program files\Haali\MatroskaSplitter\mmfinfo.dll

c:\program files\Haali\MatroskaSplitter\mkunicode.dll

c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll

.

------------------------ Other Running Processes ------------------------

.

c:\program files\Lavasoft\Ad-Aware\aawservice.exe

c:\program files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe

c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\eHome\ehSched.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\CDBurnerXP\NMSAccessU.exe

c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe

c:\windows\system32\dllhost.exe

c:\program files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\RUNDLL32.EXE

c:\program files\CA\CA Internet Security Suite\ccprovsp.exe

.

**************************************************************************

.

Completion time: 2009-12-24 03:14:56 - machine was rebooted

ComboFix-quarantined-files.txt 2009-12-24 10:14

Pre-Run: 112,635,867,136 bytes free

Post-Run: 112,429,002,752 bytes free

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=,1,2,3,4

- - End Of File - - 6AD697A92C73B7D55C503E6181C3903F

Link to post
Share on other sites

Thank you I figured it had to be that. :)

After we finish you can reinstall it should be able to after this run with Combofix.

1. Please open Notepad

  • Click Start , then Run
  • type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Driver::
gvnumtxh
xedfuwan
hjzxg

File::
c:\windows\system32\drivers\svprb.sys
C:\cleanup.bat
C:\zip.exe

DDS::
FF - prefs.js: keyword.URL - hxxp://www.mywebsearch.com/jsp/cfg_redir2.jsp?id=ZKfox001(2)&fl=0&ptb=4afBF.FNrf8pnKueTkzVeQ&st=kwd&o=kwd&url=http://search.mywebsearch.com/mywebsearch/dft_redir.jhtml&searchfor=

MIA::
c:\windows\system32\proquota.exe

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScriptB-4.gif

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

  • Combofix.txt

=============

Link to post
Share on other sites

This was all that was in the txt

ComboFix 09-12-24.02 - HP_Administrator 12/24/2009 11:17:40.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3326.2733 [GMT -7:00]

Running from: C:\Documents and Settings\HP_Administrator\Desktop\kahdah.exe

Command switches used :: C:\Documents and Settings\HP_Administrator\Desktop\CFScript.txt

FW: CA Personal Firewall *enabled* {14CB4B80-8E52-45EA-905E-67C1267B4160}

FILE ::

"C:\cleanup.bat"

"c:\windows\system32\drivers\svprb.sys"

"C:\zip.exe"

.

Link to post
Share on other sites

Guest
This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.