Link to home
Start Free TrialLog in
Avatar of suply
suply

asked on

How do I scan and remove a virus from my computer, opened zip file by mistake

I recently received in my hotmail inbox an email I thought it was from  UPS but then realized it was a Virus once It was too late I had already opened the file.

UPS Tracking Number 4606078241
From: United Parcel Service (favjulfo@bow-group.com)
Sent: Sun 7/20/08 7:44 PM
To:  

Security scan upon download  
 ups_invoi...zip (48.4 KB)
Unfortunately we were not able to deliver postal package you sent on July the 1st in timebecause the recipients address is not correct.Please print out the invoice copy attached and collect the package at our office Your UPS

I would like to know what type of theat could I have in my computer and what is the most convinient way to remove the virus from its unknown alocation inside the unit.

Im unable to upload the file due to the extension its a .exe


Avatar of dfxdeimos
dfxdeimos
Flag of United States of America image

You have a couple of options here:

1) If you already have an anti-virus on your computer you can simply initiate a full system scan and (in most cases) it will find and quarantine / delete the virus.

2) If you do not want to purchase an antivirus program you can download and install the AVG Free Edition (http://free.avg.com/) and then perform a full system scan and it should pick up and quarantine / delete the virus.

3) If you would like to purchase an antivirus program you can visit (and this is just my personal preference) http://www.kaspersky.com/ and purchase / download their antivirus application, install it, then perform a full system scan.

Good Luck.
Avatar of rpggamergirl
Scanning the system with an antivirus scanner usually will remove common viruses. Sometimes antivirus scanners can't remove some viruses especially malware.

It would help if we could look at a hijackthis log, it might show in the scan or if it comes with malware it should show in the hijackthis log.
Download Hijackthis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Open Hijackthis, click "Do a system scan and save a logfile" please don't fix anything yet.
Please attach the logfile as "Code Snippet".
Avatar of suply
suply

ASKER

Hello dfxdeimos, Im unable to run avg, I have installation problems below:

Local machine: installation failed
    Installation:
        Error: Action failed for file avgemc.exe: starting service....
            Error 0x8007041d
        Warning: Preparation to unload of the service avg8wd failed.
            Specified file was not found.
    Rollback:
        Error: Action failed for file avgwd.log: restoring from backup....
            Error 0x80070005 %DESTINATION% = "C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log", %SOURCE% = "C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log.install_backup"
        Warning: Action failed for file avgmfx86.sys: stopping service....
            Service AvgMfx86 failed to progress during stopping at checpoint 0 (wait hint 10000 ms) in 91000 ms.

Any suggestions, Thankyou


Avatar of suply

ASKER

Hello rpggamergirl, I downloaded the hijackthis but it wont  run the file. Im unable to perform a scan. I double click on the Icon and it wont do anything.

Thanks
Did you try renaming it?.....if it still won't run try changing the exe extension to .com
Avatar of suply

ASKER

Hello rpggamergirl, I had to rename hijackthis and also the log to be able to save it, here is the log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:18 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Escritorio\hhhhh.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 5856 bytes

Open in new window

Well done!

No wonder you can't run any program braviax is there!

SDFix should be able to take care of it.. IF you can run it.
Do you have other pc there where you can download and extract SDFix before transfering it to the infected pc?
You need to rename SDFix before you saved it to your pc, or download and extract it using another pc. Let us know how you go. Once SDFix has been extracted braviax won't stop it from running.
Download SDFix and save it to your desktop.(either one below)
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

If needed: How to use SDFix.
http://www.bleepingcomputer.com/forums/topic131299.html

Double click SDFix and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.

* Open the extracted folder and double click "RunThis.bat" to start the script.
* Type "Y" to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and attach the "Report.txt" back
Combofix will also remove it, but you need to rename combofix before saving it to your desktop, renaming it after it has been downloaded will not work, it has to be renamed before saving the file.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Avatar of suply

ASKER

rpggamergirl, here is the fresh hijackthis and the combofix log. Please advice.
Thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:59 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Escritorio\hhhhh.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 5674 bytes
 
 
 
 
ComboFix 08-07-21.1 - Administrador 2008-07-21 20:15:42.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.58.3082.18.1612 [GMT -4.5:30]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\hello123.exe
 * Creado un nuevo punto de restauración
 
[color=red][b]ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! [/b][/color]
.
 
((((((((((((((((((((((((((((((((((((   Otras eliminaciones   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
[color=red]C:\WINDOWS\system32\dllcache\beep.sys[/color]
[color=red]C:\WINDOWS\system32\drivers\beep.sys[/color]
C:\WINDOWS\braviax.exe
C:\WINDOWS\cru629.dat
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\cru629.dat
C:\WINDOWS\system32\crypts.dll
C:\WINDOWS\system32\DelSelf.bat
C:\WINDOWS\system32\ntload.dll
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\system32\winupdate.exe
C:\WINDOWS\system32\wscmp.dll
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TCPSR
-------\Service_tcpsr
 
 
((((((((((((((((((   Archivos creados desde 2008-06-22 - 2008-07-22  )))))))))))))))))))))))))))))))))
.
 
2008-07-21 20:21 . 	6,784		C:\WINDOWS\system32\drivers\tcpsr.sys
2008-07-21 19:29 . 2008-07-21 19:29	<DIR>	d--------	C:\Program Files
2008-07-21 19:16 . 2008-07-21 19:16	<DIR>	d--------	C:\Archivos de programa\Trend Micro
2008-07-21 19:01 . 2008-07-21 19:01	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\AVGTOOLBAR
2008-07-21 18:51 . 2008-07-21 19:09	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\avg8
2008-07-21 18:51 . 2008-07-21 18:51	<DIR>	d--------	C:\Archivos de programa\AVG
2008-07-21 17:09 . 2008-07-21 20:21	30,848	--a------	C:\WINDOWS\system32\drivers\Bbe41.sys
2008-07-21 16:27 . 2008-01-07 14:29	352	--ah-----	C:\WINDOWS\nod32fixtemdono.reg
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\ESET
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Archivos de programa\ESET
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\WINDOWS\Sun
2008-07-20 23:23 . 2008-07-21 04:29	<DIR>	d--------	C:\Documents and Settings\Administrador\.housecall6.6
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\Archivos de programa\Java
2008-07-20 23:23 . 2005-04-13 03:48	49,265	--a------	C:\WINDOWS\system32\jpicpl32.cpl
2008-07-20 23:21 . 2008-07-20 23:21	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Java
2008-07-20 22:48 . 2008-07-20 22:48	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\CyberLink
2008-07-17 05:08 . 2008-07-17 05:08	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\CyberLink
2008-07-17 03:53 . 2008-07-17 03:53	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\supportsoft
2008-07-17 03:53 . 2007-07-30 14:44	3,518,464	--a------	C:\WINDOWS\system32\cdintf300.dll
2008-07-17 03:53 . 2007-06-28 14:09	1,843,200	--a------	C:\WINDOWS\system32\acXMLParser.dll
2008-07-17 03:51 . 2008-07-17 19:20	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:51	<DIR>	d--------	C:\Archivos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:52	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Intuit
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\COMMON FILES
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Archivos de programa\MSXML 4.0
2008-07-15 19:46 . 2003-06-19 01:31	17,920	--a------	C:\WINDOWS\system32\mdimon.dll
2008-07-15 19:46 . 2008-07-15 19:46	379	--a------	C:\WINDOWS\ODBC.INI
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\WINDOWS\SHELLNEW
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\Archivos de programa\Microsoft.NET
2008-07-15 19:43 . 2008-07-15 19:43	<DIR>	dr-h-----	C:\MSOCache
2008-07-15 03:32 . 2008-07-15 03:35	<DIR>	d--------	C:\Archivos de programa\SVS Server SVS-30
2008-07-15 03:32 . 2001-06-23 14:04	319,488	--a------	C:\WINDOWS\system32\pvwv220.dll
2008-07-15 03:32 . 2001-06-23 14:04	294,912	--a------	C:\WINDOWS\system32\pvmjpg21.dll
2008-07-15 03:32 . 2001-06-23 14:04	188,416	--a------	C:\WINDOWS\system32\pvljpg20.dll
2008-07-15 03:32 . 2001-03-07 15:30	108,064	--a------	C:\WINDOWS\system32\UNPICVID2.EXE
2008-07-15 03:32 . 2001-05-08 12:23	107,057	--a------	C:\WINDOWS\system32\pvmjpg21.hlp
2008-07-15 03:32 . 1997-07-03 09:44	82,864	--a------	C:\WINDOWS\system32\UNWISE.EXE
2008-07-15 03:30 . 2008-07-17 05:22	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\U3
2008-07-14 18:35 . 2008-07-14 18:35	<DIR>	d--------	C:\Archivos de programa\OSI Codes Inc
2008-07-13 20:03 . 2008-07-14 18:47	<DIR>	d--------	C:\Archivos de programa\Google
2008-07-13 06:03 . 2008-07-13 06:06	<DIR>	d--------	C:\APVWIN
2008-07-13 00:15 . 2008-07-13 00:15	<DIR>	d--------	C:\Documents and Settings\Administrador\Contacts
2008-07-12 22:17 . 2008-07-12 22:17	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\Leadertech
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\DataViz
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Documents To Go
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\DataViz
2008-07-12 22:12 . 2008-07-12 22:12	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\HotSync
2008-07-12 22:12 . 2008-07-12 22:17	<DIR>	d--------	C:\Archivos de programa\Palm
2008-07-12 22:12 . 2008-07-12 22:11	53,248	--a------	C:\WINDOWS\PalmDevC.dll
2008-07-12 22:11 . 2008-07-21 19:09	<DIR>	d--hs----	C:\WINDOWS\Installer
2008-07-12 22:11 . 2008-07-12 22:11	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\HotSync
2008-07-12 22:07 . 2003-12-09 21:42	147,456	-ra------	C:\WINDOWS\system32\MUINST_Q.EXE
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-12 22:07 . 2003-08-01 22:14	2,054	-ra------	C:\WINDOWS\system32\MUNZ___Q.UNM
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\USB20
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\ALIEHCI
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\Drivers
2008-07-12 22:01 . 2004-01-15 14:36	55,680	--a------	C:\WINDOWS\system32\drivers\ousb2hub.sys
2008-07-12 22:01 . 2004-01-15 14:36	42,624	--a------	C:\WINDOWS\system32\drivers\ousbehci.sys
2008-07-12 22:01 . 2001-11-13 21:24	35,587	---------	C:\WINDOWS\system32\rmORGusb20.EXE
2008-07-12 22:01 . 2003-06-18 18:16	28,672	---------	C:\WINDOWS\system32\UnORGusb20.exe
2008-07-12 22:01 . 2004-02-25 17:51	651	--a------	C:\WINDOWS\system32\setup.iss
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\drivers\usbohci.sys
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\dllcache\usbohci.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-02 11:10 . 2008-07-02 11:10	<DIR>	d--------	C:\Archivos de programa\CyberLink
2008-07-02 11:08 . 2004-08-03 23:08	26,496	--a------	C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-02 10:02 . 2004-08-03 22:29	250,640	-rahs----	C:\ntldr
2008-07-02 10:02 . 2001-08-24 05:30	4,952	-rahs----	C:\Bootfont.bin
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Reciente
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Plantillas
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Mis documentos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-------	C:\WINDOWS\system32\config\systemprofile\Men£ Inicio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Impresoras
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Favoritos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Escritorio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Entorno de red
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Datos de programa
2008-07-02 10:00 . 2008-07-21 20:19	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Configuraci¢n local
 
.
((((((((((((((((((((((((((((((((((((((   Reporte Find3M   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 10:33	4,096	----a-w	C:\WINDOWS\system32\Ry4CoInst.dll
2008-07-13 10:33	22,016	----a-w	C:\WINDOWS\system32\drivers\Rockey4.sys
2008-07-13 10:33	12,928	----a-w	C:\WINDOWS\system32\drivers\Rockey4USB.sys
2008-07-13 02:41	16,694	----a-w	C:\WINDOWS\system32\drivers\PalmUSBD.sys
2008-07-13 02:31	---------	d--h--w	C:\Archivos de programa\InstallShield Installation Information
2008-07-02 15:39	---------	d-----w	C:\Archivos de programa\Archivos comunes\InstallShield
2008-07-02 14:29	---------	d-----w	C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Adobe
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Windows Media Connect 2
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\VIA
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Servicios en línea
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\S3
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\nu
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Nero
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\MSN Messenger
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\microsoft frontpage
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\HighMAT CD Writing Wizard
.
 
(((((((((((((((((((((((((((((((((   Cargando Puntos Reg   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:12 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"RemoteControl"="C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="C:\WINDOWS\system32\MSTMON_Q.EXE" [2004-08-04 03:52 163840]
"SunJavaUpdateSched"="C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"VTTimer"="VTTimer.exe" [2007-12-20 16:35 77824 C:\WINDOWS\system32\VTTimer.exe]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"VIDC.PVW2"= pvwv220.dll
"VIDC.PIMJ"= pvljpg20.dll
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Bbe41.sys]
@="Driver"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
 
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
 
*Newly Created Service* - TCPSR
.
- - - - ORPHANS REMOVED - - - -
 
HKLM-Run-NWEReboot - (no file)
 
 
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
O8 -: E&xportar a Microsoft Excel - C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 
O16 -: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
C:\WINDOWS\Downloaded Program Files\kxhcm10.ocx
 
O16 -: {33704B0F-9EB7-434B-B752-EA6CFFB87423} - hxxp://sacam2.viewnetcam.com:5002/JpegInst.cab
C:\WINDOWS\Downloaded Program Files\install.inf
C:\WINDOWS\Downloaded Program Files\pmjpegcam.ocx
C:\WINDOWS\Downloaded Program Files\pmjpegaudio.ocx
 
 
**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 20:21:32
Windows 5.1.2600 Service Pack 2 NTFS
 
escaneando procesos ocultos ...
 
escaneando entradas ocultas de autostart ...
 
escaneando archivos ocultos ...
 
 
C:\WINDOWS\system32\ntos.exe 408576 bytes executable
C:\WINDOWS\system32\wsnpoem
 
el escaneo se completo con exito
archivos ocultos: 2
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Tiempo completado: 2008-07-21 20:23:59 - machine was rebooted
ComboFix-quarantined-files.txt  2008-07-22 00:53:53
 
Pre-Run: 208,697,622,528 bytes libres
Post-Run: 208,995,667,968 bytes libres
 
219	--- E O F ---	2008-04-18 19:46:41

Open in new window

Did you try running SDFix as well?

Can you please check if it runs? in Safe Mode.
Braviax patches beep.sys, and I think SDFix also includes a clean copy of beep.sys


I'll post the script later.
Avatar of suply

ASKER

rpggamergirl, here is the log for sdfix.
[b]SDFix: Version 1.207 [/b]
Run by Administrador on Mon 07/21/2008 at 10:01 PM
 
Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix
 
[b]Checking Services [/b]:
 
[b]Name [/b]: 
BBE41
 
[b]Path [/b]:
System32\Drivers\Bbe41.sys 
 
BBE41 - Deleted
 
 
 
Restoring Default Security Values
Restoring Default Hosts File
 
Rebooting
 
Service BBE41 - Deleted
 
[b]Checking Files [/b]: 
 
Trojan Files Found:
 
C:\WINDOWS\system32\ntos.exe  - Deleted
C:\WINDOWS\system32\drivers\BBE41.sys - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
 
 
 
Folder C:\WINDOWS\system32\wsnpoem - Removed
 
 
Removing Temp Files
 
[b]ADS Check [/b]:
 
 
 
                                 [b]Final Check [/b]:
 
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:07:04
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...
 
scanning hidden services & system hive ...
 
scanning hidden registry entries ...
 
scanning hidden files ...
 
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
 
 
[b]Remaining Services [/b]:
 
 
 
 
Authorized Application Key Export:
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"="C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe:*:Enabled:QuickBooks 2008 Data Manager"
"C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
 
[b]Remaining Files [/b]:
 
 
File Backups: - C:\SDFix\backups\backups.zip
 
[b]Files with Hidden Attributes [/b]:
 
Mon  7 Jan 2008           352 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg"
Wed 13 Oct 2004     1,694,208 A.SH. --- "C:\Archivos de programa\Messenger\msmsgs.exe"
Wed 15 Aug 2007       782,336 A.SH. --- "C:\Documents and Settings\Administrador\Mis documentos\FOTOS CITATION\SIVF.tmp"
Fri 18 Apr 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu  7 Dec 2006     3,096,576 A..H. --- "C:\Documents and Settings\Administrador\Datos de programa\U3\temp\Launchpad Removal.exe"
Wed 11 Aug 2004       444,416 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\Copia de VALUACION UC\Copia de VALUACION 5\~WRL1204.tmp"
Sun 26 Jun 2005     1,407,488 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL1175.tmp"
Sun 26 Jun 2005     1,483,776 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL2120.tmp"
Sun 26 Jun 2005     1,401,856 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL3926.tmp"
Sun 26 Jun 2005     1,407,488 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL1175.tmp"
Sun 26 Jun 2005     1,483,776 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL2120.tmp"
Sun 26 Jun 2005     1,401,856 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL3926.tmp"
 
[b]Finished![/b]

Open in new window

That's great!  looks like maybe just one more left.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
Rootkit::
C:\WINDOWS\system32\drivers\tcpsr.sys
------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

NOTE: You need to change ALL passwords that has been used in that pc, these nasties are password and info stealers.
Avatar of suply

ASKER

rpggamergirl,  I draged the cfscript into the combofix and this is the new log
ComboFix 08-07-21.1 - Administrador 2008-07-21 22:30:49.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.58.3082.18.1552 [GMT -4.5:30]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\hello123.exe
Command switches used :: C:\Documents and Settings\Administrador\Escritorio\CFScript.txt
 * Creado un nuevo punto de restauración
 
[color=red][b]ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! [/b][/color]
.
 
((((((((((((((((((((((((((((((((((((   Otras eliminaciones   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\WINDOWS\system32\drivers\tcpsr.sys
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TCPSR
 
 
((((((((((((((((((   Archivos creados desde 2008-06-22 - 2008-07-22  )))))))))))))))))))))))))))))))))
.
 
2008-07-21 21:56 . 2008-07-21 21:56	<DIR>	d--------	C:\WINDOWS\ERUNT
2008-07-21 21:55 . 2008-07-21 22:07	<DIR>	d--------	C:\SDFix
2008-07-21 21:37 . 2008-07-21 21:37	<DIR>	d--h-----	C:\$AVG8.VAULT$
2008-07-21 20:40 . 2008-07-21 20:42	<DIR>	d--------	C:\WINDOWS\system32\drivers\Avg
2008-07-21 20:40 . 2008-07-21 20:40	96,520	--a------	C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-21 20:40 . 2008-07-21 20:40	76,040	--a------	C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-21 20:40 . 2008-07-21 20:40	10,520	--a------	C:\WINDOWS\system32\avgrsstx.dll
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\NetworkService\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\LocalService\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\Administrador\Configuración local
2008-07-21 19:29 . 2008-07-21 19:29	<DIR>	d--------	C:\Program Files
2008-07-21 19:16 . 2008-07-21 19:16	<DIR>	d--------	C:\Archivos de programa\Trend Micro
2008-07-21 19:01 . 2008-07-21 20:42	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\AVGTOOLBAR
2008-07-21 18:51 . 2008-07-21 20:40	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\avg8
2008-07-21 18:51 . 2008-07-21 18:51	<DIR>	d--------	C:\Archivos de programa\AVG
2008-07-21 16:27 . 2008-01-07 14:29	352	--ah-----	C:\WINDOWS\nod32fixtemdono.reg
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\ESET
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Archivos de programa\ESET
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\WINDOWS\Sun
2008-07-20 23:23 . 2008-07-21 04:29	<DIR>	d--------	C:\Documents and Settings\Administrador\.housecall6.6
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\Archivos de programa\Java
2008-07-20 23:23 . 2005-04-13 03:48	49,265	--a------	C:\WINDOWS\system32\jpicpl32.cpl
2008-07-20 23:21 . 2008-07-20 23:21	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Java
2008-07-20 22:48 . 2008-07-20 22:48	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\CyberLink
2008-07-17 05:08 . 2008-07-17 05:08	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\CyberLink
2008-07-17 03:53 . 2008-07-17 03:53	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\supportsoft
2008-07-17 03:53 . 2007-07-30 14:44	3,518,464	--a------	C:\WINDOWS\system32\cdintf300.dll
2008-07-17 03:53 . 2007-06-28 14:09	1,843,200	--a------	C:\WINDOWS\system32\acXMLParser.dll
2008-07-17 03:51 . 2008-07-17 19:20	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:51	<DIR>	d--------	C:\Archivos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:52	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Intuit
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\COMMON FILES
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Archivos de programa\MSXML 4.0
2008-07-15 19:46 . 2003-06-19 01:31	17,920	--a------	C:\WINDOWS\system32\mdimon.dll
2008-07-15 19:46 . 2008-07-15 19:46	379	--a------	C:\WINDOWS\ODBC.INI
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\WINDOWS\SHELLNEW
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\Archivos de programa\Microsoft.NET
2008-07-15 19:43 . 2008-07-15 19:43	<DIR>	dr-h-----	C:\MSOCache
2008-07-15 03:32 . 2008-07-15 03:35	<DIR>	d--------	C:\Archivos de programa\SVS Server SVS-30
2008-07-15 03:32 . 2001-06-23 14:04	319,488	--a------	C:\WINDOWS\system32\pvwv220.dll
2008-07-15 03:32 . 2001-06-23 14:04	294,912	--a------	C:\WINDOWS\system32\pvmjpg21.dll
2008-07-15 03:32 . 2001-06-23 14:04	188,416	--a------	C:\WINDOWS\system32\pvljpg20.dll
2008-07-15 03:32 . 2001-03-07 15:30	108,064	--a------	C:\WINDOWS\system32\UNPICVID2.EXE
2008-07-15 03:32 . 2001-05-08 12:23	107,057	--a------	C:\WINDOWS\system32\pvmjpg21.hlp
2008-07-15 03:32 . 1997-07-03 09:44	82,864	--a------	C:\WINDOWS\system32\UNWISE.EXE
2008-07-15 03:30 . 2008-07-17 05:22	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\U3
2008-07-14 18:35 . 2008-07-14 18:35	<DIR>	d--------	C:\Archivos de programa\OSI Codes Inc
2008-07-13 20:03 . 2008-07-14 18:47	<DIR>	d--------	C:\Archivos de programa\Google
2008-07-13 06:03 . 2008-07-13 06:06	<DIR>	d--------	C:\APVWIN
2008-07-13 00:15 . 2008-07-13 00:15	<DIR>	d--------	C:\Documents and Settings\Administrador\Contacts
2008-07-12 22:17 . 2008-07-12 22:17	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\Leadertech
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\DataViz
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Documents To Go
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\DataViz
2008-07-12 22:12 . 2008-07-12 22:12	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\HotSync
2008-07-12 22:12 . 2008-07-12 22:17	<DIR>	d--------	C:\Archivos de programa\Palm
2008-07-12 22:12 . 2008-07-12 22:11	53,248	--a------	C:\WINDOWS\PalmDevC.dll
2008-07-12 22:11 . 2008-07-21 20:40	<DIR>	d--hs----	C:\WINDOWS\Installer
2008-07-12 22:11 . 2008-07-12 22:11	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\HotSync
2008-07-12 22:07 . 2003-12-09 21:42	147,456	-ra------	C:\WINDOWS\system32\MUINST_Q.EXE
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-12 22:07 . 2003-08-01 22:14	2,054	-ra------	C:\WINDOWS\system32\MUNZ___Q.UNM
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\USB20
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\ALIEHCI
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\Drivers
2008-07-12 22:01 . 2004-01-15 14:36	55,680	--a------	C:\WINDOWS\system32\drivers\ousb2hub.sys
2008-07-12 22:01 . 2004-01-15 14:36	42,624	--a------	C:\WINDOWS\system32\drivers\ousbehci.sys
2008-07-12 22:01 . 2001-11-13 21:24	35,587	---------	C:\WINDOWS\system32\rmORGusb20.EXE
2008-07-12 22:01 . 2003-06-18 18:16	28,672	---------	C:\WINDOWS\system32\UnORGusb20.exe
2008-07-12 22:01 . 2004-02-25 17:51	651	--a------	C:\WINDOWS\system32\setup.iss
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\drivers\usbohci.sys
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\dllcache\usbohci.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-02 11:10 . 2008-07-02 11:10	<DIR>	d--------	C:\Archivos de programa\CyberLink
2008-07-02 11:08 . 2004-08-03 23:08	26,496	--a------	C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-02 10:02 . 2004-08-03 22:29	250,640	-rahs----	C:\ntldr
2008-07-02 10:02 . 2001-08-24 05:30	4,952	-rahs----	C:\Bootfont.bin
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Reciente
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Plantillas
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Mis documentos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-------	C:\WINDOWS\system32\config\systemprofile\Men£ Inicio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Impresoras
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Favoritos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Escritorio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Entorno de red
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Datos de programa
2008-07-02 10:00 . 2008-07-21 22:31	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Configuraci¢n local
 
.
((((((((((((((((((((((((((((((((((((((   Reporte Find3M   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 10:33	22,016	----a-w	C:\WINDOWS\system32\drivers\Rockey4.sys
2008-07-13 10:33	12,928	----a-w	C:\WINDOWS\system32\drivers\Rockey4USB.sys
2008-07-13 02:41	16,694	----a-w	C:\WINDOWS\system32\drivers\PalmUSBD.sys
2008-07-13 02:31	---------	d--h--w	C:\Archivos de programa\InstallShield Installation Information
2008-07-02 15:39	---------	d-----w	C:\Archivos de programa\Archivos comunes\InstallShield
2008-07-02 14:29	---------	d-----w	C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Adobe
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Windows Media Connect 2
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\VIA
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Servicios en línea
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\S3
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\nu
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Nero
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\MSN Messenger
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\microsoft frontpage
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\HighMAT CD Writing Wizard
.
 
(((((((((((((((((((((((((((((   snapshot@2008-07-21_20.22.56.51   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-20 19:05:20	163,328	----a-w	C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-07-22 02:26:37	1,744,896	----a-w	C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-07-22 02:26:37	409,600	----a-w	C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-07-20 19:05:20	163,328	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-07-22 02:26:36	1,744,896	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-07-22 02:26:36	409,600	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-07-22 00:50:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat
+ 2008-07-22 02:25:06	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat
- 2008-07-22 00:50:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Historial\History.IE5\index.dat
+ 2008-07-22 02:25:06	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Historial\History.IE5\index.dat
- 2008-07-22 00:50:58	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-22 02:25:06	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-22 01:10:43	26,824	----a-w	C:\WINDOWS\system32\drivers\avgmfx86.sys
.
(((((((((((((((((((((((((((((((((   Cargando Puntos Reg   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:12 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"RemoteControl"="C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="C:\WINDOWS\system32\MSTMON_Q.EXE" [2004-08-04 03:52 163840]
"SunJavaUpdateSched"="C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"AVG8_TRAY"="C:\ARCHIV~1\AVG\AVG8\avgtray.exe" [2008-07-21 20:40 1232152]
"VTTimer"="VTTimer.exe" [2007-12-20 16:35 77824 C:\WINDOWS\system32\VTTimer.exe]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"VIDC.PVW2"= pvwv220.dll
"VIDC.PIMJ"= pvljpg20.dll
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"=
"C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"=
 
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 10:43]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:19]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 10:40]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-21 20:40]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\ARCHIV~1\AVG\AVG8\avgemc.exe [2008-07-21 20:40]
R2 avg8wd;AVG Free8 WatchDog;C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe [2008-07-21 20:40]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-21 20:40]
R2 MLPTDR_Q;MLPTDR_Q;C:\WINDOWS\system32\MLPTDR_Q.sys [2003-07-22 03:14]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:24]
R3 ROCKEYNT;Feitian ROCKEY4 Device Service;C:\WINDOWS\system32\DRIVERS\Rockey4.sys [2008-07-13 06:03]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2008-02-18 17:17]
S3 Rockey_USB;Feitian ROCKEY4 USB Service;C:\WINDOWS\system32\DRIVERS\Rockey4USB.sys [2008-07-13 06:03]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:33:04
Windows 5.1.2600 Service Pack 2 NTFS
 
escaneando procesos ocultos ...
 
escaneando entradas ocultas de autostart ...
 
escaneando archivos ocultos ...
 
el escaneo se completo con exito
archivos ocultos: 0
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Archivos de programa\AVG\AVG8\avgrsx.exe
C:\Archivos de programa\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Tiempo completado: 2008-07-21 22:35:40 - machine was rebooted
ComboFix-quarantined-files.txt  2008-07-22 03:05:37
ComboFix2.txt  2008-07-22 00:54:02
 
Pre-Run: 208,742,477,824 bytes libres
Post-Run: 208,742,342,656 bytes libres
 
223	--- E O F ---	2008-04-18 19:46:41

Open in new window

Good job, thanks for the log.
Can you attach a fresh hijackthis log too please?

I also need you to do an online scan with Kaspersky to check if it finds any bad files, just to confirm that the pc is clean. Save the report please.

Using Internet Explorer, run Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner
   
* Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
          o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
          o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As...' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.

Avatar of suply

ASKER

Hello rpggamergirl, online scan with Kaspersky
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Tuesday, July 22, 2008
 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Tuesday, July 22, 2008 09:38:14
 Records in database: 984243
--------------------------------------------------------------------------------
 
Scan settings:
	Scan using the following database: extended
	Scan archives: yes
	Scan mail databases: yes
 
Scan area - My Computer:
	C:\
	D:\
	E:\
 
Scan statistics:
	Files scanned: 38563
	Threat name: 1
	Infected objects: 1
	Suspicious objects: 0
	Duration of the scan: 00:30:37
 
 
File name / Threat name / Threats count
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Identities\{85A0C99D-C38D-4E30-B85F-F50554C088C3}\Microsoft\Outlook Express\Bandeja de salida.dbx	Infected: Trojan-Spy.Win32.KeySpy.x	1
 
The selected area was scanned.

Open in new window

Nice walkthrough rpggamergirl, you deserve extra brownie points! =]
Avatar of suply

ASKER

and here is the fresh hijackthis
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:05:04 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\ARCHIV~1\AVG\AVG8\avgrsx.exe
C:\ARCHIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\ARCHIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\DynDNS Updater\DynTray.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\ARCHIV~1\AVG\AVG8\aAvgApi.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrador\Escritorio\HiJackThis.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Archivos de programa\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARCHIV~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: DynDNS Updater Tray Icon.lnk = C:\Archivos de programa\DynDNS Updater\DynTray.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 6572 bytes

Open in new window

ASKER CERTIFIED SOLUTION
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of suply

ASKER

rpggamergirl, Im very pleased with your dedication and outstanding profesionalism throughout the succesful solution of my virus problem.

Congratulations and Im very thankful!

suply

Avatar of suply

ASKER

Outstanding, thankyou!
suply,

You're welcome, it's a pleasure working with you.
Thank you for the nice feedback, I very much appreciate it.

Now that you're done with combofix, please uninstall it.
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

The procedure will delete ComboFix and its associated files and folders.
It will also reset System Restore.


Thank you for using Experts-Exchange!