Solved

how do I get rid of spyware trojans - popup ads etc

Posted on 2008-10-21
16
1,470 Views
Last Modified: 2013-12-06
Hi, I recently had quite a nasty virus on my computer, which I have got rid of. however I still have popups etc, which include filmon.com and other general adverts.  So I have a feeling there is still somethign lurking. I have ran malwarebytes and that got rid of quite a lot of stuff and superantispyware also, which removed stuff too. along with spybot search and destroy, but I still notice slowness and popups. I have attached a hijack file of my computer and just wondered if anyone could see anything that is harmful that perhaps I am missing?

Thanks,
Chris
hijackthis.log
0
Comment
Question by:wireless24
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
  • 3
  • +3
16 Comments
 
LVL 3

Expert Comment

by:Blackninja2007
ID: 22766134
I use Spybots which seems to work quiet well and its free

http://www.safer-networking.org/index2.html


Derek
0
 
LVL 3

Expert Comment

by:Blackninja2007
ID: 22766150
Sorry just realised you said you used spybots ... my mistake

0
 

Author Comment

by:wireless24
ID: 22766171
no probs.

I actually have rerun that and it has found more.
can you see anything in the hijack log that might be unsavoury?!

cheers

Chris
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 

Expert Comment

by:Rnetmaster
ID: 22766209
My best advice is to buy either Spyware Doctor or Spy Sweeper.  They are both pretty reasonable and get rid of a lot more than any free program does.  I know you would rather not hear that, but in this case I think paying for the program might be the best solution and will cause you less headaches in the future.
0
 
LVL 3

Expert Comment

by:Blackninja2007
ID: 22766244
Sorry cant open file as currently onwork network ... will check again when I get home in about 5 hours.
0
 

Author Comment

by:wireless24
ID: 22766529
Hi,

Hijack logfile below

Cheers

Logfile of HijackThis v1.99.1
Scan saved at 12:11:15, on 21/10/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
c:\program files\common files\protexis\license service\psiservice_2.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\Program Files\Hamachi\hamachi.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\ACT\Act for Windows\ActSage.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\PROGRA~1\MICROS~2\Office12\OUTLOOK.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Act.Outlook.Service] "C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe"
O4 - HKLM\..\Run: [Act! Preloader] "C:\Program Files\ACT\Act for Windows\ActSage.exe" -preload
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer /watchfiles
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [msgweb] C:\WINDOWS\system32\fuxufcts.exe
O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Logitech\QuickCam\eReg.exe
O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe
O4 - Global Startup: Nokia Nseries PC Suite.lnk = C:\Program Files\Nokia\NNPCS\RunLauncher.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Attach Web page to ACT! contact - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra 'Tools' menuitem: Attach Web page to ACT! contact... - {6F431AC3-364A-478b-BBDB-89C7CE1B18F6} - mscoree.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JSCDL/jdk/6u7/jinstall-6u7-windows-i586-jc.cab?e=1221061100640&h=6fcd17807b1fc65d57ff9c08887b1f3b/&filename=jinstall-6u7-windows-i586-jc.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL srbeuj.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: SQL Server (ACT7) (MSSQL$ACT7) - Unknown owner - C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe" -sACT7 (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - c:\program files\common files\protexis\license service\psiservice_2.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe

0
 
LVL 20

Assisted Solution

by:IndiGenus
IndiGenus earned 80 total points
ID: 22766598
Fix this one with HJT:
O4 - HKCU\..\Run: [msgweb] C:\WINDOWS\system32\fuxufcts.exe

And delete the file:
C:\WINDOWS\system32\fuxufcts.exe

Reboot
and see if that gets it. Post a new HJT log if not.
0
 
LVL 2

Expert Comment

by:WebSvrPro
ID: 22766617
IndiGenus's method should work!

Darn you beating me to it!
0
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 420 total points
ID: 22766718

srbeuj.dll <-- this random file is added in the value of AppInit_DLLs which starts before Windows, combofix would be a good one to use here so we can also see what other bad files are still lurking there.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
0
 

Author Comment

by:wireless24
ID: 22766967
rpggamergirl- think you have fixed it

did the comboix thing and restarted the comp and things seem much better.
I have still attached the log file though for you to have a look at,

cheers
Chris
ComboFix 08-10-19.04 - Chris 2008-10-21 14:07:17.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1252.1.1033.18.2644 [GMT 1:00]
Running from: C:\Documents and Settings\Chris\Desktop\ComboFix.exe
 * Created a new restore point
 * Resident AV is active
 
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\Chris\Application Data\Adobe\Player.exe.bak
C:\WINDOWS\system32\bIOXayay.ini
C:\WINDOWS\system32\bIOXayay.ini2
C:\WINDOWS\system32\cbXQjJAt.dll
C:\WINDOWS\system32\cxkvwi.dll
C:\WINDOWS\system32\epacupcp.ini
C:\WINDOWS\system32\fccbaAsr.dll
C:\WINDOWS\system32\geBuuSlk.dll
C:\WINDOWS\system32\jkkjHWpp.dll
C:\WINDOWS\system32\ljJYSmjh.dll
C:\WINDOWS\system32\mlJCRhHy.dll
C:\WINDOWS\system32\pcpucape.dll
C:\WINDOWS\system32\pmnkHxuV.dll
C:\WINDOWS\system32\rmvfln.dll
C:\WINDOWS\system32\srbeuj.dll
C:\WINDOWS\system32\ssqQkjge.dll
C:\WINDOWS\system32\tvknvvkn.dll
C:\WINDOWS\system32\vrkgabnw.dll
C:\WINDOWS\system32\xjtjqbbp.dll
C:\WINDOWS\system32\yayaXOIb.dll
 
----- BITS: Possible infected sites -----
 
hxxp://78.157.143.163
hxxp://78.157.143.198
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_TDSSSERV
-------\Service_TDSSserv
 
 
(((((((((((((((((((((((((   Files Created from 2008-09-21 to 2008-10-21  )))))))))))))))))))))))))))))))
.
 
2008-10-21 13:26 . 2008-10-16 20:35	87,352	--a------	C:\WINDOWS\system32\LMIinit.dll
2008-10-21 13:26 . 2008-10-16 20:35	83,288	--a------	C:\WINDOWS\system32\LMIRfsClientNP.dll
2008-10-21 13:26 . 2008-07-24 18:46	47,640	--a------	C:\WINDOWS\system32\drivers\LMIRfsDriver.sys
2008-10-21 13:26 . 2008-10-16 20:35	28,984	--a------	C:\WINDOWS\system32\LMIport.dll
2008-10-21 13:25 . 2008-10-21 13:26	<DIR>	d--------	C:\Program Files\LogMeIn
2008-10-20 17:48 . 2008-10-20 18:47	<DIR>	d--------	C:\Program Files\PowerDataRecovery
2008-10-20 13:43 . 2008-10-20 13:43	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\Malwarebytes
2008-10-20 13:43 . 2008-10-16 20:25	15,504	--a------	C:\WINDOWS\system32\drivers\mbam.sys
2008-10-20 13:42 . 2008-10-20 13:43	<DIR>	d--------	C:\Program Files\Malwarebytes' Anti-Malware
2008-10-20 13:42 . 2008-10-20 13:42	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-10-20 13:42 . 2008-10-16 20:25	38,496	--a------	C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-20 12:03 . 2008-10-21 08:32	<DIR>	d--------	C:\Program Files\Spybot - Search & Destroy
2008-10-20 12:03 . 2008-10-20 20:36	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-10-20 11:42 . 2008-10-20 11:42	<DIR>	d--------	C:\Program Files\SUPERAntiSpyware
2008-10-20 11:42 . 2008-10-20 11:42	<DIR>	d--------	C:\Program Files\Common Files\Wise Installation Wizard
2008-10-20 11:42 . 2008-10-20 11:42	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\SUPERAntiSpyware.com
2008-10-20 11:42 . 2008-10-20 11:42	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-10-19 18:26 . 2008-10-19 18:26	<DIR>	d--------	C:\~ErdUserProfile.$$$
2008-10-19 17:32 . 2008-10-19 18:48	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\jobutqzg
2008-10-19 17:31 . 2008-10-19 17:31	164	--a------	C:\WINDOWS\system32\TDSSbeat.dat
2008-10-19 17:26 . 2008-10-20 20:18	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\Ahead
2008-10-19 17:24 . 2008-10-19 17:24	<DIR>	d--------	C:\Program Files\Nero
2008-10-19 17:24 . 2008-10-19 17:30	<DIR>	d--------	C:\Program Files\Common Files\Ahead
2008-10-19 17:24 . 2008-10-19 17:24	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Nero
2008-10-19 17:21 . 2008-10-19 17:22	<DIR>	d--------	C:\Program Files\MagicISO
2008-10-17 23:46 . 2008-10-17 23:46	<DIR>	d--------	C:\Program Files\RemoteCalendars
2008-10-17 23:45 . 2008-10-18 10:40	<DIR>	d--------	C:\WINDOWS\NV16005988.TMP
2008-10-17 23:45 . 2008-09-17 23:55	201,050	--a------	C:\WINDOWS\system32\nvapps.nvb
2008-10-16 20:35 . 2008-10-16 20:35	23,736	--a------	C:\WINDOWS\system32\lmimirr.dll
2008-10-16 14:36 . 2008-10-16 14:54	3,532	--a------	C:\drmHeader.bin
2008-10-16 10:44 . 2008-10-16 10:44	<DIR>	d--------	C:\Program Files\iTunes
2008-10-16 10:44 . 2008-10-16 10:44	<DIR>	d--------	C:\Program Files\iPod
2008-10-16 10:44 . 2008-10-16 10:44	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-10-16 10:44 . 2008-04-17 13:12	107,368	--a------	C:\WINDOWS\system32\GEARAspi.dll
2008-10-16 10:44 . 2008-04-17 13:12	15,464	--a------	C:\WINDOWS\system32\drivers\GEARAspiWDM.sys
2008-10-16 10:43 . 2008-10-16 10:43	<DIR>	d--------	C:\Program Files\Bonjour
2008-10-15 16:19 . 2008-08-14 11:11	2,189,184	-----c---	C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-15 16:19 . 2008-08-14 11:09	2,145,280	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-15 16:19 . 2008-08-14 10:33	2,066,048	-----c---	C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-15 16:19 . 2008-08-14 10:33	2,023,936	-----c---	C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-10-15 15:00 . 2008-09-08 11:41	333,824	-----c---	C:\WINDOWS\system32\dllcache\srv.sys
2008-10-15 13:52 . 2008-09-15 13:12	1,846,400	-----c---	C:\WINDOWS\system32\dllcache\win32k.sys
2008-09-26 14:32 . 2008-09-26 14:32	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\nView_Profiles
2008-09-24 11:45 . 2008-09-24 11:47	28	--a------	C:\WINDOWS\ODBC.INI
2008-09-22 20:38 . 2008-10-16 10:44	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\Apple Computer
2008-09-22 09:50 . 2008-10-08 19:42	<DIR>	d--------	C:\home
2008-09-21 17:18 . 2008-09-21 17:18	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\skypePM
2008-09-21 17:18 . 2008-09-21 17:18	56	--ah-----	C:\WINDOWS\system32\ezsidmv.dat
2008-09-21 17:16 . 2008-09-21 17:16	<DIR>	d--------	C:\Program Files\Skype
2008-09-21 17:16 . 2008-09-21 17:16	<DIR>	d--------	C:\Program Files\Common Files\Skype
2008-09-21 17:16 . 2008-09-21 18:08	<DIR>	d--------	C:\Documents and Settings\Chris\Application Data\Skype
2008-09-21 17:16 . 2008-09-21 17:16	<DIR>	d--------	C:\Documents and Settings\All Users\Application Data\Skype
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-21 13:10	1,108	--sha-w	C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
2008-10-21 11:17	---------	d-----w	C:\Documents and Settings\Chris\Application Data\LogMeIn Rescue
2008-10-21 10:55	---------	d-----w	C:\Program Files\Google
2008-10-20 16:49	---------	d-----w	C:\Documents and Settings\Chris\Application Data\FileZilla
2008-10-20 12:36	0	----a-w	C:\WINDOWS\system32\drivers\logiflt.iad
2008-10-20 09:51	0	----a-w	C:\WINDOWS\system32\drivers\lvuvc.hs
2008-10-19 22:06	---------	d-----w	C:\Documents and Settings\Chris\Application Data\Hamachi
2008-10-16 09:44	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-10-16 09:43	---------	d-----w	C:\Program Files\Common Files\Apple
2008-09-20 10:48	---------	d-----w	C:\Program Files\MSXML 4.0
2008-09-19 13:46	---------	d-----w	C:\Documents and Settings\Chris\Application Data\Nokia
2008-09-19 13:46	---------	d-----w	C:\Documents and Settings\All Users\Application Data\PC Suite
2008-09-19 13:39	---------	d-----w	C:\Program Files\Nokia
2008-09-19 13:38	---------	d-----w	C:\Program Files\Common Files\Nokia
2008-09-19 13:38	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Nokia
2008-09-19 13:36	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Installations
2008-09-19 13:31	---------	d-----w	C:\Program Files\Common Files\muvee Technologies
2008-09-19 13:28	---------	d-----w	C:\Documents and Settings\Chris\Application Data\PC Suite
2008-09-19 13:26	---------	d-----w	C:\Program Files\DIFX
2008-09-19 13:26	---------	d-----w	C:\Program Files\Common Files\PCSuite
2008-09-19 05:38	114,304	----a-w	C:\WINDOWS\system32\drivers\Rtenicxp.sys
2008-09-18 21:54	---------	d-----w	C:\Program Files\DivX
2008-09-18 21:54	---------	d-----w	C:\Documents and Settings\Chris\Application Data\DivX
2008-09-18 15:54	---------	d-----w	C:\Program Files\FileZilla FTP Client
2008-09-18 15:07	---------	d-----w	C:\Program Files\Logitech
2008-09-18 15:07	---------	d-----w	C:\Program Files\Common Files\LogiShrd
2008-09-18 15:07	---------	d-----w	C:\Documents and Settings\Chris\Application Data\Leadertech
2008-09-18 15:07	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Logishrd
2008-09-18 15:02	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Office Genuine Advantage
2008-09-17 22:55	6,132,576	----a-w	C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-09-16 19:34	---------	d-----w	C:\Program Files\QuickTime
2008-09-16 19:34	---------	d-----w	C:\Program Files\Apple Software Update
2008-09-16 19:34	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Apple
2008-09-15 15:09	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-09-15 09:20	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Logitech
2008-09-12 14:48	25,280	----a-w	C:\WINDOWS\system32\drivers\hamachi.sys
2008-09-12 14:48	---------	d-----w	C:\Program Files\Hamachi
2008-09-11 11:32	---------	d-----w	C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-09-11 10:13	---------	d-----w	C:\Documents and Settings\Chris\Application Data\Windows Search
2008-09-11 08:30	---------	d-----w	C:\Documents and Settings\Chris\Application Data\ESET
2008-09-11 08:28	---------	d-----w	C:\Program Files\ESET
2008-09-11 08:28	---------	d-----w	C:\Documents and Settings\All Users\Application Data\ESET
2008-09-10 21:33	---------	d-----w	C:\Documents and Settings\All Users\Application Data\ACT
2008-09-10 15:37	---------	d-----w	C:\Program Files\Java
2008-09-10 15:36	---------	d-----w	C:\Program Files\Common Files\Java
2008-09-10 15:27	---------	d-----w	C:\Documents and Settings\All Users\Application Data\Sage Software SB, Inc
2008-09-10 15:26	88	--sh--r	C:\Documents and Settings\All Users\Application Data\FC250EE85F.sys
2008-09-10 15:24	---------	d-----w	C:\Program Files\EPSON
2008-09-10 15:16	---------	d--h--w	C:\Program Files\InstallShield Installation Information
2008-09-10 15:16	---------	d-----w	C:\Documents and Settings\Chris\Application Data\IsolatedStorage
2008-09-10 15:14	---------	d-----w	C:\Program Files\Common Files\Protexis
2008-09-10 15:11	---------	d-----w	C:\Program Files\Microsoft.NET
2008-09-10 15:11	---------	d-----w	C:\Program Files\Microsoft SQL Server
2008-09-10 15:10	---------	d-----w	C:\Program Files\ACT
2008-09-10 15:10	---------	d-----w	C:\Documents and Settings\Chris\Application Data\ACT
2008-09-10 15:00	---------	d-----w	C:\Program Files\MSXML 6.0
2008-09-10 14:57	---------	d-----w	C:\Documents and Settings\Chris\Application Data\Windows Desktop Search
2008-09-10 14:53	0	---ha-w	C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-09-10 14:53	0	---ha-w	C:\WINDOWS\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2008-09-10 14:53	---------	d-----w	C:\Program Files\NOS
2008-09-10 14:53	---------	d-----w	C:\Documents and Settings\All Users\Application Data\NOS
2008-09-10 14:52	---------	d-----w	C:\Program Files\Windows Desktop Search
2008-09-10 14:45	---------	d-----w	C:\Program Files\Windows Media Connect 2
2008-09-10 14:41	---------	d-----w	C:\Program Files\Reference Assemblies
2008-09-10 14:30	---------	d-----w	C:\Program Files\Common Files\Adobe AIR
2008-09-10 14:29	---------	d-----w	C:\Program Files\Common Files\Adobe
2008-09-10 13:46	---------	d-----w	C:\Program Files\MSBuild
2008-09-10 13:46	---------	d-----w	C:\Program Files\Microsoft Works
2008-09-10 13:27	15,600	----a-w	C:\WINDOWS\gdrv.sys
2008-09-10 13:27	---------	d-----w	C:\Program Files\Realtek
2008-09-10 13:27	---------	d-----w	C:\Documents and Settings\Chris\Application Data\InstallShield
2008-09-10 13:25	315,392	----a-w	C:\WINDOWS\HideWin.exe
2008-09-10 13:25	---------	d-----w	C:\Program Files\Common Files\InstallShield
2008-09-10 13:22	---------	d-----w	C:\Program Files\Yahoo!
2008-09-10 13:22	---------	d-----w	C:\Program Files\Intel
2008-09-10 13:16	---------	d-----w	C:\Program Files\microsoft frontpage
2008-09-08 10:41	333,824	----a-w	C:\WINDOWS\system32\drivers\srv.sys
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-17 133104]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"JMB36X IDE Setup"="C:\WINDOWS\RaidTool\xInsIDE.exe" [2007-03-20 36864]
"36X Raid Configurer"="C:\WINDOWS\system32\xRaidSetup.exe" [2007-05-25 1953792]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-09-17 13574144]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"Google Desktop Search"="C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-09-10 29744]
"Act.Outlook.Service"="C:\Program Files\ACT\Act for Windows\Act.Outlook.Service.exe" [2007-08-14 9728]
"Act! Preloader"="C:\Program Files\ACT\Act for Windows\ActSage.exe" [2007-08-14 1351680]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"egui"="C:\Program Files\ESET\ESET Smart Security\egui.exe" [2008-08-18 1447168]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-09-06 413696]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-08-14 565008]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2008-08-14 2407184]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-09-17 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"LogMeIn GUI"="C:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-05 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2008-09-17 C:\WINDOWS\system32\nwiz.exe]
 
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
 
C:\Documents and Settings\Chris\Start Menu\Programs\Startup\
hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2008-09-12 625952]
Logitech . Product Registration.lnk - C:\Program Files\Logitech\QuickCam\eReg.exe [2008-02-13 493832]
 
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Calendar Sync.lnk - C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe [2008-10-02 546288]
Nokia Nseries PC Suite.lnk - C:\Program Files\Nokia\NNPCS\RunLauncher.exe [2008-01-14 679936]
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 20:35 87352 C:\WINDOWS\system32\LMIinit.dll
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSrvdc.sys]
@="driver"
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\ACT\\Act for Windows\\ActSage.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009
 
R2 LMIInfo;LogMeIn Kernel Information Provider;C:\Program Files\LogMeIn\x86\RaInfo.sys [2008-07-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2008-07-24 47640]
R2 MSSQL$ACT7;SQL Server (ACT7);C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2007-02-10 29178224]
R2 PSI_SVC_2;Protexis Licensing V2;c:\program files\common files\protexis\license service\psiservice_2.exe [2007-04-12 178752]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2008-09-10 29744]
S3 LachesisFltr;Lachesis Mouse Driver;C:\WINDOWS\system32\drivers\Lachesis.sys [2007-08-08 12032]
S3 LVRS;Logitech RightSound Filter Driver;C:\WINDOWS\system32\DRIVERS\lvrs.sys [2008-07-26 627864]
S3 PciCon;PciCon;I:\PciCon.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
 
2008-10-21 C:\WINDOWS\Tasks\GoogleUpdateTaskUser.job
- C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-17 16:22]
.
- - - - ORPHANS REMOVED - - - -
 
BHO-{159229C1-C44F-42D8-AEC6-09FBFB6375FC} - C:\WINDOWS\system32\cbXQjJAt.dll
BHO-{2d297fdd-679f-4b9e-b46d-ffbb9e340196} - C:\WINDOWS\system32\rmvfln.dll
BHO-{DA944A6E-4EE3-49D0-B0EF-84A2FFB20C9E} - C:\WINDOWS\system32\yayaXOIb.dll
HKLM-Run-5cff2990 - C:\WINDOWS\system32\pcpucape.dll
ShellExecuteHooks-{159229C1-C44F-42D8-AEC6-09FBFB6375FC} - C:\WINDOWS\system32\cbXQjJAt.dll
 
 
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\a6u44j5w.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.co.uk
FF -: plugin - C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\a6u44j5w.default\extensions\LogMeInClient@logmein.com\plugins\npRACtrl.dll
FF -: plugin - C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npGoogleGadgetPluginFirefoxWin.dll
.
 
**************************************************************************
 
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-21 14:13:29
Windows 5.1.2600 Service Pack 3 NTFS
 
scanning hidden processes ... 
 
scanning hidden autostart entries ...
 
scanning hidden files ... 
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\LogMeIn\x86\ramaint.exe
C:\Program Files\LogMeIn\x86\LogMeIn.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\WINDOWS\system32\searchindexer.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\searchprotocolhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\searchfilterhost.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-10-21 14:16:02 - machine was rebooted
ComboFix-quarantined-files.txt  2008-10-21 13:15:57
 
Pre-Run: 136,674,951,168 bytes free
Post-Run: 136,852,152,320 bytes free
 
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(1)partition(1)\WINDOWS
[operating systems]
D:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(1)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
 
315	--- E O F ---	2008-10-16 05:05:18

Open in new window

0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 22767505
Combofix deleted a lot of bad files there.

Run combofix again using this script.
1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
C:\WINDOWS\system32\TDSSbeat.dat

Folder::
C:\Documents and Settings\All Users\Application Data\jobutqzg

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TDSSrvdc.sys]
------------------------------------------------------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

C:\~ErdUserProfile.$$$ <-- this file was created at the same time as the other bad ones, check the properties and see what it says.
0
 

Author Comment

by:wireless24
ID: 22767544
hold on ,

please do not close this question.

cheers
0
 
LVL 20

Expert Comment

by:IndiGenus
ID: 22767931
wireless24,
No one will close the question. That's up to you.

Good spot rpg, I looked right passed the google part of that 020. And vundo along with TDSSSERV rootkit was there. Nice work as usual!
 

0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 22829158
>>>I looked right passed the google part of that 020<<<
easy to look right passed it as it was obscured but I cheated and used the analyzer, :) thanks.
Vee_mod,
Thank you for closing.
wireless24,
You may then uninstall combofix.
Go to Start > Run and copy and paste next command in the field:

ComboFix /u

The procedure will delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Set a new, clean Restore Point.
0

Featured Post

When ransomware hits your clients, what do you do?

MSPs: Endpoint security isn’t enough to prevent ransomware.
As the impact and severity of crypto ransomware attacks has grown, Webroot has fought back, not just by building a next-gen endpoint solution capable of preventing ransomware attacks but also by being a thought leader.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Read about why website design really matters in today's demanding market.
For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question