Question

How do I scan and remove a virus from my computer, opened zip file by mistake

Asked by: suply

I recently received in my hotmail inbox an email I thought it was from UPS but then realized it was a Virus once It was too late I had already opened the file.

UPS Tracking Number 4606078241
From: United Parcel Service (favjulfo@bow-group.com)
Sent: Sun 7/20/08 7:44 PM
To:

Security scan upon download
ups_invoi...zip (48.4 KB)
Unfortunately we were not able to deliver postal package you sent on July the 1st in timebecause the recipients address is not correct.Please print out the invoice copy attached and collect the package at our office Your UPS

I would like to know what type of theat could I have in my computer and what is the most convinient way to remove the virus from its unknown alocation inside the unit.

Im unable to upload the file due to the extension its a .exe

This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

Plus...

30 Day FREE access, no risk, no obligation
Collaborate with the world's top tech experts
Unlimited access to our exclusive solution database
Never be left without tech help again

Subscribe Now

Asked On: 2008-07-21 at 14:51:28ID23583530
Tags: UPS Tracking Number 4606078241
Topic: Email Anti-Virus
Participating Experts: 2
Points: 500
Comments: 21

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

"The time we save is the biggest benefit of Experts Exchange to Warner Bros. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange." Mike Kapnisakis, Warner Bros.
"Our team likes having a resource that is more secure than just using Google and most experts using this service really know their stuff. It's nice to look here first versus using Google." Dayna Sellner, Lockheed Martin
"Anytime that I've been stumped with a problem, 9 out of 10 times Experts Exchange has either the accepted solution or an open discussion of the potential solution to the problem." Kenny Red, eBay Inc.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.

Screenshot of Experts Exchange Knowledgebase

Need individual assistance?

Our experts are ready to help.

If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.

Want to learn from the best?

Read articles from industry experts.

Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.

Working on a long term project?

Store your work and research.

Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.

Access the answers to your technology questions today.

Subscribe Now

30-day free trial. Register in 60 seconds.

What Makes Experts Exchange Unique?

Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.

Trusted by the world's most respected brands.

image of each brand's logo

Faithfully serving IT professionals since 1996.

Experts Exchange Logo

Try it out and discover for yourself.

Subscribe Now

30-day free trial. Register in 60 seconds.

Free Tech Articles

WARNING: 5 Reasons why you should NEVER fix a computer for free.
It is in our nature to love the puzzle. We are obsessed. The lot of us. We love puzzles. We love the challenge. We thrive on finding the answer. We hate disarray. It bothers us deep in our soul. W...
SCCM OSD Basic troubleshooting
SCCM 2007 OSD is a fantastic way to deploy operating systems, however, like most things SCCM issues can sometimes be difficult to resolve due to the sheer volume of logs to sift through and the dispe...
Migrate Small Business Server 2003 to Exchange 2010 and Windows 2008 R2
This guide is intended to provide step by step instructions on how to migrate from Small Business Server 2003 to Windows 2008 R2 with Exchange 2010. For this migration to work you will need the fo...
Create a Win7 Gadget
This article shows you how to create a simple "Gadget" -- a sort of mini-application supported by Windows 7 and Vista. Gadgets can be dropped anywhere on the desktop to provide instant information, ...
Outlook continually prompting for username and password
There have been a lot of questions recently regarding Outlook prompting for a username and password whilst using Exchange 2007. There are a few reasons why this would happen and I will try to cover t...
Backup Exchange 2010 Information Store using Windows Backup
There seems to be quite a lot of confusion around the ability to backup Exchange 2010 using the built in Windows Backup feature. This stems from the omission of this feature prior to Exchange 2007 s...

Cloud Class Webinars

Avoiding Bugs in Microsoft Access
Alison Balter takes and in-depth look at avoiding bugs in Access. In this webinar you will learn about using the immediate window to debug your applications, invoking the debugger, using breakpoints to troubleshoot, stepping through code, setting the next statement to execute, ...
Top 10 Best New Features in Visio 2010
Scott Helmers gives live demonstrations of the top 10 new features in Visio 2010. This webinar will teach you how to create compelling diagrams by adding shapes to the page with a single click, linking the shapes in a diagram to data in Excel (or SQL Server, or SharePoint), ...
IT Consultant Business Secrets Revealed
Michael Munger, Experts Exchange tech pro and IT consultant, pulls back the curtain on his very successful businesses and answers question on every IT consultant and business owner should know about. He shares secrets on what he did to solve the 5 most common problems in IT, ...
Disaster Recovery and Business Continuity
Quest CTO, Mike Billon, gives an overview of the steps involved in building a dunamic disaster recovery plan. Through case studies and an examination of software/hardware tooles for monitoring and testing, you'll gain a better understandin of where you are, where you want ...
Organize Your Visio Diagrams with Containers and Lists
Scott Helmers uses cross functional flowcharts, wireframe diagrams, data graphic legends and seating charts to teach you: how to ustilize all three new structured diagram components in Visio 2010, the best practices for organizeing shapes in previous version of Visio, how to organize ...
How to Us Objects, Properties, Events and Methods in Microsoft Access
Alison Dalter gives an in-depbth look at objects, properties, events and methods in Microsoft Access. In this webinar you will learn about using the object browser, referring to objects, working with properties and methods, working with object variables, understanding the ...

Watch More

Join the Community

Give a Little. Get a Lot.

Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.

Join the Community

Answers

by: dfxdeimosPosted on 2008-07-21 at 14:56:28ID: 22054683

You have a couple of options here:

1) If you already have an anti-virus on your computer you can simply initiate a full system scan and (in most cases) it will find and quarantine / delete the virus.

2) If you do not want to purchase an antivirus program you can download and install the AVG Free Edition (http://free.avg.com/) and then perform a full system scan and it should pick up and quarantine / delete the virus.

3) If you would like to purchase an antivirus program you can visit (and this is just my personal preference) http://www.kaspersky.com/ and purchase / download their antivirus application, install it, then perform a full system scan.

Good Luck.

by: rpggamergirlPosted on 2008-07-21 at 16:23:20ID: 22055307

Scanning the system with an antivirus scanner usually will remove common viruses. Sometimes antivirus scanners can't remove some viruses especially malware.

It would help if we could look at a hijackthis log, it might show in the scan or if it comes with malware it should show in the hijackthis log.
Download Hijackthis:
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Open Hijackthis, click "Do a system scan and save a logfile" please don't fix anything yet.
Please attach the logfile as "Code Snippet".

by: suplyPosted on 2008-07-21 at 16:46:34ID: 22055424

Hello dfxdeimos, Im unable to run avg, I have installation problems below:

Local machine: installation failed
Installation:
Error: Action failed for file avgemc.exe: starting service....
Error 0x8007041d
Warning: Preparation to unload of the service avg8wd failed.
Specified file was not found.
Rollback:
Error: Action failed for file avgwd.log: restoring from backup....
Error 0x80070005 %DESTINATION% = "C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log", %SOURCE% = "C:\Documents and Settings\All Users\Datos de programa\avg8\Log\avgwd.log.install_backup"
Warning: Action failed for file avgmfx86.sys: stopping service....
Service AvgMfx86 failed to progress during stopping at checpoint 0 (wait hint 10000 ms) in 91000 ms.

Any suggestions, Thankyou

by: suplyPosted on 2008-07-21 at 17:02:18ID: 22055487

Hello rpggamergirl, I downloaded the hijackthis but it wont run the file. Im unable to perform a scan. I double click on the Icon and it wont do anything.

Thanks

by: rpggamergirlPosted on 2008-07-21 at 17:05:41ID: 22055503

Did you try renaming it?.....if it still won't run try changing the exe extension to .com

by: suplyPosted on 2008-07-21 at 17:16:40ID: 22055541

Hello rpggamergirl, I had to rename hijackthis and also the log to be able to save it, here is the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:44:18 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Escritorio\hhhhh.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [braviax] braviax.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [braviax] C:\WINDOWS\system32\braviax.exe (User 'Default user')
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: cru629.dat
O20 - Winlogon Notify: crypt - C:\WINDOWS\SYSTEM32\crypts.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 5856 bytes

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:

Select all Open in new window

by: rpggamergirlPosted on 2008-07-21 at 17:33:20ID: 22055622

Well done!

No wonder you can't run any program braviax is there!

SDFix should be able to take care of it.. IF you can run it.
Do you have other pc there where you can download and extract SDFix before transfering it to the infected pc?
You need to rename SDFix before you saved it to your pc, or download and extract it using another pc. Let us know how you go. Once SDFix has been extracted braviax won't stop it from running.
Download SDFix and save it to your desktop.(either one below)
http://downloads.andymanchesta.com/RemovalTools/SDFix.zip
http://downloads.andymanchesta.com/RemovalTools/SDFix.exe

If needed: How to use SDFix.
http://www.bleepingcomputer.com/forums/topic131299.html

Double click SDFix and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

* Restart your computer
* After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
* Instead of Windows loading as normal, a menu with options should appear;
* Select the first option, to run Windows in Safe Mode, then press "Enter".
* Choose your usual account.

* Open the extracted folder and double click "RunThis.bat" to start the script.
* Type "Y" to begin the script.
* It will remove the Trojan Services then make some repairs to the registry and prompt you to press any key to Reboot.
* Press any Key and it will restart the PC.
* Your system will take longer that normal to restart as the fixtool will be running and removing files.
* When the desktop loads the Fixtool will complete the removal and display "Finished", then press any key to end the script and load your desktop icons.
* Finally open the SDFix folder on your desktop and attach the "Report.txt" back

by: rpggamergirlPosted on 2008-07-21 at 17:37:25ID: 22055644

Combofix will also remove it, but you need to rename combofix before saving it to your desktop, renaming it after it has been downloaded will not work, it has to be renamed before saving the file.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

by: suplyPosted on 2008-07-21 at 17:59:36ID: 22055749

rpggamergirl, here is the fresh hijackthis and the combofix log. Please advice.
Thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:59 PM, on 7/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\Documents and Settings\Administrador\Escritorio\hhhhh.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\ntos.exe,
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL (file missing)
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll (file missing)
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 5674 bytes
 
 
 
 
ComboFix 08-07-21.1 - Administrador 2008-07-21 20:15:42.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.58.3082.18.1612 [GMT -4.5:30]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\hello123.exe
 * Creado un nuevo punto de restauración
 
[color=red][b]ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! [/b][/color]
.
 
((((((((((((((((((((((((((((((((((((   Otras eliminaciones   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
[color=red]C:\WINDOWS\system32\dllcache\beep.sys[/color]
[color=red]C:\WINDOWS\system32\drivers\beep.sys[/color]
C:\WINDOWS\braviax.exe
C:\WINDOWS\cru629.dat
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\braviax.exe
C:\WINDOWS\system32\cru629.dat
C:\WINDOWS\system32\crypts.dll
C:\WINDOWS\system32\DelSelf.bat
C:\WINDOWS\system32\ntload.dll
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\system32\winupdate.exe
C:\WINDOWS\system32\wscmp.dll
C:\WINDOWS\system32\wsnpoem\audio.dll
C:\WINDOWS\system32\wsnpoem\video.dll
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TCPSR
-------\Service_tcpsr
 
 
((((((((((((((((((   Archivos creados desde 2008-06-22 - 2008-07-22  )))))))))))))))))))))))))))))))))
.
 
2008-07-21 20:21 . 	6,784		C:\WINDOWS\system32\drivers\tcpsr.sys
2008-07-21 19:29 . 2008-07-21 19:29	<DIR>	d--------	C:\Program Files
2008-07-21 19:16 . 2008-07-21 19:16	<DIR>	d--------	C:\Archivos de programa\Trend Micro
2008-07-21 19:01 . 2008-07-21 19:01	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\AVGTOOLBAR
2008-07-21 18:51 . 2008-07-21 19:09	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\avg8
2008-07-21 18:51 . 2008-07-21 18:51	<DIR>	d--------	C:\Archivos de programa\AVG
2008-07-21 17:09 . 2008-07-21 20:21	30,848	--a------	C:\WINDOWS\system32\drivers\Bbe41.sys
2008-07-21 16:27 . 2008-01-07 14:29	352	--ah-----	C:\WINDOWS\nod32fixtemdono.reg
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\ESET
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Archivos de programa\ESET
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\WINDOWS\Sun
2008-07-20 23:23 . 2008-07-21 04:29	<DIR>	d--------	C:\Documents and Settings\Administrador\.housecall6.6
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\Archivos de programa\Java
2008-07-20 23:23 . 2005-04-13 03:48	49,265	--a------	C:\WINDOWS\system32\jpicpl32.cpl
2008-07-20 23:21 . 2008-07-20 23:21	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Java
2008-07-20 22:48 . 2008-07-20 22:48	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\CyberLink
2008-07-17 05:08 . 2008-07-17 05:08	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\CyberLink
2008-07-17 03:53 . 2008-07-17 03:53	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\supportsoft
2008-07-17 03:53 . 2007-07-30 14:44	3,518,464	--a------	C:\WINDOWS\system32\cdintf300.dll
2008-07-17 03:53 . 2007-06-28 14:09	1,843,200	--a------	C:\WINDOWS\system32\acXMLParser.dll
2008-07-17 03:51 . 2008-07-17 19:20	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:51	<DIR>	d--------	C:\Archivos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:52	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Intuit
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\COMMON FILES
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Archivos de programa\MSXML 4.0
2008-07-15 19:46 . 2003-06-19 01:31	17,920	--a------	C:\WINDOWS\system32\mdimon.dll
2008-07-15 19:46 . 2008-07-15 19:46	379	--a------	C:\WINDOWS\ODBC.INI
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\WINDOWS\SHELLNEW
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\Archivos de programa\Microsoft.NET
2008-07-15 19:43 . 2008-07-15 19:43	<DIR>	dr-h-----	C:\MSOCache
2008-07-15 03:32 . 2008-07-15 03:35	<DIR>	d--------	C:\Archivos de programa\SVS Server SVS-30
2008-07-15 03:32 . 2001-06-23 14:04	319,488	--a------	C:\WINDOWS\system32\pvwv220.dll
2008-07-15 03:32 . 2001-06-23 14:04	294,912	--a------	C:\WINDOWS\system32\pvmjpg21.dll
2008-07-15 03:32 . 2001-06-23 14:04	188,416	--a------	C:\WINDOWS\system32\pvljpg20.dll
2008-07-15 03:32 . 2001-03-07 15:30	108,064	--a------	C:\WINDOWS\system32\UNPICVID2.EXE
2008-07-15 03:32 . 2001-05-08 12:23	107,057	--a------	C:\WINDOWS\system32\pvmjpg21.hlp
2008-07-15 03:32 . 1997-07-03 09:44	82,864	--a------	C:\WINDOWS\system32\UNWISE.EXE
2008-07-15 03:30 . 2008-07-17 05:22	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\U3
2008-07-14 18:35 . 2008-07-14 18:35	<DIR>	d--------	C:\Archivos de programa\OSI Codes Inc
2008-07-13 20:03 . 2008-07-14 18:47	<DIR>	d--------	C:\Archivos de programa\Google
2008-07-13 06:03 . 2008-07-13 06:06	<DIR>	d--------	C:\APVWIN
2008-07-13 00:15 . 2008-07-13 00:15	<DIR>	d--------	C:\Documents and Settings\Administrador\Contacts
2008-07-12 22:17 . 2008-07-12 22:17	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\Leadertech
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\DataViz
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Documents To Go
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\DataViz
2008-07-12 22:12 . 2008-07-12 22:12	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\HotSync
2008-07-12 22:12 . 2008-07-12 22:17	<DIR>	d--------	C:\Archivos de programa\Palm
2008-07-12 22:12 . 2008-07-12 22:11	53,248	--a------	C:\WINDOWS\PalmDevC.dll
2008-07-12 22:11 . 2008-07-21 19:09	<DIR>	d--hs----	C:\WINDOWS\Installer
2008-07-12 22:11 . 2008-07-12 22:11	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\HotSync
2008-07-12 22:07 . 2003-12-09 21:42	147,456	-ra------	C:\WINDOWS\system32\MUINST_Q.EXE
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-12 22:07 . 2003-08-01 22:14	2,054	-ra------	C:\WINDOWS\system32\MUNZ___Q.UNM
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\USB20
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\ALIEHCI
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\Drivers
2008-07-12 22:01 . 2004-01-15 14:36	55,680	--a------	C:\WINDOWS\system32\drivers\ousb2hub.sys
2008-07-12 22:01 . 2004-01-15 14:36	42,624	--a------	C:\WINDOWS\system32\drivers\ousbehci.sys
2008-07-12 22:01 . 2001-11-13 21:24	35,587	---------	C:\WINDOWS\system32\rmORGusb20.EXE
2008-07-12 22:01 . 2003-06-18 18:16	28,672	---------	C:\WINDOWS\system32\UnORGusb20.exe
2008-07-12 22:01 . 2004-02-25 17:51	651	--a------	C:\WINDOWS\system32\setup.iss
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\drivers\usbohci.sys
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\dllcache\usbohci.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-02 11:10 . 2008-07-02 11:10	<DIR>	d--------	C:\Archivos de programa\CyberLink
2008-07-02 11:08 . 2004-08-03 23:08	26,496	--a------	C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-02 10:02 . 2004-08-03 22:29	250,640	-rahs----	C:\ntldr
2008-07-02 10:02 . 2001-08-24 05:30	4,952	-rahs----	C:\Bootfont.bin
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Reciente
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Plantillas
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Mis documentos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-------	C:\WINDOWS\system32\config\systemprofile\Men£ Inicio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Impresoras
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Favoritos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Escritorio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Entorno de red
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Datos de programa
2008-07-02 10:00 . 2008-07-21 20:19	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Configuraci¢n local
 
.
((((((((((((((((((((((((((((((((((((((   Reporte Find3M   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 10:33	4,096	----a-w	C:\WINDOWS\system32\Ry4CoInst.dll
2008-07-13 10:33	22,016	----a-w	C:\WINDOWS\system32\drivers\Rockey4.sys
2008-07-13 10:33	12,928	----a-w	C:\WINDOWS\system32\drivers\Rockey4USB.sys
2008-07-13 02:41	16,694	----a-w	C:\WINDOWS\system32\drivers\PalmUSBD.sys
2008-07-13 02:31	---------	d--h--w	C:\Archivos de programa\InstallShield Installation Information
2008-07-02 15:39	---------	d-----w	C:\Archivos de programa\Archivos comunes\InstallShield
2008-07-02 14:29	---------	d-----w	C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Adobe
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Windows Media Connect 2
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\VIA
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Servicios en línea
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\S3
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\nu
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Nero
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\MSN Messenger
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\microsoft frontpage
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\HighMAT CD Writing Wizard
.
 
(((((((((((((((((((((((((((((((((   Cargando Puntos Reg   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:12 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"RemoteControl"="C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="C:\WINDOWS\system32\MSTMON_Q.EXE" [2004-08-04 03:52 163840]
"SunJavaUpdateSched"="C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"VTTimer"="VTTimer.exe" [2007-12-20 16:35 77824 C:\WINDOWS\system32\VTTimer.exe]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\userinit.exe,C:\\WINDOWS\\system32\\ntos.exe,"
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"VIDC.PVW2"= pvwv220.dll
"VIDC.PIMJ"= pvljpg20.dll
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Bbe41.sys]
@="Driver"
 
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
 
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
 
*Newly Created Service* - TCPSR
.
- - - - ORPHANS REMOVED - - - -
 
HKLM-Run-NWEReboot - (no file)
 
 
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.google.com
R0 -: HKLM-Main,Start Page = hxxp://www.google.com
O8 -: E&xportar a Microsoft Excel - C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
 
O16 -: {2E28242B-A689-11D4-80F2-0040266CBB8D} - hxxp://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
C:\WINDOWS\Downloaded Program Files\kxhcm10.ocx
 
O16 -: {33704B0F-9EB7-434B-B752-EA6CFFB87423} - hxxp://sacam2.viewnetcam.com:5002/JpegInst.cab
C:\WINDOWS\Downloaded Program Files\install.inf
C:\WINDOWS\Downloaded Program Files\pmjpegcam.ocx
C:\WINDOWS\Downloaded Program Files\pmjpegaudio.ocx
 
 
**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 20:21:32
Windows 5.1.2600 Service Pack 2 NTFS
 
escaneando procesos ocultos ...
 
escaneando entradas ocultas de autostart ...
 
escaneando archivos ocultos ...
 
 
C:\WINDOWS\system32\ntos.exe 408576 bytes executable
C:\WINDOWS\system32\wsnpoem
 
el escaneo se completo con exito
archivos ocultos: 2
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\WINDOWS\system32\wscntfy.exe
.
**************************************************************************
.
Tiempo completado: 2008-07-21 20:23:59 - machine was rebooted
ComboFix-quarantined-files.txt  2008-07-22 00:53:53
 
Pre-Run: 208,697,622,528 bytes libres
Post-Run: 208,995,667,968 bytes libres
 
219	--- E O F ---	2008-04-18 19:46:41

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:
251:
252:
253:
254:
255:
256:
257:
258:
259:
260:
261:
262:
263:
264:
265:
266:
267:
268:
269:
270:
271:
272:
273:
274:
275:
276:
277:
278:
279:
280:
281:
282:
283:
284:
285:
286:
287:
288:
289:
290:
291:
292:
293:
294:
295:
296:
297:
298:
299:
300:
301:
302:
303:
304:
305:
306:
307:
308:
309:
310:
311:
312:
313:
314:
315:
316:
317:
318:
319:
320:
321:
322:
323:
324:
325:
326:
327:
328:
329:
330:
331:
332:
333:
334:
335:

Select all Open in new window

by: rpggamergirlPosted on 2008-07-21 at 18:50:22ID: 22056008

Did you try running SDFix as well?

Can you please check if it runs? in Safe Mode.
Braviax patches beep.sys, and I think SDFix also includes a clean copy of beep.sys

I'll post the script later.

by: suplyPosted on 2008-07-21 at 19:11:06ID: 22056059

rpggamergirl, here is the log for sdfix.

[b]SDFix: Version 1.207 [/b]
Run by Administrador on Mon 07/21/2008 at 10:01 PM
 
Microsoft Windows XP [Versi¢n 5.1.2600]
Running From: C:\SDFix
 
[b]Checking Services [/b]:
 
[b]Name [/b]: 
BBE41
 
[b]Path [/b]:
System32\Drivers\Bbe41.sys 
 
BBE41 - Deleted
 
 
 
Restoring Default Security Values
Restoring Default Hosts File
 
Rebooting
 
Service BBE41 - Deleted
 
[b]Checking Files [/b]: 
 
Trojan Files Found:
 
C:\WINDOWS\system32\ntos.exe  - Deleted
C:\WINDOWS\system32\drivers\BBE41.sys - Deleted
C:\WINDOWS\system32\wsnpoem\video.dll - Deleted
C:\WINDOWS\system32\wsnpoem\audio.dll - Deleted
 
 
 
Folder C:\WINDOWS\system32\wsnpoem - Removed
 
 
Removing Temp Files
 
[b]ADS Check [/b]:
 
 
 
                                 [b]Final Check [/b]:
 
catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:07:04
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...
 
scanning hidden services & system hive ...
 
scanning hidden registry entries ...
 
scanning hidden files ...
 
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
 
 
[b]Remaining Services [/b]:
 
 
 
 
Authorized Application Key Export:
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"="C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe:*:Enabled:QuickBooks 2008 Data Manager"
"C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe:*:Enabled:avgemc.exe"
"C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"="C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe:*:Enabled:avgupd.exe"
 
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"="C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"="C:\\Archivos de programa\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
 
[b]Remaining Files [/b]:
 
 
File Backups: - C:\SDFix\backups\backups.zip
 
[b]Files with Hidden Attributes [/b]:
 
Mon  7 Jan 2008           352 A..H. --- "C:\WINDOWS\nod32fixtemdono.reg"
Wed 13 Oct 2004     1,694,208 A.SH. --- "C:\Archivos de programa\Messenger\msmsgs.exe"
Wed 15 Aug 2007       782,336 A.SH. --- "C:\Documents and Settings\Administrador\Mis documentos\FOTOS CITATION\SIVF.tmp"
Fri 18 Apr 2008             0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu  7 Dec 2006     3,096,576 A..H. --- "C:\Documents and Settings\Administrador\Datos de programa\U3\temp\Launchpad Removal.exe"
Wed 11 Aug 2004       444,416 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\Copia de VALUACION UC\Copia de VALUACION 5\~WRL1204.tmp"
Sun 26 Jun 2005     1,407,488 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL1175.tmp"
Sun 26 Jun 2005     1,483,776 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL2120.tmp"
Sun 26 Jun 2005     1,401,856 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\Copia (2) de VALUACION 02\~WRL3926.tmp"
Sun 26 Jun 2005     1,407,488 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL1175.tmp"
Sun 26 Jun 2005     1,483,776 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL2120.tmp"
Sun 26 Jun 2005     1,401,856 A..H. --- "C:\Documents and Settings\Administrador\Mis documentos\respaldo\BK_Pen24Feb\VALUACION 10114E\VALUACION 02\~WRL3926.tmp"
 
[b]Finished![/b]

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:

Select all Open in new window

by: rpggamergirlPosted on 2008-07-21 at 19:22:39ID: 22056091

That's great! looks like maybe just one more left.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
Rootkit::
C:\WINDOWS\system32\drivers\tcpsr.sys
------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

NOTE: You need to change ALL passwords that has been used in that pc, these nasties are password and info stealers.

by: suplyPosted on 2008-07-21 at 19:56:52ID: 22056169

rpggamergirl, I draged the cfscript into the combofix and this is the new log

ComboFix 08-07-21.1 - Administrador 2008-07-21 22:30:49.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.2.1252.58.3082.18.1552 [GMT -4.5:30]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\hello123.exe
Command switches used :: C:\Documents and Settings\Administrador\Escritorio\CFScript.txt
 * Creado un nuevo punto de restauración
 
[color=red][b]ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION! [/b][/color]
.
 
((((((((((((((((((((((((((((((((((((   Otras eliminaciones   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\WINDOWS\system32\drivers\tcpsr.sys
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TCPSR
 
 
((((((((((((((((((   Archivos creados desde 2008-06-22 - 2008-07-22  )))))))))))))))))))))))))))))))))
.
 
2008-07-21 21:56 . 2008-07-21 21:56	<DIR>	d--------	C:\WINDOWS\ERUNT
2008-07-21 21:55 . 2008-07-21 22:07	<DIR>	d--------	C:\SDFix
2008-07-21 21:37 . 2008-07-21 21:37	<DIR>	d--h-----	C:\$AVG8.VAULT$
2008-07-21 20:40 . 2008-07-21 20:42	<DIR>	d--------	C:\WINDOWS\system32\drivers\Avg
2008-07-21 20:40 . 2008-07-21 20:40	96,520	--a------	C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-21 20:40 . 2008-07-21 20:40	76,040	--a------	C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-21 20:40 . 2008-07-21 20:40	10,520	--a------	C:\WINDOWS\system32\avgrsstx.dll
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\NetworkService\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\LocalService\Configuración local
2008-07-21 20:24 . 2008-07-21 20:24	<DIR>	d--------	C:\Documents and Settings\Administrador\Configuración local
2008-07-21 19:29 . 2008-07-21 19:29	<DIR>	d--------	C:\Program Files
2008-07-21 19:16 . 2008-07-21 19:16	<DIR>	d--------	C:\Archivos de programa\Trend Micro
2008-07-21 19:01 . 2008-07-21 20:42	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\AVGTOOLBAR
2008-07-21 18:51 . 2008-07-21 20:40	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\avg8
2008-07-21 18:51 . 2008-07-21 18:51	<DIR>	d--------	C:\Archivos de programa\AVG
2008-07-21 16:27 . 2008-01-07 14:29	352	--ah-----	C:\WINDOWS\nod32fixtemdono.reg
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\ESET
2008-07-21 16:23 . 2008-07-21 16:23	<DIR>	d--------	C:\Archivos de programa\ESET
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\WINDOWS\Sun
2008-07-20 23:23 . 2008-07-21 04:29	<DIR>	d--------	C:\Documents and Settings\Administrador\.housecall6.6
2008-07-20 23:23 . 2008-07-20 23:23	<DIR>	d--------	C:\Archivos de programa\Java
2008-07-20 23:23 . 2005-04-13 03:48	49,265	--a------	C:\WINDOWS\system32\jpicpl32.cpl
2008-07-20 23:21 . 2008-07-20 23:21	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Java
2008-07-20 22:48 . 2008-07-20 22:48	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\CyberLink
2008-07-17 05:08 . 2008-07-17 05:08	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\CyberLink
2008-07-17 03:53 . 2008-07-17 03:53	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\supportsoft
2008-07-17 03:53 . 2007-07-30 14:44	3,518,464	--a------	C:\WINDOWS\system32\cdintf300.dll
2008-07-17 03:53 . 2007-06-28 14:09	1,843,200	--a------	C:\WINDOWS\system32\acXMLParser.dll
2008-07-17 03:51 . 2008-07-17 19:20	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:51	<DIR>	d--------	C:\Archivos de programa\Intuit
2008-07-17 03:51 . 2008-07-17 03:52	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\Intuit
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\COMMON FILES
2008-07-17 03:50 . 2008-07-17 03:50	<DIR>	d--------	C:\Archivos de programa\MSXML 4.0
2008-07-15 19:46 . 2003-06-19 01:31	17,920	--a------	C:\WINDOWS\system32\mdimon.dll
2008-07-15 19:46 . 2008-07-15 19:46	379	--a------	C:\WINDOWS\ODBC.INI
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\WINDOWS\SHELLNEW
2008-07-15 19:45 . 2008-07-15 19:45	<DIR>	d--------	C:\Archivos de programa\Microsoft.NET
2008-07-15 19:43 . 2008-07-15 19:43	<DIR>	dr-h-----	C:\MSOCache
2008-07-15 03:32 . 2008-07-15 03:35	<DIR>	d--------	C:\Archivos de programa\SVS Server SVS-30
2008-07-15 03:32 . 2001-06-23 14:04	319,488	--a------	C:\WINDOWS\system32\pvwv220.dll
2008-07-15 03:32 . 2001-06-23 14:04	294,912	--a------	C:\WINDOWS\system32\pvmjpg21.dll
2008-07-15 03:32 . 2001-06-23 14:04	188,416	--a------	C:\WINDOWS\system32\pvljpg20.dll
2008-07-15 03:32 . 2001-03-07 15:30	108,064	--a------	C:\WINDOWS\system32\UNPICVID2.EXE
2008-07-15 03:32 . 2001-05-08 12:23	107,057	--a------	C:\WINDOWS\system32\pvmjpg21.hlp
2008-07-15 03:32 . 1997-07-03 09:44	82,864	--a------	C:\WINDOWS\system32\UNWISE.EXE
2008-07-15 03:30 . 2008-07-17 05:22	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\U3
2008-07-14 18:35 . 2008-07-14 18:35	<DIR>	d--------	C:\Archivos de programa\OSI Codes Inc
2008-07-13 20:03 . 2008-07-14 18:47	<DIR>	d--------	C:\Archivos de programa\Google
2008-07-13 06:03 . 2008-07-13 06:06	<DIR>	d--------	C:\APVWIN
2008-07-13 00:15 . 2008-07-13 00:15	<DIR>	d--------	C:\Documents and Settings\Administrador\Contacts
2008-07-12 22:17 . 2008-07-12 22:17	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\Leadertech
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\DataViz
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Documents To Go
2008-07-12 22:13 . 2008-07-12 22:13	<DIR>	d--------	C:\Archivos de programa\Archivos comunes\DataViz
2008-07-12 22:12 . 2008-07-12 22:12	<DIR>	d--------	C:\Documents and Settings\All Users\Datos de programa\HotSync
2008-07-12 22:12 . 2008-07-12 22:17	<DIR>	d--------	C:\Archivos de programa\Palm
2008-07-12 22:12 . 2008-07-12 22:11	53,248	--a------	C:\WINDOWS\PalmDevC.dll
2008-07-12 22:11 . 2008-07-21 20:40	<DIR>	d--hs----	C:\WINDOWS\Installer
2008-07-12 22:11 . 2008-07-12 22:11	<DIR>	d--------	C:\Documents and Settings\Administrador\Datos de programa\HotSync
2008-07-12 22:07 . 2003-12-09 21:42	147,456	-ra------	C:\WINDOWS\system32\MUINST_Q.EXE
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\drivers\usbprint.sys
2008-07-12 22:07 . 2004-08-03 23:01	25,856	--a------	C:\WINDOWS\system32\dllcache\usbprint.sys
2008-07-12 22:07 . 2003-08-01 22:14	2,054	-ra------	C:\WINDOWS\system32\MUNZ___Q.UNM
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\USB20
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\system32\ALIEHCI
2008-07-12 22:01 . 2008-07-12 22:01	<DIR>	d--------	C:\WINDOWS\Drivers
2008-07-12 22:01 . 2004-01-15 14:36	55,680	--a------	C:\WINDOWS\system32\drivers\ousb2hub.sys
2008-07-12 22:01 . 2004-01-15 14:36	42,624	--a------	C:\WINDOWS\system32\drivers\ousbehci.sys
2008-07-12 22:01 . 2001-11-13 21:24	35,587	---------	C:\WINDOWS\system32\rmORGusb20.EXE
2008-07-12 22:01 . 2003-06-18 18:16	28,672	---------	C:\WINDOWS\system32\UnORGusb20.exe
2008-07-12 22:01 . 2004-02-25 17:51	651	--a------	C:\WINDOWS\system32\setup.iss
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\drivers\usbohci.sys
2008-07-12 21:19 . 2004-08-03 23:08	17,024	--a------	C:\WINDOWS\system32\dllcache\usbohci.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\drivers\usbccgp.sys
2008-07-12 20:01 . 2004-08-03 23:08	31,616	--a------	C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:42	21,504	--a------	C:\WINDOWS\system32\dllcache\hidserv.dll
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\drivers\kbdhid.sys
2008-07-12 20:01 . 2004-08-19 15:28	14,976	--a------	C:\WINDOWS\system32\dllcache\kbdhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\drivers\mouhid.sys
2008-07-12 20:01 . 2001-08-22 21:34	12,416	--a------	C:\WINDOWS\system32\dllcache\mouhid.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-12 20:01 . 2001-08-17 22:02	9,600	--a------	C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-02 11:10 . 2008-07-02 11:10	<DIR>	d--------	C:\Archivos de programa\CyberLink
2008-07-02 11:08 . 2004-08-03 23:08	26,496	--a------	C:\WINDOWS\system32\dllcache\usbstor.sys
2008-07-02 10:02 . 2004-08-03 22:29	250,640	-rahs----	C:\ntldr
2008-07-02 10:02 . 2001-08-24 05:30	4,952	-rahs----	C:\Bootfont.bin
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Reciente
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Plantillas
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Mis documentos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-------	C:\WINDOWS\system32\config\systemprofile\Men£ Inicio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Impresoras
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Favoritos
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--------	C:\WINDOWS\system32\config\systemprofile\Escritorio
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	d--h-----	C:\WINDOWS\system32\config\systemprofile\Entorno de red
2008-07-02 10:00 . 2008-07-02 10:00	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Datos de programa
2008-07-02 10:00 . 2008-07-21 22:31	<DIR>	dr-h-----	C:\WINDOWS\system32\config\systemprofile\Configuraci¢n local
 
.
((((((((((((((((((((((((((((((((((((((   Reporte Find3M   )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-13 10:33	22,016	----a-w	C:\WINDOWS\system32\drivers\Rockey4.sys
2008-07-13 10:33	12,928	----a-w	C:\WINDOWS\system32\drivers\Rockey4USB.sys
2008-07-13 02:41	16,694	----a-w	C:\WINDOWS\system32\drivers\PalmUSBD.sys
2008-07-13 02:31	---------	d--h--w	C:\Archivos de programa\InstallShield Installation Information
2008-07-02 15:39	---------	d-----w	C:\Archivos de programa\Archivos comunes\InstallShield
2008-07-02 14:29	---------	d-----w	C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Ahead
2008-07-02 14:29	---------	d-----w	C:\Archivos de programa\Archivos comunes\Adobe
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Windows Media Connect 2
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\VIA
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Servicios en línea
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\S3
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\nu
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\Nero
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\MSN Messenger
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\microsoft frontpage
2008-07-02 14:28	---------	d-----w	C:\Archivos de programa\HighMAT CD Writing Wizard
.
 
(((((((((((((((((((((((((((((   snapshot@2008-07-21_20.22.56.51   )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-20 19:05:20	163,328	----a-w	C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-07-22 02:26:37	1,744,896	----a-w	C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-07-22 02:26:37	409,600	----a-w	C:\WINDOWS\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat
+ 2008-07-20 19:05:20	163,328	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-07-22 02:26:36	1,744,896	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT
+ 2008-07-22 02:26:36	409,600	----a-w	C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat
- 2008-07-22 00:50:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat
+ 2008-07-22 02:25:06	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat
- 2008-07-22 00:50:58	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Historial\History.IE5\index.dat
+ 2008-07-22 02:25:06	32,768	----a-w	C:\WINDOWS\system32\config\systemprofile\Configuración local\Historial\History.IE5\index.dat
- 2008-07-22 00:50:58	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-22 02:25:06	16,384	----a-w	C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-07-22 01:10:43	26,824	----a-w	C:\WINDOWS\system32\drivers\avgmfx86.sys
.
(((((((((((((((((((((((((((((((((   Cargando Puntos Reg   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* entradas vac¡as & entradas leg¡timas predeterminadas no son mostradas
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:12 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"RemoteControl"="C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"KONICA MINOLTA PagePro 1350WStatusDisplay"="C:\WINDOWS\system32\MSTMON_Q.EXE" [2004-08-04 03:52 163840]
"SunJavaUpdateSched"="C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe" [2005-04-13 03:48 36975]
"AVG8_TRAY"="C:\ARCHIV~1\AVG\AVG8\avgtray.exe" [2008-07-21 20:40 1232152]
"VTTimer"="VTTimer.exe" [2007-12-20 16:35 77824 C:\WINDOWS\system32\VTTimer.exe]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=avgrsstx.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.MJPG"= pvmjpg21.dll
"VIDC.PVW2"= pvwv220.dll
"VIDC.PIMJ"= pvljpg20.dll
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\MSN Messenger\\msnmsgr.exe"=
"C:\\Archivos de programa\\MSN Messenger\\livecall.exe"=
"C:\\Archivos de programa\\Intuit\\QuickBooks 2008\\QBDBMgrN.exe"=
"C:\\Archivos de programa\\AVG\\AVG8\\avgemc.exe"=
"C:\\Archivos de programa\\AVG\\AVG8\\avgupd.exe"=
 
R0 ViBus;ViBus;C:\WINDOWS\system32\DRIVERS\ViBus.sys [2007-12-07 10:43]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2007-09-21 17:19]
R0 ViPrt;VIA SATA IDE Device Driver;C:\WINDOWS\system32\DRIVERS\ViPrt.sys [2007-12-07 10:40]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-21 20:40]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\ARCHIV~1\AVG\AVG8\avgemc.exe [2008-07-21 20:40]
R2 avg8wd;AVG Free8 WatchDog;C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe [2008-07-21 20:40]
R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-21 20:40]
R2 MLPTDR_Q;MLPTDR_Q;C:\WINDOWS\system32\MLPTDR_Q.sys [2003-07-22 03:14]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2008-02-26 05:24]
R3 ROCKEYNT;Feitian ROCKEY4 Device Service;C:\WINDOWS\system32\DRIVERS\Rockey4.sys [2008-07-13 06:03]
R3 S3GIGP;S3GIGP;C:\WINDOWS\system32\DRIVERS\S3gIGPm.sys [2008-02-18 17:17]
S3 Rockey_USB;Feitian ROCKEY4 USB Service;C:\WINDOWS\system32\DRIVERS\Rockey4USB.sys [2008-07-13 06:03]
 
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 22:33:04
Windows 5.1.2600 Service Pack 2 NTFS
 
escaneando procesos ocultos ...
 
escaneando entradas ocultas de autostart ...
 
escaneando archivos ocultos ...
 
el escaneo se completo con exito
archivos ocultos: 0
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Archivos de programa\AVG\AVG8\avgrsx.exe
C:\Archivos de programa\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Tiempo completado: 2008-07-21 22:35:40 - machine was rebooted
ComboFix-quarantined-files.txt  2008-07-22 03:05:37
ComboFix2.txt  2008-07-22 00:54:02
 
Pre-Run: 208,742,477,824 bytes libres
Post-Run: 208,742,342,656 bytes libres
 
223	--- E O F ---	2008-04-18 19:46:41

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:
154:
155:
156:
157:
158:
159:
160:
161:
162:
163:
164:
165:
166:
167:
168:
169:
170:
171:
172:
173:
174:
175:
176:
177:
178:
179:
180:
181:
182:
183:
184:
185:
186:
187:
188:
189:
190:
191:
192:
193:
194:
195:
196:
197:
198:
199:
200:
201:
202:
203:
204:
205:
206:
207:
208:
209:
210:
211:
212:
213:
214:
215:
216:
217:
218:
219:
220:
221:
222:
223:
224:
225:
226:
227:
228:
229:
230:
231:
232:
233:
234:
235:
236:
237:
238:
239:
240:
241:
242:
243:
244:
245:
246:
247:
248:
249:
250:

Select all Open in new window

by: rpggamergirlPosted on 2008-07-21 at 21:06:11ID: 22056387

Good job, thanks for the log.
Can you attach a fresh hijackthis log too please?

I also need you to do an online scan with Kaspersky to check if it finds any bad files, just to confirm that the pc is clean. Save the report please.

Using Internet Explorer, run Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner

* Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As...' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.

by: suplyPosted on 2008-07-22 at 14:40:21ID: 22063967

Hello rpggamergirl, online scan with Kaspersky

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
 Tuesday, July 22, 2008
 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
 Kaspersky Online Scanner 7 version: 7.0.25.0
 Program database last update: Tuesday, July 22, 2008 09:38:14
 Records in database: 984243
--------------------------------------------------------------------------------
 
Scan settings:
	Scan using the following database: extended
	Scan archives: yes
	Scan mail databases: yes
 
Scan area - My Computer:
	C:\
	D:\
	E:\
 
Scan statistics:
	Files scanned: 38563
	Threat name: 1
	Infected objects: 1
	Suspicious objects: 0
	Duration of the scan: 00:30:37
 
 
File name / Threat name / Threats count
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Identities\{85A0C99D-C38D-4E30-B85F-F50554C088C3}\Microsoft\Outlook Express\Bandeja de salida.dbx	Infected: Trojan-Spy.Win32.KeySpy.x	1
 
The selected area was scanned.

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:

Select all Open in new window

by: dfxdeimosPosted on 2008-07-22 at 14:55:51ID: 22064081

Nice walkthrough rpggamergirl, you deserve extra brownie points! =]

by: suplyPosted on 2008-07-22 at 15:06:09ID: 22064151

and here is the fresh hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:05:04 PM, on 7/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
 
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
C:\ARCHIV~1\AVG\AVG8\avgrsx.exe
C:\ARCHIV~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\MSTMON_Q.EXE
C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
C:\ARCHIV~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
C:\Archivos de programa\DynDNS Updater\DynTray.exe
C:\Archivos de programa\Palm\Hotsync.exe
C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Archivos de programa\Internet Explorer\iexplore.exe
C:\ARCHIV~1\AVG\AVG8\aAvgApi.exe
C:\Archivos de programa\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Administrador\Escritorio\HiJackThis.exe
 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Archivos de programa\AVG\AVG8\avgssie.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\ARCHIV~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Archivos de programa\Archivos comunes\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Archivos de programa\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [KONICA MINOLTA PagePro 1350WStatusDisplay] C:\WINDOWS\system32\MSTMON_Q.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Archivos de programa\Java\jre1.5.0_03\bin\jusched.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\ARCHIV~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Palm Registration.lnk = C:\Archivos de programa\Palm\register.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Archivos de programa\Archivos comunes\DataViz\DvzIncMsgr.exe
O4 - Global Startup: DynDNS Updater Tray Icon.lnk = C:\Archivos de programa\DynDNS Updater\DynTray.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Archivos de programa\Palm\Hotsync.exe
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_03\bin\npjpi150_03.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {2E28242B-A689-11D4-80F2-0040266CBB8D} (KX-HCM10 Control) - http://suplyaire.viewnetcam.com:5003/kxhcm10.ocx
O16 - DPF: {33704B0F-9EB7-434B-B752-EA6CFFB87423} (pmjpegaudio Class) - http://sacam2.viewnetcam.com:5002/JpegInst.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1208534760440
O16 - DPF: {87BE3784-6977-4E84-AA08-55A96B9CEAC5} (Bl_camera Control) - http://sacam.viewnetcam.com:50001/bl_camera.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.5.0) - http://javadl-esd.sun.com/update/1.5.0/jinstall-1_5_0_03-windows-i586.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Archivos de programa\Intuit\QuickBooks 2008\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Archivos de programa\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\ARCHIV~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: DynDNS Updater - Dynamic Network Services, Inc. - C:\Archivos de programa\DynDNS Updater\DynUpSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Archivos de programa\Archivos comunes\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
 
--
End of file - 6572 bytes

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:

Select all Open in new window

by: rpggamergirlPosted on 2008-07-22 at 21:42:46ID: 22066062

suply,

Kaspersky reported one of the user's folder or email in Outlook Express as infected --> Bandeja de salida.dbx
Please delete it.
C:\Documents and Settings\Administrador\Configuración local\Datos de programa\Identities\{85A0C99D-C38D-4E30-B85F-F50554C088C3}\Microsoft\Outlook Express\Bandeja de salida.dbx

Hijackthis log looks okay, I don't see any malicious entries there.

dfxdeimos,
Thanks, speaking of points I just gave away 1000 pts that was already awarded to me on another thread, ;)

by: suplyPosted on 2008-07-22 at 22:13:41ID: 22066165

rpggamergirl, Im very pleased with your dedication and outstanding profesionalism throughout the succesful solution of my virus problem.

Congratulations and Im very thankful!

suply

by: suplyPosted on 2008-07-22 at 22:15:59ID: 31478724

Outstanding, thankyou!

by: rpggamergirlPosted on 2008-07-22 at 22:41:50ID: 22066272

suply,

You're welcome, it's a pleasure working with you.
Thank you for the nice feedback, I very much appreciate it.

Now that you're done with combofix, please uninstall it.
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

The procedure will delete ComboFix and its associated files and folders.
It will also reset System Restore.

Thank you for using Experts-Exchange!

20120131-EE-VQP-002

3 Ways to Join

30-Day Free Trial

For individual users
Instant access to solutions
Ask your tech questions
Start your 30-day Free Trial

Business Accounts

Perfect for organizations
Multiple users
Save over 36%
Create a Business Account

Answer for Membership

Earn free access
Showcase your knowledge
No credit card required
Sign Up to Answer

The Experts

98% positive feedback on 31,087 answers since March 2000. angeliii is a Microsoft Most Valuable Professional for his work with MS SQL Server & Develoment.

He has also proven his knowledge of Visual Basic Programming, PHP Scripting and Oracle Databases.

The Experts

97% positive feedback on 10,752 answers since July 2000. lrmoore has more than 18 years experience in the networking industry.

The six-time Mircosoft MVPs specialties include firewalls, virtual private networking, and network management.

Testimonials

"...and excellent source for support... Kind of like having your very own IT dept." Electriciansnet

Testimonials

"I was apprehensive at signing up at first. However... it has already made my life as an IT administrator much easier." JaCrews

Testimonials

"WOW! You guys have great, active, and knowledgeable people on here." moore50

Business Clients

In the Press

"If you’ve got a question... Experts Exchange can supply an answer.”

In the Press

"...an invaluable aid for both IT professionals and those who require tech support."

In the Press

"where IT professionals provide quick answers on just about any topic"

Business Account Plans

Loading Advertisement...

Question

How do I scan and remove a virus from my computer, opened zip file by mistake

Subscribe now for full access to Experts Exchange and get

Instant Access to this Solution

UPS Tracking Number 4606078241

Email Anti-Virus

Trusted by hundreds of thousands everyday for fast, accurate and reliable tech support.

See what Experts Exchange can do for you.

Got a question?

We've got the answer.

Need individual assistance?

Our experts are ready to help.

Want to learn from the best?

Read articles from industry experts.

Working on a long term project?

Store your work and research.

What Makes Experts Exchange Unique?

Trusted by the world's most respected brands.

Faithfully serving IT professionals since 1996.

Related Solutions

Free Tech Articles

Cloud Class Webinars

Join the Community

Give a Little. Get a Lot.

Answers

3 Ways to Join

The Experts

The Experts

Testimonials

Testimonials

Testimonials

Business Clients

Business Clients

In the Press

In the Press

In the Press

UPS Tracking Number 4606078241