Moiz Saifuddin
asked on
Unable to open any programs
I am unable to open any programs and when I do like say I open mozilla then a command box pops up for 2 sec and closes and this is the case with every program on my PC. I am running microsoft xp professional.
I forgot a program go to http://www.tomcoyote.org/hjt download hijack this.
after you run combofix it will produce a log file save it to someplace where you can find it and then reboot the system see if you can access things now if so run hijack this and post the logfile up here along with the combofix logfile then continue with the other tools i listed above.
after you run combofix it will produce a log file save it to someplace where you can find it and then reboot the system see if you can access things now if so run hijack this and post the logfile up here along with the combofix logfile then continue with the other tools i listed above.
That's what it sounds like to me, too. There are a number of viruses that mess up the Registry data for running executable (.exe) files, so this can cause nothing to happen when you double click an .exe file in My Computer or try to execute one by putting the name in the Run dialog box off the Start Menu. Viruses can also corrupt the registry data for .lnk files (shortcuts) so that clicking on them doesn't work. So you may need the registry script from this page to fix the registry association for .exe files:
go to the following page and click on the link for item number 12, "EXE Fix for Windows XP" (and next to it in the same row of the table is the fix for .lnk files):
http://www.kellys-korner-xp.com/xp_tweaks.htm
You would need to download the .reg file to someplace convenient where you can access it, such as your Desktop, then double click it to merge the contents into the Registry and reboot the computer.
If double-clicking it doesn't work, try renaming regedit.exe to regedit.com and see if you can do it that way.
And if THAT doesn't work, try this tip from the following page:
http://www.dougknox.com/xp/file_assoc.htm
If your EXE file associations are corrupted, it can be difficult to open REGEDIT, or to even import REG files. To work around this, press CTRL-ALT-DEL and open Task Manager. Once there, click File, then hold down the CTRL key and click New Task (Run). This will open a Command Prompt window. Enter REGEDIT.EXE and press Enter.
go to the following page and click on the link for item number 12, "EXE Fix for Windows XP" (and next to it in the same row of the table is the fix for .lnk files):
http://www.kellys-korner-xp.com/xp_tweaks.htm
You would need to download the .reg file to someplace convenient where you can access it, such as your Desktop, then double click it to merge the contents into the Registry and reboot the computer.
If double-clicking it doesn't work, try renaming regedit.exe to regedit.com and see if you can do it that way.
And if THAT doesn't work, try this tip from the following page:
http://www.dougknox.com/xp/file_assoc.htm
If your EXE file associations are corrupted, it can be difficult to open REGEDIT, or to even import REG files. To work around this, press CTRL-ALT-DEL and open Task Manager. Once there, click File, then hold down the CTRL key and click New Task (Run). This will open a Command Prompt window. Enter REGEDIT.EXE and press Enter.
ASKER
ComboFix 08-02.05.3 - moiz 2008-02-05 11:37:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18. 85 [GMT -6:00]
Running from: C:\Documents and Settings\moiz\Desktop\Comb oFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
(((((((((((((((((((((((((( (((((((((( ((( Other Deletions )))))))))))))))))))))))))) )))))))))) )))))))))) )))
.
C:\Autorun.inf
C:\Documents and Settings\LocalService\Appl ication Data\NetMon
C:\Documents and Settings\LocalService\Appl ication Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Appl ication Data\NetMon\log.txt
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB AT37\www.broadcaster.com
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB AT37\www.broadcaster.com\played_list.sol
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB AT37\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\macromedia.com\supp ort\flashp layer\sys\ #www.broadcaster.com
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\macromedia.com\supp ort\flashp layer\sys\ #www.broadcaster.com\settings.sol
C:\Documents and Settings\NetworkService\Ap plication Data\NetMon
C:\Documents and Settings\NetworkService\Ap plication Data\NetMon\domains.txt
C:\Documents and Settings\NetworkService\Ap plication Data\NetMon\log.txt
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon(2).exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\Fonts\acrsecB.f on
C:\WINDOWS\Fonts\acrsecI.f on
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\amvo.e xe
C:\WINDOWS\system32\amvo0. dll
C:\WINDOWS\system32\amvo1. dll
C:\WINDOWS\system32\atmtd. dll._
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\ccbeg. bak1
C:\WINDOWS\system32\ccbeg. bak2
C:\WINDOWS\system32\ccbeg. ini2
C:\WINDOWS\system32\ccbeg. tmp
C:\WINDOWS\system32\gebcc. dll
C:\WINDOWS\system32\gebxyx x.dll
C:\WINDOWS\system32\mcrh.t mp
.
(((((((((((((((((((((((((( (((((((((( ((( Drivers/Services )))))))))))))))))))))))))) )))))))))) )))))))))) )))
.
-------\LEGACY_POWERMANAGE R
-------\PowerManager
((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 )))))))))))))))))))))))))) )))))
.
2008-02-05 11:03 . 2008-02-05 11:02 103,673 -r-hs---- C:\188qsm.bat
2008-02-04 11:06 . 2008-02-04 11:06 281,050 -r-hs---- C:\2ifetri.cmd
2008-02-02 09:19 . 2008-02-02 09:19 282,584 -r-hs---- C:\i.cmd
2008-02-02 09:01 . 2008-02-02 09:01 <DIR> d-------- C:\Program Files\iPod
2008-02-02 08:58 . 2008-02-02 08:59 <DIR> d-------- C:\Program Files\QuickTime
2008-02-01 10:13 . 2008-02-01 10:12 281,562 -r-hs---- C:\h.cmd
2008-01-31 06:37 . 2008-02-05 11:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 06:37 . 2008-01-31 06:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-22 16:44 . 2008-02-02 09:02 <DIR> d-------- C:\Program Files\iTunes
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d----c--- C:\WINDOWS\system32\DRVSTO RE
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Program Files\Apple Software Update
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-01-22 16:41 . 2007-10-31 14:09 30,464 --a------ C:\WINDOWS\system32\driver s\usbaapl. sys
2008-01-21 06:55 . 2006-07-14 15:03 539,944,960 --a------ C:\Fight Club (DivX).avi
2008-01-21 06:54 . 2006-07-23 16:01 733,630,464 --a------ C:\DVD-Good Will Hunting.avi
2008-01-21 06:53 . 2006-08-05 13:44 766,092,800 --a------ C:\What Lies Beneath (DivX DVD).avi
2008-01-21 06:29 . 2006-07-27 05:50 489,606,376 --a------ C:\four brothers (whole movie).mpg
2008-01-21 06:29 . 2007-12-15 03:25 303,058 -r-hs---- C:\nideiect.com
2008-01-11 14:19 . 2008-01-11 14:19 <DIR> d-------- C:\Documents and Settings\moiz\Application Data\Helios
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickT imeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickT ime.qts
.
(((((((((((((((((((((((((( (((((((((( (((( Find3M Report )))))))))))))))))))))))))) )))))))))) )))))))))) ))))))
.
2008-01-22 22:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-24 19:31 --------- d-----w C:\Program Files\AnchorFree
2007-12-22 16:49 --------- d-----w C:\Program Files\Web Publish
2007-12-18 09:55 --------- d-----w C:\Program Files\Shareaza
2007-12-18 09:54 --------- d-----w C:\Documents and Settings\moiz\Application Data\Shareaza
2007-12-18 08:57 --------- d-----w C:\Documents and Settings\moiz\Application Data\Skype
2007-12-16 11:05 --------- d-----w C:\Documents and Settings\moiz\Application Data\Aim
2007-12-16 01:59 --------- d-----w C:\Program Files\Hotspot Shield
2007-12-15 12:19 --------- d-----w C:\Program Files\EditPlus 2
2007-12-15 12:17 --------- d-----w C:\Program Files\iTunes(2)
2007-12-15 12:17 --------- d-----w C:\Program Files\iPod(2)
2007-12-15 12:17 --------- d-----w C:\Program Files\imeem
2007-12-15 12:16 --------- d-----w C:\Program Files\TextPad 5
2007-12-15 12:16 --------- d-----w C:\Program Files\Common Files\Skype
2007-12-15 12:16 --------- d-----w C:\Program Files\Beyond Compare 2
2007-12-15 12:15 --------- d-----w C:\Program Files\DivX
2007-12-15 12:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 12:14 --------- d-----w C:\Program Files\CyberLink
2007-12-15 11:59 --------- d-----w C:\Program Files\Need2Find
2007-12-15 11:59 --------- d-----w C:\Program Files\LimeWire
2007-12-15 11:59 --------- d-----w C:\Program Files\Kazaa
2007-12-15 11:59 --------- d-----w C:\Program Files\AWS
2007-12-15 11:59 --------- d-----w C:\Program Files\Altnet
2007-12-15 11:52 --------- d-----w C:\Program Files\Dell Photo AIO Printer 922
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\aolback
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-15 11:51 --------- d-----w C:\Program Files\AOL 9.0
2007-12-15 11:51 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 11:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
.
(((((((((((((((((((((((((( (((((((((( ( Reg Loading Points )))))))))))))))))))))))))) )))))))))) )))))))))) ))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Brow ser Helper Objects\{4E7BD74F-2B8D-469 E-90F0-F66 AB581A933} ]
2005-03-07 15:57 552960 --a------ C:\PROGRA~1\INSTAF~1\INSTA F~1.DLL
[HKEY_LOCAL_MACHINE\~\Brow ser Helper Objects\{59879FA4-4790-461 c-A1CC-4EC 4DE4CA483} ]
C:\Program Files\RXToolBar\sfcont.dll
[HKEY_CURRENT_USER\SOFTWAR E\Microsof t\Windows\ CurrentVer sion\Run]
"AIM"="C:\Program Files\AIM\aim.exe" [2004-06-07 14:53 239064]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe " [2004-08-04 01:06 1845208]
"Shareaza"="C:\Program Files\Shareaza\Shareaza.ex e" [2007-12-01 18:30 4855258]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\Adobe Updater.ex e" [2007-03-01 00:37 2677210]
[HKEY_LOCAL_MACHINE\SOFTWA RE\Microso ft\Windows \CurrentVe rsion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 521694]
"SunJavaUpdateSched"="C:\P rogram Files\Java\jre1.5.0_09\bin \jusched.e xe" [2006-10-12 03:10 230876]
"P2P Networking"="C:\WINDOWS\sy stem32\P2P Networking\P2P Networking.exe" [2007-02-23 18:33 646108]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3917270]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 17:06 395740]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 01:14 15651288 C:\WINDOWS\RTHDCPL.exe]
"UserFaultCheck"="C:\WINDO WS\system3 2\dumprep 0 -u" [ ]
"Trickler"="c:\documents and settings\m\local settings\temp\~vis0000\fsg _4104.exe" [ ]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe " [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper. exe" [2008-01-15 03:22 267048]
C:\Documents and Settings\moiz\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.ex e [2007-02-23 12:37:45 502742]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 05:05:56 247252]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32 \inetsrv\i netinfo.ex e [2004-08-04 06:00]
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system3 2\DRIVERS\ tapvpn.sys [2006-07-23 03:44]
S3 wampapache;wampapache;"c:\ wamp\apach e2\bin\htt pd.exe" [2007-01-09 23:17]
S3 wampmysqld;wampmysqld;c:\w amp\mysql\ bin\mysqld -nt.exe [2007-07-06 12:14]
[HKEY_CURRENT_USER\softwar e\microsof t\windows\ currentver sion\explo rer\mountp oints2\{3d 961092-c02 8-11db-807 7-00a0d137 de9e}]
\Shell\AutoRun\command - E:\i.cmd
\Shell\explore\Command - E:\i.cmd
\Shell\open\Command - E:\i.cmd
.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 04:16:02 C:\WINDOWS\Tasks\AppleSoft wareUpdate .job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-27 06:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-02 15:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-02 16:00:00 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 17:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-02 18:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-04 19:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-04 20:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-04 21:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-04 22:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-04 23:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 00:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-27 07:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 01:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 02:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 03:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 04:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 05:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-21 22:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-23 09:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-26 10:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-29 11:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-01-27 12:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-01 13:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-01 14:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\JcP2CY 72.exe
"2008-02-05 17:39:35 C:\WINDOWS\Tasks\ex. sysdll.job"
- C:\WINDOWS\system32\rundll 32.exe
.
************************** ********** ********** ********** ********** ********
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 11:42:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk error: C:\WINDOWS\
************************** ********** ********** ********** ********** ********
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2ev xx.exe
C:\WINDOWS\system32\acs.ex e
C:\WINDOWS\system32\Ati2ev xx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDev iceService .exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\wscntf y.exe
C:\Program Files\iPod\bin\iPodService .exe
C:\WINDOWS\system32\NOTEPA D.EXE
.
************************** ********** ********** ********** ********** ********
.
Completion time: 2008-02-05 11:44:54 - machine was rebooted
ComboFix-quarantined-files .txt 2008-02-05 17:44:02
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.
Running from: C:\Documents and Settings\moiz\Desktop\Comb
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((((
.
C:\Autorun.inf
C:\Documents and Settings\LocalService\Appl
C:\Documents and Settings\LocalService\Appl
C:\Documents and Settings\LocalService\Appl
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\#SharedObjects\RCLB
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\macromedia.com\supp
C:\Documents and Settings\moiz\Application Data\macromedia\Flash Player\macromedia.com\supp
C:\Documents and Settings\NetworkService\Ap
C:\Documents and Settings\NetworkService\Ap
C:\Documents and Settings\NetworkService\Ap
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon(2).exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\Fonts\acrsecB.f
C:\WINDOWS\Fonts\acrsecI.f
C:\WINDOWS\svchost.exe
C:\WINDOWS\system32\amvo.e
C:\WINDOWS\system32\amvo0.
C:\WINDOWS\system32\amvo1.
C:\WINDOWS\system32\atmtd.
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\ccbeg.
C:\WINDOWS\system32\ccbeg.
C:\WINDOWS\system32\ccbeg.
C:\WINDOWS\system32\ccbeg.
C:\WINDOWS\system32\gebcc.
C:\WINDOWS\system32\gebxyx
C:\WINDOWS\system32\mcrh.t
.
((((((((((((((((((((((((((
.
-------\LEGACY_POWERMANAGE
-------\PowerManager
((((((((((((((((((((((((( Files Created from 2008-01-05 to 2008-02-05 ))))))))))))))))))))))))))
.
2008-02-05 11:03 . 2008-02-05 11:02 103,673 -r-hs---- C:\188qsm.bat
2008-02-04 11:06 . 2008-02-04 11:06 281,050 -r-hs---- C:\2ifetri.cmd
2008-02-02 09:19 . 2008-02-02 09:19 282,584 -r-hs---- C:\i.cmd
2008-02-02 09:01 . 2008-02-02 09:01 <DIR> d-------- C:\Program Files\iPod
2008-02-02 08:58 . 2008-02-02 08:59 <DIR> d-------- C:\Program Files\QuickTime
2008-02-01 10:13 . 2008-02-01 10:12 281,562 -r-hs---- C:\h.cmd
2008-01-31 06:37 . 2008-02-05 11:42 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-31 06:37 . 2008-01-31 06:37 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-22 16:44 . 2008-02-02 09:02 <DIR> d-------- C:\Program Files\iTunes
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d----c--- C:\WINDOWS\system32\DRVSTO
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Program Files\Common Files\Apple
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Program Files\Apple Software Update
2008-01-22 16:41 . 2008-01-22 16:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-01-22 16:41 . 2007-10-31 14:09 30,464 --a------ C:\WINDOWS\system32\driver
2008-01-21 06:55 . 2006-07-14 15:03 539,944,960 --a------ C:\Fight Club (DivX).avi
2008-01-21 06:54 . 2006-07-23 16:01 733,630,464 --a------ C:\DVD-Good Will Hunting.avi
2008-01-21 06:53 . 2006-08-05 13:44 766,092,800 --a------ C:\What Lies Beneath (DivX DVD).avi
2008-01-21 06:29 . 2006-07-27 05:50 489,606,376 --a------ C:\four brothers (whole movie).mpg
2008-01-21 06:29 . 2007-12-15 03:25 303,058 -r-hs---- C:\nideiect.com
2008-01-11 14:19 . 2008-01-11 14:19 <DIR> d-------- C:\Documents and Settings\moiz\Application Data\Helios
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickT
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickT
.
((((((((((((((((((((((((((
.
2008-01-22 22:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2007-12-24 19:31 --------- d-----w C:\Program Files\AnchorFree
2007-12-22 16:49 --------- d-----w C:\Program Files\Web Publish
2007-12-18 09:55 --------- d-----w C:\Program Files\Shareaza
2007-12-18 09:54 --------- d-----w C:\Documents and Settings\moiz\Application Data\Shareaza
2007-12-18 08:57 --------- d-----w C:\Documents and Settings\moiz\Application Data\Skype
2007-12-16 11:05 --------- d-----w C:\Documents and Settings\moiz\Application Data\Aim
2007-12-16 01:59 --------- d-----w C:\Program Files\Hotspot Shield
2007-12-15 12:19 --------- d-----w C:\Program Files\EditPlus 2
2007-12-15 12:17 --------- d-----w C:\Program Files\iTunes(2)
2007-12-15 12:17 --------- d-----w C:\Program Files\iPod(2)
2007-12-15 12:17 --------- d-----w C:\Program Files\imeem
2007-12-15 12:16 --------- d-----w C:\Program Files\TextPad 5
2007-12-15 12:16 --------- d-----w C:\Program Files\Common Files\Skype
2007-12-15 12:16 --------- d-----w C:\Program Files\Beyond Compare 2
2007-12-15 12:15 --------- d-----w C:\Program Files\DivX
2007-12-15 12:14 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-15 12:14 --------- d-----w C:\Program Files\CyberLink
2007-12-15 11:59 --------- d-----w C:\Program Files\Need2Find
2007-12-15 11:59 --------- d-----w C:\Program Files\LimeWire
2007-12-15 11:59 --------- d-----w C:\Program Files\Kazaa
2007-12-15 11:59 --------- d-----w C:\Program Files\AWS
2007-12-15 11:59 --------- d-----w C:\Program Files\Altnet
2007-12-15 11:52 --------- d-----w C:\Program Files\Dell Photo AIO Printer 922
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\aolback
2007-12-15 11:51 --------- d-----w C:\Program Files\Common Files\AOL
2007-12-15 11:51 --------- d-----w C:\Program Files\AOL 9.0
2007-12-15 11:51 --------- d-----w C:\Program Files\ABBYY FineReader 5.0 Sprint
2007-12-15 11:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
.
((((((((((((((((((((((((((
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Brow
2005-03-07 15:57 552960 --a------ C:\PROGRA~1\INSTAF~1\INSTA
[HKEY_LOCAL_MACHINE\~\Brow
C:\Program Files\RXToolBar\sfcont.dll
[HKEY_CURRENT_USER\SOFTWAR
"AIM"="C:\Program Files\AIM\aim.exe" [2004-06-07 14:53 239064]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe
"Shareaza"="C:\Program Files\Shareaza\Shareaza.ex
"AdobeUpdater"="C:\Program
[HKEY_LOCAL_MACHINE\SOFTWA
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 21:05 521694]
"SunJavaUpdateSched"="C:\P
"P2P Networking"="C:\WINDOWS\sy
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3917270]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-10 17:06 395740]
"RTHDCPL"="RTHDCPL.EXE" [2005-11-10 01:14 15651288 C:\WINDOWS\RTHDCPL.exe]
"UserFaultCheck"="C:\WINDO
"Trickler"="c:\documents and settings\m\local settings\temp\~vis0000\fsg
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe
"iTunesHelper"="C:\Program
C:\Documents and Settings\moiz\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - C:\Program Files\LimeWire\LimeWire.ex
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 05:05:56 247252]
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32
R3 tapvpn;TAP VPN Adapter;C:\WINDOWS\system3
S3 wampapache;wampapache;"c:\
S3 wampmysqld;wampmysqld;c:\w
[HKEY_CURRENT_USER\softwar
\Shell\AutoRun\command - E:\i.cmd
\Shell\explore\Command - E:\i.cmd
\Shell\open\Command - E:\i.cmd
.
Contents of the 'Scheduled Tasks' folder
"2008-02-02 04:16:02 C:\WINDOWS\Tasks\AppleSoft
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-01-27 06:00:00 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-02 15:00:00 C:\WINDOWS\Tasks\At10.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-02 16:00:00 C:\WINDOWS\Tasks\At11.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 17:00:00 C:\WINDOWS\Tasks\At12.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-02 18:00:00 C:\WINDOWS\Tasks\At13.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-04 19:00:00 C:\WINDOWS\Tasks\At14.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-04 20:00:00 C:\WINDOWS\Tasks\At15.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-04 21:00:00 C:\WINDOWS\Tasks\At16.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-04 22:00:00 C:\WINDOWS\Tasks\At17.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-04 23:00:00 C:\WINDOWS\Tasks\At18.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 00:00:00 C:\WINDOWS\Tasks\At19.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-27 07:00:00 C:\WINDOWS\Tasks\At2.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 01:00:00 C:\WINDOWS\Tasks\At20.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 02:00:00 C:\WINDOWS\Tasks\At21.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 03:00:00 C:\WINDOWS\Tasks\At22.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 04:00:00 C:\WINDOWS\Tasks\At23.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 05:00:00 C:\WINDOWS\Tasks\At24.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-21 22:00:00 C:\WINDOWS\Tasks\At3.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-23 09:00:00 C:\WINDOWS\Tasks\At4.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-26 10:00:00 C:\WINDOWS\Tasks\At5.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-29 11:00:00 C:\WINDOWS\Tasks\At6.job"
- C:\WINDOWS\system32\JcP2CY
"2008-01-27 12:00:00 C:\WINDOWS\Tasks\At7.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-01 13:00:00 C:\WINDOWS\Tasks\At8.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-01 14:00:00 C:\WINDOWS\Tasks\At9.job"
- C:\WINDOWS\system32\JcP2CY
"2008-02-05 17:39:35 C:\WINDOWS\Tasks\ex. sysdll.job"
- C:\WINDOWS\system32\rundll
.
**************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-05 11:42:46
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk error: C:\WINDOWS\
**************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2ev
C:\WINDOWS\system32\acs.ex
C:\WINDOWS\system32\Ati2ev
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDev
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\wscntf
C:\Program Files\iPod\bin\iPodService
C:\WINDOWS\system32\NOTEPA
.
**************************
.
Completion time: 2008-02-05 11:44:54 - machine was rebooted
ComboFix-quarantined-files
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
sorry add this too into that section
C:\WINDOWS\system32\JcP2CY 72.exe
so it should look like this
-------------------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- --------
File::
C:\188qsm.bat
C:\2ifetri.cmd
C:\i.cmd
C:\h.cmd
C:\nideiect.com
C:\PROGRA~1\INSTAF~1\INSTA F~1.DLL
C:\Program Files\RXToolBar\sfcont.dll
C:\WINDOWS\system32\JcP2CY 72.exe
c:\documents and settings\m\local settings\temp\~vis0000\fsg _4104.exe
Registry::
[HKEY_LOCAL_MACHINE\~\Brow ser Helper Objects\{4E7BD74F-2B8D-469 E-90F0-F66 AB581A933} ]
[HKEY_LOCAL_MACHINE\~\Brow ser Helper Objects\{59879FA4-4790-461 c-A1CC-4EC 4DE4CA483} ]
-------------------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- -----
C:\WINDOWS\system32\JcP2CY
so it should look like this
--------------------------
File::
C:\188qsm.bat
C:\2ifetri.cmd
C:\i.cmd
C:\h.cmd
C:\nideiect.com
C:\PROGRA~1\INSTAF~1\INSTA
C:\Program Files\RXToolBar\sfcont.dll
C:\WINDOWS\system32\JcP2CY
c:\documents and settings\m\local settings\temp\~vis0000\fsg
Registry::
[HKEY_LOCAL_MACHINE\~\Brow
[HKEY_LOCAL_MACHINE\~\Brow
--------------------------
Forced accept.
Computer101
EE Admin
Computer101
EE Admin
Try this
Get the following tools create a folder on your hard drive at the root of C: called tools download the following tools below to that folder then reboot the computer while it is comming back up keep pressing f8 until you get the windows boot menu from there select safe mode once in safe mode run the tools starting with combofix.
Download combofix.exe and save it to your desktop
Close any open browsers.
Before starting ComboFix disable and exit any anti-virus software, anti-spyware or any other security related software as they may interfere with ComboFix's operation.
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you and display it on your desktop called c:\combofix.txt. By default this log is located on your 'C' drive. Post that log in your next reply along with a fresh HJT log as well
Note:Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Combofix http://download.bleepingcomputer.com/sUBs/ComboFix.exe
Also run these
your going to need some anti spyware /malware utlities run too
http://www.superantispyware.com
http://security.kolla.de spybot s&d - download it install it (do not install tea timer, ) update it then run it
http://lavasoft.com - adaware - download it run it and then uninstall it
http://pack.google.com/intl/en/pack_installer_new.html?hl=en&gl=us&utm_source=en_US-et-more&utm_medium=et&utm_campaign=en_US&ciNum=11 - select to only download and install spyware doctor.
You'll also want to use several free online anti virus scanners such as
http://www.pandasoftware.com
http://www.bitdefender.com
Additionally you may want to run a rootkit tester...
http://technet.microsoft.com/en-us/sysinternals/bb897445.aspx