malware desable internet

abikhalil · May 10, 2010

Hello,

My Pc is infected and the malware desable any browser of intenet but skype still working.

when I start the pc, the files in the start menu dont run and for each of these file I receive the worning message :

***.exe encountered a problem and need to close.

We are sorry for the inconvenience .... etc etc

I have these messages for :

hkcmd,exe

NerocCheck.exe

issch.exe

cpqset.exe

realsched.exe

isuspm.exe

RecGuard.exe

SynTPEnh.exe

Reader-sl.exe

hpztb12.exe

QPService.exe

ehtray.exe

knlxhojt.exe

Qttask.exe

I run MAM and remove all what it found but still have the same problems.

I made the topic step by step but as the only way to communicate with you is with another pc and to send the files I use an external usb DD, I was forced to execute Defogger-Enable to take these files

well here are the files :

MAM log file :

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

Version de la base de donn

Attach.zip

kahdah · May 10, 2010

Hello abikhalil

Welcome to Malwarebytes.

=====================

Download ComboFix from one of these locations:

Link 1

Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

abikhalil · May 11, 2010

Hello abikhalil
Welcome to Malwarebytes.
=====================
Download ComboFix from one of these locations:
Link 1
Link 2
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

abikhalil · May 11, 2010

Hello Kahdah

thank you for your prompt reply and for your help

please find here the report as requested

regards

ComboFix 10-05-10.05 - Adminstrator 05/11/2010 20:06:26.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.653 [GMT 2:00]

Running from: c:\documents and settings\Adminstrator\My Documents\elimination virus\etape 2\ComboFix.exe

AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Outdated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Adminstrator\Application Data\inst.exe

c:\documents and settings\Adminstrator\knlxrhojt .exe

c:\documents and settings\Adminstrator\knlxrhojt.exe

c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray.exe

c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe

c:\program files\CBS Software\SpeedConnect Internet Accelerator\SpeedConnectStartUp.exe

c:\program files\Common Files\InstallShield\UpdateService\issch.exe

c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe

c:\program files\Common Files\Real\Update_OB\realsched.exe

c:\program files\D-Link\AirPlus G\AirGCFG.exe

c:\program files\Hewlett-Packard\Default Settings\cpqset.exe

c:\program files\Hewlett-Packard\HP Quick Launch Buttons\qlbctrl.exe

c:\program files\HP\HP Software Update\HPWuSchd2.exe

c:\program files\HP\QuickPlay\QPService.exe

c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

c:\program files\QuickTime\qttask.exe

c:\program files\Synaptics\SynTP\SynTPEnh.exe

c:\program files\Uniblue\SpyEraser\SpyEraser.exe

c:\program files\Windows Media Player\WMPNSCFG.exe

c:\windows\Cbemaa.exe

c:\windows\SMINST\RecGuard.exe

c:\windows\system32\8cb6910.log

c:\windows\system32\chdaudpropshortcut .exe

c:\windows\system32\chdaudpropshortcut.exe

c:\windows\system32\ctfmon .exe

c:\windows\system32\drivers\npf.sys

c:\windows\system32\hkcmd .exe

c:\windows\system32\hkcmd.exe

c:\windows\system32\igfxpers .exe

c:\windows\system32\igfxtray .exe

c:\windows\system32\KGyGaAvL.sys

c:\windows\system32\knlxrhojt .exe

c:\windows\system32\msxsltsso.dll

c:\windows\system32\nerocheck .exe

c:\windows\system32\NeroCheck.exe

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\regedit .exe

c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

D:\Autorun.inf

Infected copy of c:\windows\system32\drivers\ndis.sys was found and disinfected

Restored copy from - c:\windows\ServicePackFiles\i386\ndis.sys

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_ABEL

-------\Legacy_SSHNAS

-------\Service_Abel

-------\Service_NPF

((((((((((((((((((((((((( Files Created from 2010-04-11 to 2010-05-11 )))))))))))))))))))))))))))))))

.

2010-05-11 18:01 . 2010-05-11 18:01 -------- d-sha-r- \cmdcons

2010-05-11 17:55 . 2010-05-11 18:16 -------- d-----w- \ComboFix

2010-05-11 17:53 . 2010-05-11 18:13 -------- d---a-w- \Qoobox

2010-05-09 15:57 . 2010-05-09 15:57 -------- d-----w- c:\documents and settings\Adminstrator\Local Settings\Application Data\Threat Expert

2010-05-09 15:53 . 2010-01-22 07:56 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-05-09 15:53 . 2010-01-22 07:55 767952 ----a-w- c:\windows\BDTSupport.dll

2010-05-09 15:53 . 2008-11-26 10:08 131 ----a-w- c:\windows\IDB.zip

2010-05-09 15:53 . 2010-01-22 07:56 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-05-09 15:53 . 2010-01-22 07:56 1652688 ----a-w- c:\windows\PCTBDCore.dll

2010-05-09 15:53 . 2009-10-27 23:36 1152444 ----a-w- c:\windows\UDB.zip

2010-05-09 15:52 . 2010-05-09 16:14 -------- d-----w- c:\program files\Spyware Doctor

2010-05-09 15:52 . 2010-05-09 15:53 -------- d-----w- c:\program files\Common Files\PC Tools

2010-05-09 15:52 . 2010-05-09 15:52 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools

2010-05-09 15:52 . 2010-05-09 15:52 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\PC Tools

2010-05-09 13:48 . 2010-05-09 13:48 -------- d-sh--w- c:\documents and settings\Administrator\IECompatCache

2010-05-09 13:46 . 2010-05-09 13:46 -------- d-sh--w- c:\documents and settings\Administrator\PrivacIE

2010-05-09 10:34 . 2010-05-09 10:34 -------- d-----w- c:\program files\CCleaner

2010-05-09 08:16 . 2010-05-09 08:18 -------- d-----w- C:\UsbFix

2010-05-09 08:16 . 2010-05-09 08:18 -------- d-----w- \UsbFix

2010-05-09 08:01 . 2010-05-09 08:01 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache

2010-05-09 07:08 . 2010-05-09 07:08 -------- d-sh--w- c:\documents and settings\Administrator\IETldCache

2010-05-09 06:05 . 2010-05-09 06:50 -------- d-----w- c:\program files\Anti Trojan Elite

2010-05-09 04:26 . 2010-05-09 04:26 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\Malwarebytes

2010-05-09 04:26 . 2010-05-09 04:26 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2010-05-09 04:26 . 2010-05-09 04:26 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes

2010-05-09 04:07 . 2009-08-02 16:49 3036024 ----a-w- c:\documents and settings\Adminstrator\Application Data\Simply Super Software\Trojan Remover\lwp1847.exe

2010-05-08 19:53 . 2010-05-08 19:56 -------- d-----w- c:\program files\RegCleaner

2010-05-08 18:40 . 2010-05-08 18:40 -------- d-----w- c:\program files\7-Zip

2010-05-08 17:19 . 2010-05-09 05:49 -------- d-----w- c:\documents and settings\Adminstrator\Local Settings\Application Data\eiblmnnvq

2010-04-24 20:14 . 2010-04-24 20:14 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\InstallShield

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2010-05-11 18:16 . 2009-04-08 06:32 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

2010-05-11 18:13 . 2008-07-18 15:40 -------- d-----w- c:\program files\QuickTime

2010-05-10 15:43 . 2007-06-10 12:11 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\Canon

2010-05-09 14:54 . 2006-11-13 16:15 -------- d--h--w- c:\program files\InstallShield Installation Information

2010-05-09 14:54 . 2007-06-10 19:29 -------- d-----w- c:\program files\Google

2010-05-09 07:57 . 2009-08-27 19:04 -------- d-----w- c:\program files\NETGEAR

2010-05-08 18:56 . 2009-11-11 11:54 1053184 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat

2010-05-08 18:45 . 2008-12-01 19:05 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET

2010-05-05 14:42 . 2008-01-28 16:42 -------- d-----w- c:\program files\NetAppel

2010-05-03 19:11 . 2010-04-09 18:03 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\Image Zone Express

2010-05-02 09:47 . 2007-04-03 13:10 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\HP

2010-04-25 16:23 . 2009-12-06 16:49 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\Skype

2010-04-25 14:54 . 2009-12-06 16:51 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\skypePM

2010-04-23 14:53 . 2007-10-16 20:26 -------- d-----w- c:\documents and settings\Adminstrator\Application Data\Corel

2010-04-20 17:21 . 2007-11-08 20:10 -------- d-----w- c:\program files\D-Link

2010-04-09 08:15 . 2010-04-09 07:58 113139 ----a-w- c:\windows\hpoins07.dat

2010-04-09 08:13 . 2006-11-13 16:15 -------- d-----w- c:\program files\HP

2010-04-09 08:13 . 2010-04-09 08:13 -------- d-----w- c:\program files\Common Files\HP

2010-04-09 08:10 . 2010-04-09 08:10 -------- d-----w- c:\program files\Common Files\Hewlett-Packard

2010-03-19 08:06 . 2008-06-30 12:43 -------- d-----w- c:\program files\OfficeReady 4.0

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimwmp.dll

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimswf.dll

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimrp.dll

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\ThinShims\rpnpshimqt.dll

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\Components\nprpffbrowserrecordext.dll

2010-03-13 17:48 . 2010-03-13 17:48 300616 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Common\rpmainbrowserrecordplugin.dll

2010-03-13 17:48 . 2010-03-13 17:48 118784 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Chrome\Hook\rpchromebrowserrecordhelper.dll

2010-03-13 17:48 . 2010-03-13 17:48 329312 ----a-w- c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll

2010-03-13 17:48 . 2007-05-31 19:42 -------- d-----w- c:\program files\Common Files\Real

2010-03-13 17:48 . 2007-06-10 19:29 -------- d-----w- c:\program files\Real

2010-03-13 17:48 . 2010-03-13 17:48 -------- d-----w- c:\program files\Common Files\xing shared

2008-06-11 17:58 . 2008-06-11 17:35 72 --sh--w- c:\windows\SF9F4C5A4.tmp

2007-10-18 19:30 . 2007-10-18 19:24 88 --sh--r- c:\windows\system32\3F72B0686F.sys

2007-10-17 09:33 . 2007-10-17 09:33 56 --sh--r- c:\windows\system32\6F68B0723F.sys

.

<pre>
c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray .exe
c:\program files\Adobe\Reader 8.0\Reader\reader_sl .exe
c:\program files\CBS Software\SpeedConnect Internet Accelerator\speedconnectstartup .exe
c:\program files\Common Files\InstallShield\UpdateService\issch .exe
c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\D-Link\AirPlus G\airgcfg .exe
c:\program files\ESET\ESET Smart Security\egui .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\Hewlett-Packard\Default Settings\cpqset .exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\qlbctrl .exe
c:\program files\HP\HP Software Update\hpwuschd2 .exe
c:\program files\HP\QuickPlay\qpservice .exe
c:\program files\HPQ\HP Wireless Assistant\hp wireless assistant .exe
c:\program files\QuickTime\qttask .exe
c:\program files\ScanSoft\OmniPageSE\opware32 .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Uniblue\SpyEraser\spyeraser .exe
c:\program files\Windows Media Player\wmpnscfg .exe
c:\windows\ehome\ehtray .exe
c:\windows\SMINST\recguard .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb12 .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"knlxrhojt"="c:\documents and settings\Adminstrator\knlxrhojt.exe" [N/A]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [N/A]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [N/A]

"RecGuard"="c:\windows\SMINST\RecGuard.exe" [N/A]

"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [N/A]

"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [N/A]

"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [N/A]

"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [N/A]

"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [N/A]

"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [N/A]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [N/A]

"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb12.exe" [N/A]

"ehTray"="c:\windows\ehome\ehtray.exe" [2010-05-07 56766]

"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-02-06 2021400]

"Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [N/A]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [N/A]

c:\windows\system32\config\systemprofile\Start Menu\Programs\Startup\

Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\

Vongo Tray.lnk - c:\program files\Vongo\Tray.exe [2006-5-9 73728]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

NETGEAR WN111v2 Smart Wizard.lnk - c:\program files\NETGEAR\WN111v2\WN111V2.exe [2008-5-9 1474631]

NETGEAR WNDA3100v2 Smart Wizard.lnk - c:\program files\NETGEAR\WNDA3100v2\WNDA3100v2.exe [2010-5-9 3272704]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk

backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk

backup=c:\windows\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SANTIS USB and PC Card Utility.lnk]

path=c:\documents and settings\All Users\Start Menu\Programs\Startup\SANTIS USB and PC Card Utility.lnk

backup=c:\windows\pss\SANTIS USB and PC Card Utility.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]

c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\D-Link AirPlus G]

c:\program files\D-Link\AirPlus G\AirGCFG.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]

CHDAudPropShortcut.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]

c:\program files\HP\HP Software Update\HPWuSchd2.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]

c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M5T8QL3YW3]

c:\docume~1\ADMINS~1\LOCALS~1\Temp\Cjd.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpeedConnectStartUp]

c:\program files\CBS Software\SpeedConnect Internet Accelerator\SpeedConnectStartUp.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue SpyEraser]

c:\program files\Uniblue\SpyEraser\SpyEraser.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]

c:\program files\Windows Media Player\WMPNSCFG.exe [N/A]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\WINDOWS\\system32\\mqsvc.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=

"c:\\Program Files\\NetAppel\\NetAppel.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\WINDOWS\\system32\\igfxsrvc.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=

"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=

"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [5/9/2010 5:52 PM 218592]

R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2/6/2009 2:23 PM 106208]

R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2/6/2009 2:24 PM 93336]

R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [5/9/2010 5:53 PM 112592]

R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [2/6/2009 2:23 PM 727720]

R2 Uniblue DiskRescue;Uniblue DiskRescue;c:\program files\Uniblue\DiskRescue\UBDiskRescueSrv.exe [9/10/2008 5:22 PM 229648]

R3 JSWSCIMD;jswscimd Service;c:\windows\system32\drivers\jswscimd.sys [2/12/2008 7:05 PM 57440]

S2 ATE_PROCMON;ATE_PROCMON;\??\c:\program files\Anti Trojan Elite\ATEPMon.sys --> c:\program files\Anti Trojan Elite\ATEPMon.sys [?]

S2 DCamUSB20;TRUST USB2 AUDIO VIDEO EDITOR;c:\windows\system32\drivers\csmini20.sys [6/3/2007 6:36 PM 46216]

S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/31/2010 10:19 AM 135664]

S2 WSWNDA3100;WSWNDA3100;c:\program files\NETGEAR\WNDA3100v2\WifiSvc.exe [5/9/2010 9:57 AM 278528]

S3 5U870CAP_VID_1262&PID_25FD;HP Pavilion Webcam ;c:\windows\system32\drivers\5u870cap.sys [6/6/2006 10:39 PM 61952]

S3 ATMEL FVNETusbASKEY (AR)®;ATMEL FVNETusbASKEY (AR)® Service for SANTIS WLAN USB Adapter;c:\windows\system32\drivers\vnetusbk.sys [2/20/2003 6:15 PM 93184]

S3 ATMEL WinXP PCMCIAFVNETR (2ARC)®;ATMEL WinXP PCMCIAFVNETR (2ARC)® Service for SANTIS WLAN PC Card;c:\windows\system32\drivers\fvnetr51.sys [1/14/2003 12:44 PM 91648]

S3 BCMH43XX;Broadcom 802.11 USB Network Adapter Driver;c:\windows\system32\drivers\bcmwlhigh5.sys [5/9/2010 9:57 AM 632576]

S3 CH341SER;CH341SER;c:\windows\system32\drivers\ch341ser.sys [8/17/2008 8:10 PM 35824]

S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\windows\system32\DNINDIS5.sys [7/24/2003 1:10 PM 17149]

S3 INIDVD;Initio USB DVD Filter Driver;c:\windows\system32\drivers\inidvd.sys [4/5/2009 2:46 PM 7936]

S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\NETGEAR\WN111v2\jswpsapi.exe [2/27/2008 11:54 AM 360547]

S3 m4301a;Linksys Wireless-B USB Network Adapter v4.0 Driver;c:\windows\system32\drivers\m4301a.sys [8/7/2007 8:20 PM 116192]

S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [5/9/2010 5:52 PM 366840]

S3 WN111v2;NETGEAR WN111v2 USB2.0 Wireless Card Service;c:\windows\system32\drivers\wn111v2.sys [5/31/2008 3:46 PM 434688]

.

------- Supplementary Scan -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = hxxp://www.google.be/ig?hl=fr

uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8

mLocal Page = c:\windows\system32\blank.htm

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = *.local

uSearchAssistant = hxxp://www.google.com/ie

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll

FF - ProfilePath - c:\documents and settings\Adminstrator\Application Data\Mozilla\Firefox\Profiles\9nzm0n5r.default\

FF - prefs.js: browser.search.selectedEngine - Yahoo

FF - component: c:\documents and settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext\components\nprpffbrowserrecordext.dll

FF - plugin: c:\documents and settings\Adminstrator\Application Data\Move Networks\plugins\npqmp071700000016.dll

FF - plugin: c:\documents and settings\Adminstrator\Local Settings\Application Data\Yahoo!\BrowserPlus\2.7.1\Plugins\npybrowserplus_2.7.1.dll

FF - plugin: c:\program files\Google\Update\1.2.183.23\npGoogleOneClick8.dll

FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----

c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);

c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr

ef", true);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);

c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");

c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);

.

- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)

SSODL-GootkitSSO-{09F8EFA3-B472-40B0-B41C-CD96A30D9BA6} - c:\windows\System32\msxsltsso.dll

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2010-05-11 20:18

Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]

"ImagePath"=multi:"system32\DRIVERS\inidvd.sys\00"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\INIDVD]

"ImagePath"=multi:"system32\DRIVERS\inidvd.sys\00"

.

------------------------ Other Running Processes ------------------------

.

c:\windows\System32\smss.exe

c:\windows\system32\csrss.exe

c:\windows\system32\winlogon.exe

c:\windows\system32\services.exe

c:\windows\system32\lsass.exe

c:\windows\system32\svchost.exe

c:\windows\System32\svchost.exe

c:\windows\system32\svchost.exe

c:\windows\system32\spoolsv.exe

c:\windows\system32\acs.exe

c:\windows\system32\svchost.exe

c:\windows\system32\msdtc.exe

c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\windows\System32\svchost.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\windows\system32\HPZipm12.exe

c:\windows\system32\svchost.exe

c:\windows\system32\UTSCSI.EXE

c:\windows\system32\mqsvc.exe

c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe

c:\windows\system32\mqtgsvc.exe

c:\windows\system32\wuauclt.exe

c:\windows\System32\alg.exe

c:\windows\system32\wscntfy.exe

c:\windows\system32\wbem\wmiprvse.exe

.

**************************************************************************

.

Completion time: 2010-05-11 20:21:24 - machine was rebooted

ComboFix-quarantined-files.txt 2010-05-11 18:21

Pre-Run: 34,090,975,232 bytes free

Post-Run: 33,989,861,376 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

- - End Of File - - 28CA3E7E2C09FABCE4CF4FF792F164FD

kahdah · May 11, 2010

1. Please open Notepad

Click Start , then Run
type in notepad in the Run Box then hit ok.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KILLALL::

RenV::
c:\program files\Adobe\Acrobat 8.0\Acrobat\acrotray .exe
c:\program files\Adobe\Reader 8.0\Reader\reader_sl .exe
c:\program files\CBS Software\SpeedConnect Internet Accelerator\speedconnectstartup .exe
c:\program files\Common Files\InstallShield\UpdateService\issch .exe
c:\program files\Common Files\InstallShield\UpdateService\isuspm .exe
c:\program files\Common Files\Real\Update_OB\realsched .exe
c:\program files\D-Link\AirPlus G\airgcfg .exe
c:\program files\ESET\ESET Smart Security\egui .exe
c:\program files\Google\GoogleToolbarNotifier\googletoolbarnotifier .exe
c:\program files\Hewlett-Packard\Default Settings\cpqset .exe
c:\program files\Hewlett-Packard\HP Quick Launch Buttons\qlbctrl .exe
c:\program files\HP\HP Software Update\hpwuschd2 .exe
c:\program files\HP\QuickPlay\qpservice .exe
c:\program files\HPQ\HP Wireless Assistant\hp wireless assistant .exe
c:\program files\QuickTime\qttask .exe
c:\program files\ScanSoft\OmniPageSE\opware32 .exe
c:\program files\Synaptics\SynTP\syntpenh .exe
c:\program files\Uniblue\SpyEraser\spyeraser .exe
c:\program files\Windows Media Player\wmpnscfg .exe
c:\windows\ehome\ehtray .exe
c:\windows\SMINST\recguard .exe
c:\windows\system32\spool\drivers\w32x86\3\hpztsb12 .exe


Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"knlxrhojt"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M5T8QL3YW3]

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

5. After reboot, (in case it asks to reboot), please post the following report/log into your next reply:

Combofix.txt

abikhalil · May 12, 2010

HI,

HERE IS THE NEW REPORT

THANKS

ComboFix 10-05-10.05 - Adminstrator 05/12/2010 5:27.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.631 [GMT 2:00]

Running from: c:\documents and settings\Adminstrator\My Documents\elimination virus\etape 2\ComboFix.exe

Command switches used :: c:\documents and settings\Adminstrator\My Documents\elimination virus\etape 2\CFScript.txt

AV: ESET Smart Security 3.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}

FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}

FW: Norton Internet Worm Protection *disabled* {990F9400-4CEE-43EA-A83A-D013ADD8EA6E}

* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2010-04-12 to 2010-05-12 )))))))))))))))))))))))))))))))

.

2010-05-09 15:57 . 2010-05-09 15:57 -------- d-----w- c:\documents and settings\Adminstrator\Local Settings\Application Data\Threat Expert

2010-05-09 15:53 . 2010-01-22 07:56 149456 ----a-w- c:\windows\SGDetectionTool.dll

2010-05-09 15:53 . 2010-01-22 07:55 767952 ----a-w- c:\windows\BDTSupport.dll

2010-05-09 15:53 . 2008-11-26 10:08 131 ----a-w- c:\windows\IDB.zip

2010-05-09 15:53 . 2010-01-22 07:56 165840 ----a-w- c:\windows\PCTBDRes.dll

2010-05-09 15:53 . 2010-01-22 07:56 1652688 ----a-w- c:\windows\PCTBDCore.dll

2010-05-09 15:53 . 2009-10-27 23:36 1152444 ----a-w- c:\windows\UDB.zip

2010-05-09 15:53 . 2010-02-05 07:17 233136 ----a-w- c:\windows\system32\drivers\pctgntdi.sys

2010-05-09 15:52 . 2010-03-29 08:06 218592 ----a-w- c:\windows\system32\drivers\PCTCore.sys

2010-05-09 15:52 . 2009-11-23 11:54 88040 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys

2010-05-09 15:52 . 2010-04-08 12:29 63360 ----a-w- c:\windows\system32\drivers\pctplsg.sys