Link to home
Start Free TrialLog in
Avatar of cosecant
cosecant

asked on

XTEMP1.EXE process detected - apparent trojan, no antivirus is picking it up, how do I remove it?

I've recently bought a new laptop.  To transfer some of my backup files to this new laptop, I've been using my external USB hard drive.  After doing so, I've noticed a strange process appearing, 'XTEMP1.EXE'.  After doing some googling, f-secure has reported this as a trojan downloader.  I noticed that this same process was also running on my PREVIOUS computer as well, where my backups came from, so I'm assuming that the trojan/virus has replicated itself or infected this new computer via the USB hard drive.

I've tried killing the process, searching for *XTEMP* and deleting them all, but the problem keeps coming back.  I've downloaded the trial version of F-Secure in hopes of scanning, then removal/quarantine, but I've done that and the process is still there.

I'm pretty sure I'm going to need to run a HJT log, but it's been years since I've done so, can anyone give me the link, and the options I need to select?  I'll gladly post the HJT log asap.  Thanks for any further information and help you can provide.
Avatar of namol
namol
Avatar of phototropic
phototropic
Go here to download HJT:

http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download

Click on "Install", accept the EULA, and select "Do a System Scan and Save a Logfile"

Post the scan log here.
Avatar of cosecant
cosecant

ASKER

Thanks for the replies everyone.  Firstly, the 1st link for xtemp removal was downloaded, ran, but problem still exists.  And the 2nd link doesn't work at all.

Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:58:32 PM, on 7/14/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\WINDOWS\system32\xtemp1.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.exe

--
End of file - 6131 bytes


I noticed there's a bunch of lines regarding Internet Explorer homepage or something, is that possible ad-ware as well?  In either case, any help would be appreciated, thanks!!
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
C:\WINDOWS\system32\xtemp1.exe
The bad files is still running in your processes.

Probably started up as a flashdrive infection.
Download and run this tool and follow the prompts:
http://www.techsupportforum.com/sectools/sUBs/Flash_Disinfector.exe

You can also try ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..


Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


This link tells you How to use Combofix as well as installing RC if you haven't yet.
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
>>>I noticed there's a bunch of lines regarding Internet Explorer homepage or something, is that possible ad-ware as well?<<<

Those R's entries are not malicious, they're just the MS default entries, you can fix those safely if you want, except for the starpage if you set it yourself to -->
 google.net-studio.org

You can fix any redundant entries in Hijackthis,
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

and any 04 lines of a program that you don't want to start at bootup.
Avatar of cosecant
cosecant

ASKER

Thank you very much for the help and replies.  Here's my HJT log after running both USB Disinfector as well as ComboFix:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:32:00 PM, on 7/14/2008
Platform: Windows XP SP3, v.3264 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\FSGK32.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\F-Secure Internet Security\Common\FSMB32.EXE
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\F-Secure Internet Security\Common\FCH32.EXE
C:\Program Files\F-Secure Internet Security\Common\FAMEH32.EXE
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsqh.exe
C:\Program Files\F-Secure Internet Security\FSGUI\fsguidll.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fssm32.exe
C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
C:\Program Files\F-Secure Internet Security\FSAUA\program\fsus.exe
C:\Program Files\F-Secure Internet Security\Anti-Virus\fsav32.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.net-studio.org
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" /splash
O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Anti-Virus\fsgk32st.exe
O23 - Service: F-Secure Automatic Update Agent (FSAUA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FSAUA\program\fsaua.exe
O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\FWES\Program\fsdfwd.exe
O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\F-Secure Internet Security\Common\FSMA32.EXE
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: QoS RSVP (RSVP) - Unknown owner - C:\WINDOWS\system32\rsvp.exe (file missing)

--
End of file - 5769 bytes

When you say I should install RC, what is RC?
Is my problem solved?  Are there any unnecessary or problematic processes still running?
I'm pretty sure my other computer is infected with xtemp as well, what program should I run to disinfect that one?
For future safety, how would I prevent this from happening?  I loathe anti virus programs because of the insane amount of resource usage, are there any that are highly recommended?

Thanks everyone!
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
>>>When you say I should install RC, what is RC?<<<
RC stands for Recovery Console, sorry for abbreviation. don't worry about it for now if things looks ok with combofix you don't have ti install it.

xtemp1.exe <-- is no longer showing in your Hijackthis running processes, but we still need to see the combofix log.
Can you please attach the combofix log here, thanks.
Avatar of cosecant
cosecant

ASKER

Here's the ComboFix log:

ComboFix 08-07-14.2 - jlieu 2008-07-14 22:26:23.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1543 [GMT -6:00]
Running from: C:\Documents and Settings\jlieu\Desktop\ComboFix.exe
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\Autorun.inf

.
(((((((((((((((((((((((((   Files Created from 2008-06-15 to 2008-07-15  )))))))))))))))))))))))))))))))
.

2008-07-14 14:55 . 2008-07-14 14:55      32,768      --a------      C:\WINDOWS\system32\xtemp1.exe
2008-07-14 14:53 . 2008-07-14 14:53            d--------      C:\Program Files\Trend Micro
2008-07-14 12:39 . 2008-07-14 14:55      77,824      ---hs----      C:\WINDOWS\system32\dx6vcl.dll
2008-07-13 23:07 . 2008-07-13 23:07            d--------      C:\Documents and Settings\jlieu\Application Data\F-Secure
2008-07-13 23:04 . 2008-07-13 23:05            d--------      C:\Program Files\F-Secure Internet Security
2008-07-13 23:04 . 2008-07-13 23:04            d--------      C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-13 23:04 . 2008-04-04 12:08      57,856      --a------      C:\WINDOWS\system32\drivers\fsdfw.sys
2008-07-13 23:04 . 2008-04-04 12:08      36,736      --a------      C:\WINDOWS\system32\drivers\fsndis5.sys
2008-07-13 23:03 . 2008-07-13 23:03            d--------      C:\Documents and Settings\All Users\Application Data\fssg
2008-07-13 19:44 . 2008-07-13 19:44            d--------      C:\Documents and Settings\jlieu\Application Data\Media Player Classic
2008-07-13 19:11 . 2008-07-13 19:12            d--------      C:\Program Files\Winamp
2008-07-13 19:11 . 2008-07-13 19:12            d--------      C:\Documents and Settings\jlieu\Application Data\Winamp
2008-07-13 18:34 . 2008-07-13 18:34            d--------      C:\Documents and Settings\Administrator
2008-07-13 17:03 . 2008-07-13 17:03            d--------      C:\Program Files\TDelta
2008-07-11 21:32 . 2008-07-11 21:32      268      --ah-----      C:\sqmdata01.sqm
2008-07-11 21:32 . 2008-07-11 21:32      244      --ah-----      C:\sqmnoopt01.sqm
2008-07-11 17:44 . 2008-07-11 17:44      268      --ah-----      C:\sqmdata00.sqm
2008-07-11 17:44 . 2008-07-11 17:44      244      --ah-----      C:\sqmnoopt00.sqm
2008-07-11 17:43 . 2007-07-30 19:19      271,224      --a------      C:\WINDOWS\system32\mucltui.dll
2008-07-11 17:43 . 2007-07-30 19:19      207,736      --a------      C:\WINDOWS\system32\muweb.dll
2008-07-11 17:43 . 2007-07-30 19:19      30,072      --a------      C:\WINDOWS\system32\mucltui.dll.mui
2008-07-11 02:18 . 2008-07-14 18:23            d--------      C:\Program Files\Windower
2008-07-11 02:14 . 2008-07-11 02:14            d--------      C:\Program Files\Superjoy Box Pro
2008-07-11 02:14 . 2006-05-05 16:24      12,160      --a------      C:\WINDOWS\system32\drivers\Maypro.sys
2008-07-11 02:12 . 2005-09-13 20:14      290,816      --a------      C:\WINDOWS\system32\Projoycpl.dll
2008-07-11 02:08 . 2005-09-03 15:58      430,080      --a------      C:\WINDOWS\system32\Mpjoycpl.dll
2008-07-11 02:08 . 2004-10-21 17:22      49,152      --a------      C:\WINDOWS\system32\ffdrv1.dll
2008-07-11 02:02 . 2008-07-11 02:02            d--------      C:\Program Files\EMS USB2
2008-07-11 02:02 . 2008-07-11 02:04      272,384      --a------      C:\WINDOWS\system32\UsbPadCP.DLL
2008-07-11 02:02 . 2008-07-11 02:04      36,864      --a------      C:\WINDOWS\system32\UsbPadFF.DLL
2008-07-11 02:02 . 2008-07-11 02:04      6,704      --a------      C:\WINDOWS\system32\drivers\EMSUSB2.SYS
2008-07-11 02:02 . 2008-07-11 02:04      3,536      --a------      C:\WINDOWS\system32\drivers\FltrKbd.SYS
2008-07-11 01:43 . 2008-07-11 01:43            d--------      C:\Documents and Settings\jlieu\Contacts
2008-07-11 01:34 . 2008-07-11 01:42            d--hsc---      C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-11 01:33 . 2008-07-11 01:42            d--------      C:\Program Files\Windows Live
2008-07-11 01:33 . 2008-07-11 01:36            d--------      C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-11 01:31 . 2008-07-11 01:31      4,096      --a------      C:\WINDOWS\d3dx.dat
2008-07-11 01:18 . 2007-11-30 17:31      10,368      --a------      C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-11 01:18 . 2007-11-30 17:31      10,368      --a--c---      C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-11 00:28 . 2008-07-11 00:28            d--------      C:\Program Files\FFXiBench3
2008-07-11 00:09 . 2008-07-13 19:11            d--------      C:\Program Files\Winamp3
2008-07-11 00:09 . 2008-07-11 00:09      50      --a------      C:\WINDOWS\Winamp.ini
2008-07-11 00:09 . 2008-07-11 00:09      41      --a------      C:\WINDOWS\winampa.ini
2008-07-11 00:03 . 2008-07-11 00:03            d--------      C:\Program Files\PlayOnline
2008-07-10 23:51 . 2008-07-10 23:51            d--------      C:\Program Files\Real Alternative
2008-07-10 23:51 . 2003-03-18 21:14      499,712      --a------      C:\WINDOWS\system32\msvcp71.dll
2008-07-10 23:51 . 2004-01-11 16:00      348,160      --a------      C:\WINDOWS\system32\msvcr71.dll
2008-07-10 23:50 . 2008-07-10 23:50            d--------      C:\WINDOWS\WinRAR
2008-07-10 23:50 . 2008-07-10 23:50            d--------      C:\Program Files\Combined Community Codec Pack
2008-07-10 23:24 . 2008-07-10 23:24            d--------      C:\Program Files\uTorrent
2008-07-10 23:24 . 2008-07-14 10:01            d--------      C:\Documents and Settings\jlieu\Application Data\uTorrent
2008-07-10 22:47 . 2008-07-10 22:47      0      --a------      C:\WINDOWS\nsreg.dat
2008-07-10 22:36 . 2008-06-13 05:05      272,128      ---------      C:\WINDOWS\system32\drivers\bthport.sys
2008-07-10 22:36 . 2008-06-13 05:05      272,128      -----c---      C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-10 22:33 . 2008-07-10 22:55            d--------      C:\SWSetup
2008-07-10 22:28 . 2008-07-10 23:11            d--------      C:\Program Files\CONEXANT
2008-07-10 22:09 . 2008-07-10 22:09            d--------      C:\WINDOWS\system32\ENU
2008-07-10 22:09 . 2008-07-10 22:09            d--------      C:\Documents and Settings\jlieu\Application Data\InstallShield
2008-07-10 22:09 . 2008-05-23 15:26      1,034,776      --a------      C:\WINDOWS\system32\imsmudlg.exe
2008-06-20 05:51 . 2008-06-20 05:51      361,600      -----c---      C:\WINDOWS\system32\dllcache\tcpip.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 08:14      ---------      d--h--w      C:\Program Files\InstallShield Installation Information
2008-07-11 06:23      ---------      d-----w      C:\Program Files\Common Files\InstallShield
2008-07-11 04:26      ---------      d-----w      C:\Program Files\Hewlett-Packard
2008-07-11 04:09      ---------      d-----w      C:\Program Files\Intel
2008-07-11 02:42      ---------      d-----w      C:\Program Files\Apoint2K
2008-07-11 02:42      ---------      d-----w      C:\Documents and Settings\jlieu\Application Data\WinBatch
2008-07-11 02:28      ---------      d-----w      C:\Program Files\microsoft frontpage
2008-07-11 02:27      ---------      d-----w      C:\Program Files\Windows Media Connect 2
2008-06-20 17:46      245,248      ----a-w      C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51      361,600      ----a-w      C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40      138,496      ----a-w      C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08      225,856      ----a-w      C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-04 19:40      920,088      ----a-w      C:\WINDOWS\system32\igxpun.exe
2008-05-09 10:53      90,112      ----a-w      C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53      430,080      ----a-w      C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53      180,224      ----a-w      C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53      172,032      ----a-w      C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24      155,648      ----a-w      C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07      135,168      ----a-w      C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12      1,288,192      ----a-w      C:\WINDOWS\system32\quartz.dll
.

------- Sigcheck -------

2007-12-29 08:43  2185216  cc19a7cffda996438ae11b33ac5d88e8      C:\WINDOWS\system32\ntkrnlpa.exe

2007-12-29 08:00  2306560  8ee730c805814e5db4e3aabce25c1e41      C:\WINDOWS\system32\ntoskrnl.exe
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-11-30 17:26 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-04-02 07:50 143360]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-04-02 07:50 163840]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-04-02 07:50 135168]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-12-15 15:29 184320]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 17:41 178712]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 15:33 36352]
"F-Secure Manager"="C:\Program Files\F-Secure Internet Security\Common\FSM32.EXE" [2008-04-04 12:10 182936]
"F-Secure TNB"="C:\Program Files\F-Secure Internet Security\FSGUI\TNBUtil.exe" [2008-04-04 12:09 739936]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders      msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=

R0 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys [2008-04-04 12:08]
R1 F-Secure HIPS;F-Secure HIPS;C:\Program Files\F-Secure Internet Security\HIPS\fshs.sys [2008-04-04 12:09]
R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;C:\WINDOWS\system32\drivers\CHDAud.sys [2008-02-01 13:18]
R3 F-Secure Gatekeeper;F-Secure Gatekeeper;C:\Program Files\F-Secure Internet Security\Anti-Virus\minifilter\fsgk.sys [2008-04-04 12:07]
S3 EMSUSB2;EMSUSB2;C:\WINDOWS\system32\Drivers\EMSUSB2.SYS [2008-07-11 02:04]
S4 F-Secure Filter;F-Secure File System Filter;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSfilter.sys [2008-04-04 12:07]
S4 F-Secure Recognizer;F-Secure File System Recognizer;C:\Program Files\F-Secure Internet Security\Anti-Virus\Win2K\FSrec.sys [2008-04-04 12:07]

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-14 22:27:15
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-14 22:27:44
ComboFix-quarantined-files.txt  2008-07-15 04:27:41

Pre-Run: 82,504,355,840 bytes free
Post-Run: 82,851,524,608 bytes free

158      --- E O F ---      2008-07-14 18:36:57


If possible, could you address the above concerns as well?
Is my problem solved?  Are there any unnecessary or problematic processes still running?
I'm pretty sure my other computer is infected with xtemp as well, what program should I run to disinfect that one?
For future safety, how would I prevent this from happening?  I loathe anti virus programs because of the insane amount of resource usage, are there any that are highly recommended?

Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
Yes it is still there. I'm using Avast antivirus it's free and it's not a resource hog, and I only have 512mb RAM.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
C:\WINDOWS\system32\xtemp1.exe
C:\WINDOWS\system32\dx6vcl.dll

------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.



Also do an online scan with Kaspersky and save the logfile.
Using Internet Explorer, run Kaspersky Online Scanner
http://www.kaspersky.com/virusscanner
   
* Click 'Accept' in the window that pops up.
* You will be prompted to install an ActiveX component from Kaspersky, Click on the information bar and select Install ActiveX Control if so. This may happen more than once. That is OK. You also may get a warning from your Windows Firewall. You can tell it to unblock.
* The program will launch and then start to download the latest definition files.
* Once the scanner is installed and the definitions downloaded, click 'Next'.
* Now click on 'Scan Settings'
* In the scan settings make sure that the following are selected:
          o Scan using the following Anti-Virus database: 'Extended' (If available, otherwise 'Standard')
          o Scan Options: 'Scan Archives' and 'Scan Mail Bases'
* Click 'OK'
* Now under 'Select a target to scan' select 'My Computer'
* The scan will take a while, so be patient and let it run. Once the scan is complete, it will display whether your system has been infected.
* Now click on the 'Save Report As...' button:
* Make sure it says Save as a text file - change it if not
* Save the file to your desktop.


Avatar of cosecant
cosecant

ASKER

ComboFix log:

ComboFix 08-07-14.2 - jlieu 2008-07-15  8:07:08.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.1526 [GMT -6:00]
Running from: C:\Documents and Settings\jlieu\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\jlieu\Desktop\CFScript.txt
 * Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\system32\dx6vcl.dll
C:\WINDOWS\system32\xtemp1.exe
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dx6vcl.dll
C:\WINDOWS\system32\xtemp1.exe

.
(((((((((((((((((((((((((   Files Created from 2008-06-15 to 2008-07-15  )))))))))))))))))))))))))))))))
.

2008-07-14 14:53 . 2008-07-14 14:53            d--------      C:\Program Files\Trend Micro
2008-07-13 23:07 . 2008-07-13 23:07            d--------      C:\Documents and Settings\jlieu\Application Data\F-Secure
2008-07-13 23:04 . 2008-07-14 23:52            d--------      C:\Program Files\F-Secure Internet Security
2008-07-13 23:04 . 2008-07-14 23:52            d--------      C:\Documents and Settings\All Users\Application Data\F-Secure
2008-07-13 23:03 . 2008-07-13 23:03            d--------      C:\Documents and Settings\All Users\Application Data\fssg
2008-07-13 19:44 . 2008-07-13 19:44            d--------      C:\Documents and Settings\jlieu\Application Data\Media Player Classic
2008-07-13 19:11 . 2008-07-13 19:12            d--------      C:\Program Files\Winamp
2008-07-13 19:11 . 2008-07-13 19:12            d--------      C:\Documents and Settings\jlieu\Application Data\Winamp
2008-07-13 18:34 . 2008-07-13 18:34            d--------      C:\Documents and Settings\Administrator
2008-07-13 17:03 . 2008-07-13 17:03            d--------      C:\Program Files\TDelta
2008-07-11 21:32 . 2008-07-11 21:32      268      --ah-----      C:\sqmdata01.sqm
2008-07-11 21:32 . 2008-07-11 21:32      244      --ah-----      C:\sqmnoopt01.sqm
2008-07-11 17:44 . 2008-07-11 17:44      268      --ah-----      C:\sqmdata00.sqm
2008-07-11 17:44 . 2008-07-11 17:44      244      --ah-----      C:\sqmnoopt00.sqm
2008-07-11 17:43 . 2007-07-30 19:19      271,224      --a------      C:\WINDOWS\system32\mucltui.dll
2008-07-11 17:43 . 2007-07-30 19:19      207,736      --a------      C:\WINDOWS\system32\muweb.dll
2008-07-11 17:43 . 2007-07-30 19:19      30,072      --a------      C:\WINDOWS\system32\mucltui.dll.mui
2008-07-11 02:18 . 2008-07-14 18:23            d--------      C:\Program Files\Windower
2008-07-11 02:14 . 2008-07-11 02:14            d--------      C:\Program Files\Superjoy Box Pro
2008-07-11 02:14 . 2006-05-05 16:24      12,160      --a------      C:\WINDOWS\system32\drivers\Maypro.sys
2008-07-11 02:12 . 2005-09-13 20:14      290,816      --a------      C:\WINDOWS\system32\Projoycpl.dll
2008-07-11 02:08 . 2005-09-03 15:58      430,080      --a------      C:\WINDOWS\system32\Mpjoycpl.dll
2008-07-11 02:08 . 2004-10-21 17:22      49,152      --a------      C:\WINDOWS\system32\ffdrv1.dll
2008-07-11 02:02 . 2008-07-11 02:02            d--------      C:\Program Files\EMS USB2
2008-07-11 02:02 . 2008-07-11 02:04      272,384      --a------      C:\WINDOWS\system32\UsbPadCP.DLL
2008-07-11 02:02 . 2008-07-11 02:04      36,864      --a------      C:\WINDOWS\system32\UsbPadFF.DLL
2008-07-11 02:02 . 2008-07-11 02:04      6,704      --a------      C:\WINDOWS\system32\drivers\EMSUSB2.SYS
2008-07-11 02:02 . 2008-07-11 02:04      3,536      --a------      C:\WINDOWS\system32\drivers\FltrKbd.SYS
2008-07-11 01:43 . 2008-07-11 01:43            d--------      C:\Documents and Settings\jlieu\Contacts
2008-07-11 01:34 . 2008-07-11 01:42            d--hsc---      C:\Program Files\Common Files\WindowsLiveInstaller
2008-07-11 01:33 . 2008-07-11 01:42            d--------      C:\Program Files\Windows Live
2008-07-11 01:33 . 2008-07-11 01:36            d--------      C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-07-11 01:31 . 2008-07-11 01:31      4,096      --a------      C:\WINDOWS\d3dx.dat
2008-07-11 01:18 . 2007-11-30 17:31      10,368      --a------      C:\WINDOWS\system32\drivers\hidusb.sys
2008-07-11 01:18 . 2007-11-30 17:31      10,368      --a--c---      C:\WINDOWS\system32\dllcache\hidusb.sys
2008-07-11 00:28 . 2008-07-11 00:28            d--------      C:\Program Files\FFXiBench3
2008-07-11 00:09 . 2008-07-13 19:11            d--------      C:\Program Files\Winamp3
2008-07-11 00:09 . 2008-07-11 00:09      50      --a------      C:\WINDOWS\Winamp.ini
2008-07-11 00:09 . 2008-07-11 00:09      41      --a------      C:\WINDOWS\winampa.ini
2008-07-11 00:03 . 2008-07-11 00:03            d--------      C:\Program Files\PlayOnline
2008-07-10 23:51 . 2008-07-10 23:51            d--------      C:\Program Files\Real Alternative
2008-07-10 23:51 . 2003-03-18 21:14      499,712      --a------      C:\WINDOWS\system32\msvcp71.dll
2008-07-10 23:51 . 2004-01-11 16:00      348,160      --a------      C:\WINDOWS\system32\msvcr71.dll
2008-07-10 23:50 . 2008-07-10 23:50            d--------      C:\WINDOWS\WinRAR
2008-07-10 23:50 . 2008-07-10 23:50            d--------      C:\Program Files\Combined Community Codec Pack
2008-07-10 23:24 . 2008-07-10 23:24            d--------      C:\Program Files\uTorrent
2008-07-10 23:24 . 2008-07-15 08:07            d--------      C:\Documents and Settings\jlieu\Application Data\uTorrent
2008-07-10 22:47 . 2008-07-10 22:47      0      --a------      C:\WINDOWS\nsreg.dat
2008-07-10 22:36 . 2008-06-13 05:05      272,128      ---------      C:\WINDOWS\system32\drivers\bthport.sys
2008-07-10 22:36 . 2008-06-13 05:05      272,128      -----c---      C:\WINDOWS\system32\dllcache\bthport.sys
2008-07-10 22:33 . 2008-07-10 22:55            d--------      C:\SWSetup
2008-07-10 22:28 . 2008-07-10 23:11            d--------      C:\Program Files\CONEXANT
2008-07-10 22:09 . 2008-07-10 22:09            d--------      C:\WINDOWS\system32\ENU
2008-07-10 22:09 . 2008-07-10 22:09            d--------      C:\Documents and Settings\jlieu\Application Data\InstallShield
2008-07-10 22:09 . 2008-05-23 15:26      1,034,776      --a------      C:\WINDOWS\system32\imsmudlg.exe
2008-06-20 05:51 . 2008-06-20 05:51      361,600      -----c---      C:\WINDOWS\system32\dllcache\tcpip.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-11 08:14      ---------      d--h--w      C:\Program Files\InstallShield Installation Information
2008-07-11 06:23      ---------      d-----w      C:\Program Files\Common Files\InstallShield
2008-07-11 04:26      ---------      d-----w      C:\Program Files\Hewlett-Packard
2008-07-11 04:09      ---------      d-----w      C:\Program Files\Intel
2008-07-11 02:42      ---------      d-----w      C:\Program Files\Apoint2K
2008-07-11 02:42      ---------      d-----w      C:\Documents and Settings\jlieu\Application Data\WinBatch
2008-07-11 02:28      ---------      d-----w      C:\Program Files\microsoft frontpage
2008-07-11 02:27      ---------      d-----w      C:\Program Files\Windows Media Connect 2
2008-06-20 17:46      245,248      ----a-w      C:\WINDOWS\system32\mswsock.dll
2008-06-20 11:51      361,600      ----a-w      C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40      138,496      ----a-w      C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08      225,856      ----a-w      C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-04 19:40      920,088      ----a-w      C:\WINDOWS\system32\igxpun.exe
2008-05-09 10:53      90,112      ----a-w      C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53      430,080      ----a-w      C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53      180,224      ----a-w      C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53      172,032      ----a-w      C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24      155,648      ----a-w      C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07      135,168      ----a-w      C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12      1,288,192      ----a-w      C:\WINDOWS\system32\quartz.dll
.

------- Sigcheck -------

2007-12-29 08:43  2185216  cc19a7cffda996438ae11b33ac5d88e8      C:\WINDOWS\system32\ntkrnlpa.exe

2007-12-29 08:00  2306560  8ee730c805814e5db4e3aabce25c1e41      C:\WINDOWS\system32\ntoskrnl.exe
.
(((((((((((((((((((((((((((((   snapshot@2008-07-14_22.27.36.09   )))))))))))))))))))))))))))))))))))))))))
.
- 2008-07-14 20:56:44      61,642      ----a-w      C:\WINDOWS\system32\perfc009.dat
+ 2008-07-15 05:51:54      59,872      ----a-w      C:\WINDOWS\system32\perfc009.dat
- 2008-07-14 20:56:44      398,572      ----a-w      C:\WINDOWS\system32\perfh009.dat
+ 2008-07-15 05:51:54      394,498      ----a-w      C:\WINDOWS\system32\perfh009.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2007-11-30 17:26 15360]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2008-04-02 07:50 143360]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2008-04-02 07:50 163840]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2008-04-02 07:50 135168]
"Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2007-12-15 15:29 184320]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-05-07 17:41 178712]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-07-09 15:33 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLogOff"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders      msapsspc.dll, schannel.dll, digest.dll, credssp.dll, msnsspc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=

R3 CnxtHdAudAddService;Microsoft UAA Function Driver for High Definition Audio Service;C:\WINDOWS\system32\drivers\CHDAud.sys [2008-02-01 13:18]
R4 FSFW;F-Secure Firewall Driver;C:\WINDOWS\system32\drivers\fsdfw.sys []
S3 EMSUSB2;EMSUSB2;C:\WINDOWS\system32\Drivers\EMSUSB2.SYS [2008-07-11 02:04]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 08:08:14
Windows 5.1.2600 Service Pack 3, v.3264 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-15  8:08:49
ComboFix-quarantined-files.txt  2008-07-15 14:08:46
ComboFix2.txt  2008-07-15 04:27:45

Pre-Run: 81,649,143,808 bytes free
Post-Run: 81,641,062,400 bytes free

160      --- E O F ---      2008-07-14 18:36:57


Kaspersky Scan Report:

KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, July 15, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3, v.3264 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, July 15, 2008 15:17:15
Records in database: 956074
Scan settings
Scan using the following database       extended
Scan archives       yes
Scan mail databases       yes
Scan area       My Computer
C:\
D:\
E:\
Scan statistics
Files scanned       58691
Threat name       2
Infected objects       3
Suspicious objects       0
Duration of the scan       02:32:15

File name       Threat name       Threats count
C:\QooBox\Quarantine\C\WINDOWS\system32\dx6vcl.dll.vir      Infected: Trojan-Downloader.Win32.Agent.fdt      1      
C:\WINDOWS\system32\dx6vcl.0ll      Infected: Trojan-Downloader.Win32.Agent.fdt      1      
C:\WINDOWS\system32\notepod.0xe      Infected: Trojan-Downloader.Win32.Agent.icf      1      
The selected area was scanned.

Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
Kaspersky found 2 trojans, delete them using combofix script.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
C:\WINDOWS\system32\dx6vcl.0ll    
C:\WINDOWS\system32\notepod.0xe      
------------------------------------------------------------------------

3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
Or you can also delete them manually if you like.
Avatar of cosecant
cosecant

ASKER

Alright, deleted.  Anything else?  Or is my system now free of viruses?


I'm pretty sure my other computer is infected with xtemp as well, what program should I run to disinfect that one?

ASKER CERTIFIED SOLUTION
Avatar of rpggamergirl
rpggamergirl
Flag of Australia image
Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial
Avatar of Mohammed Hamada
Mohammed Hamada
Flag of Portugal image
Remember to always scan your Flash before hook it up, and disable auto run...!