[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Vundo trojan, XP Home SP3 access denied, missing BITS file

Posted on 2009-04-08
7
Medium Priority
?
2,255 Views
Last Modified: 2013-11-22
Working on a machine pretty well crippled by Vundo trojan.  Eradicated most if not all manifestations with various AV programs, including MalwareBytes and HijackThis.  Restored access to Registry OK.  Still cannot get Automatic Updates to work or even install updates by going to MS website, because BITS service is stopped and cannot be started because of missing file.  Attempts to install SP3 from MS-TechNet disk look good up until the end when it just displays an "Access is Denied) window and backs out of the install.  Tried a repair by reinstalling SP2, with same result - Access denied.  Have attempted restore with OEM's install disk (Microcenter), but that doesn't restore the crippled functionality.  Running a SFC now against an XP-Home Upgrade CD and that might help; don't know yet.

Question:  The missing BITS (Background Intelligent Transfer System) file might be key; but what is it and where would I get it if SFC doesn't do the job?

Any other help with this really nasty Trojan would be much appreciated.

Ron Hicks, Arlington VA
0
Comment
Question by:Ronald Hicks
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 3
7 Comments
 
LVL 47

Accepted Solution

by:
rpggamergirl earned 2000 total points
ID: 24096675
Check that the path to executable is correct --> %SystemRoot%\system32\svchost.exe -k netsvcs
If it's wrong, then Edit the registry to fix the path there.

You can look in the services window or look in the registry.

Start > Run > type in

regedit

Enter and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS
in the right Window pane look for" Imagepath"
Then in the data column if it has  %fystemRoot%\system32\svchost.exe -k netsvcs
doubleclick on Imagepath and change it to %SystemRoot%\system32\svchost.exe -k netsvcs
and OK.


If regedit won't let you edit the registry you can rename it to regedit.com or download this regtools.vbs first.
http://www.dougknox.com/security/scripts_desc/regtools.htm

Or: this utility also enable access to the registry.
http://www.dougknox.com/xp/utils/xp_emerutils.htm
And go to the C:\EmergencyUtils folder and double click Copy_of_Regedit.com
 
Also scan with Combofix and show us the logfile.

Please download ComboFix by sUBs:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe 
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log and attach it in your next reply by pasting it in the "Code Snippet" or "Attach File" window.
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.


If needed, here's the Combofix tutorial which includes the installation of the Recovery Console:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

0
 

Author Comment

by:Ronald Hicks
ID: 24103699
You were "spot on" about "System" having been changed to fystem.  Neither of the DougKnox fixes worked.  I still could not edit the registry with the "copy_of_regedit.exe in the EmergencyUntil folder.

I'm attaching (if I can figure out how) the CF log file.  It lists a lot of really suspicious file names.

Perhaps of note is that CF reported that Norton 2005 was running, but I don't have Norton or Symantec installed and there was no running process that seemed related to Norton, so I clicked OK
Running from: c:\documents and settings\Virginia\Desktop\ComboFix.exe
AV: Norton AntiVirus 2005 *On-access scanning enabled* (Updated)
AV: Spy Sweeper with AntiVirus *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *enabled*
 * Created a new restore point
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\windows\ebiyujupiliyojo.dll
c:\windows\system32\afesatah.ini
c:\windows\system32\agusivof.ini
c:\windows\system32\ateyanun.ini
c:\windows\system32\azevozab.ini
c:\windows\system32\erilerot.ini
c:\windows\system32\esilufug.ini
c:\windows\system32\ifobehel.ini
c:\windows\system32\ijiwuboy.ini
c:\windows\system32\ilayopaw.ini
c:\windows\system32\ivayoyot.ini
c:\windows\system32\obizasis.ini
c:\windows\system32\okapasaf.ini
c:\windows\system32\onupuyur.ini
c:\windows\system32\ubolafoh.ini
c:\windows\system32\ufidisav.ini
c:\windows\system32\uhapurid.ini
 
.
(((((((((((((((((((((((((   Files Created from 2009-03-09 to 2009-04-09  )))))))))))))))))))))))))))))))
.
 
2009-04-08 22:01 . 2009-04-08 22:01	<DIR>	d--------	C:\EmergencyUtils
2009-04-08 08:44 . 2004-08-04 00:56	116,224	--a--c---	c:\windows\system32\dllcache\xrxwiadr.dll
2009-04-08 08:44 . 2001-08-17 22:37	99,865	--a--c---	c:\windows\system32\dllcache\xlog.exe
2009-04-08 08:44 . 2001-08-17 22:37	27,648	--a--c---	c:\windows\system32\dllcache\xrxftplt.exe
2009-04-08 08:44 . 2001-08-17 22:36	23,040	--a--c---	c:\windows\system32\dllcache\xrxwbtmp.dll
2009-04-08 08:44 . 2004-08-03 22:29	19,455	--a--c---	c:\windows\system32\dllcache\wvchntxx.sys
2009-04-08 08:44 . 2004-08-03 23:10	19,328	--a--c---	c:\windows\system32\dllcache\wstcodec.sys
2009-04-08 08:44 . 2001-08-17 22:36	17,408	--a--c---	c:\windows\system32\dllcache\xrxscnui.dll
2009-04-08 08:44 . 2001-08-17 12:11	16,970	--a--c---	c:\windows\system32\dllcache\xem336n5.sys
2009-04-08 08:44 . 2001-08-17 22:37	4,608	--a--c---	c:\windows\system32\dllcache\xrxflnch.exe
2009-04-08 08:43 . 2001-08-17 13:28	771,581	--a--c---	c:\windows\system32\dllcache\winacisa.sys
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winzm.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winsp.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winpy.ime
2009-04-08 08:43 . 2004-08-03 22:31	154,624	--a--c---	c:\windows\system32\dllcache\wlluc48.sys
2009-04-08 08:43 . 2004-08-04 08:00	79,360	--a--c---	c:\windows\system32\dllcache\winar30.ime
2009-04-08 08:43 . 2004-08-04 08:00	69,120	--a--c---	c:\windows\system32\dllcache\wingb.ime
2009-04-08 08:43 . 2004-08-04 08:00	65,536	--a--c---	c:\windows\system32\dllcache\winime.ime
2009-04-08 08:43 . 2001-08-17 12:12	34,890	--a--c---	c:\windows\system32\dllcache\wlandrv2.sys
2009-04-08 08:43 . 2004-08-03 22:29	12,063	--a--c---	c:\windows\system32\dllcache\wsiintxx.sys
2009-04-08 08:43 . 2004-08-03 23:07	8,832	--a--c---	c:\windows\system32\dllcache\wmiacpi.sys
2009-04-08 08:43 . 2004-08-04 00:56	8,192	--a--c---	c:\windows\system32\dllcache\wshirda.dll
2009-04-08 08:41 . 2001-08-17 13:28	794,654	--a--c---	c:\windows\system32\dllcache\usr1801.sys
2009-04-08 08:40 . 2001-08-17 22:36	216,064	--a--c---	c:\windows\system32\dllcache\um34scan.dll
2009-04-08 08:39 . 2001-08-17 22:36	525,568	--a--c---	c:\windows\system32\dllcache\tridxp.dll
2009-04-08 08:39 . 2001-08-17 14:56	440,576	--a--c---	c:\windows\system32\dllcache\tridkb.dll
2009-04-08 08:39 . 2001-08-17 14:56	315,520	--a--c---	c:\windows\system32\dllcache\trid3d.dll
2009-04-08 08:39 . 2001-08-17 14:02	230,912	--a--c---	c:\windows\system32\dllcache\tosdvd03.sys
2009-04-08 08:39 . 2001-08-17 12:51	222,336	--a--c---	c:\windows\system32\dllcache\trid3dm.sys
2009-04-08 08:39 . 2001-08-17 12:51	166,784	--a--c---	c:\windows\system32\dllcache\tridxpm.sys
2009-04-08 08:39 . 2001-08-17 12:51	159,232	--a--c---	c:\windows\system32\dllcache\tridkbm.sys
2009-04-08 08:39 . 2004-08-04 00:56	82,432	--a--c---	c:\windows\system32\dllcache\tp4mon.exe
2009-04-08 08:39 . 2001-08-17 22:35	42,496	--a--c---	c:\windows\system32\dllcache\tp4res.dll
2009-04-08 08:39 . 2001-08-17 12:12	34,375	--a--c---	c:\windows\system32\dllcache\tpro4.sys
2009-04-08 08:39 . 2001-08-17 22:36	31,744	--a--c---	c:\windows\system32\dllcache\tp4.dll
2009-04-08 08:39 . 2001-08-17 13:48	11,520	--a--c---	c:\windows\system32\dllcache\twotrack.sys
2009-04-08 08:39 . 2001-08-17 13:51	4,992	--a--c---	c:\windows\system32\dllcache\toside.sys
2009-04-08 08:37 . 2001-08-17 12:18	285,760	--a--c---	c:\windows\system32\dllcache\stlnata.sys
2009-04-08 08:36 . 2004-08-04 08:00	143,422	--a--c---	c:\windows\system32\dllcache\softkey.dll
2009-04-08 08:36 . 2001-08-17 22:36	114,688	--a--c---	c:\windows\system32\dllcache\sonypi.dll
2009-04-08 08:36 . 2001-08-17 22:36	106,584	--a--c---	c:\windows\system32\dllcache\spdports.dll
2009-04-08 08:36 . 2001-08-17 22:36	99,328	--a--c---	c:\windows\system32\dllcache\srusd.dll
2009-04-08 08:36 . 2001-08-17 13:51	61,824	--a--c---	c:\windows\system32\dllcache\speed.sys
2009-04-08 08:36 . 2001-08-17 12:11	48,736	--a--c---	c:\windows\system32\dllcache\srwlnd5.sys
2009-04-08 08:36 . 2001-08-17 12:51	37,040	--a--c---	c:\windows\system32\dllcache\sonypi.sys
2009-04-08 08:36 . 2001-08-17 22:36	24,660	--a--c---	c:\windows\system32\dllcache\spxupchk.dll
2009-04-08 08:36 . 2001-08-17 12:51	20,752	--a--c---	c:\windows\system32\dllcache\sonync.sys
2009-04-08 08:36 . 2001-08-17 14:07	19,072	--a--c---	c:\windows\system32\dllcache\sparrow.sys
2009-04-08 08:36 . 2001-08-17 13:53	9,600	--a--c---	c:\windows\system32\dllcache\sonymc.sys
2009-04-08 08:36 . 2001-08-17 13:56	7,552	--a--c---	c:\windows\system32\dllcache\sonypvu1.sys
2009-04-08 08:36 . 2004-08-03 23:00	7,552	--a--c---	c:\windows\system32\dllcache\sonyait.sys
2009-04-08 08:34 . 2001-08-17 14:56	252,032	--a--c---	c:\windows\system32\dllcache\sis300iv.dll
2009-04-08 08:34 . 2001-08-17 22:36	238,592	--a--c---	c:\windows\system32\dllcache\sisgrv.dll
2009-04-08 08:34 . 2001-08-17 14:56	157,696	--a--c---	c:\windows\system32\dllcache\sisv256.dll
2009-04-08 08:34 . 2001-08-17 14:56	150,144	--a--c---	c:\windows\system32\dllcache\sis6306v.dll
2009-04-08 08:34 . 2001-08-17 12:50	104,064	--a--c---	c:\windows\system32\dllcache\sisgrp.sys
2009-04-08 08:34 . 2001-08-17 12:50	101,760	--a--c---	c:\windows\system32\dllcache\sis300ip.sys
2009-04-08 08:34 . 2001-08-17 12:12	94,698	--a--c---	c:\windows\system32\dllcache\sk98xwin.sys
2009-04-08 08:34 . 2001-08-17 12:12	91,294	--a--c---	c:\windows\system32\dllcache\skfpwin.sys
2009-04-08 08:34 . 2001-08-17 12:50	68,608	--a--c---	c:\windows\system32\dllcache\sis6306p.sys
2009-04-08 08:34 . 2004-08-03 22:31	63,547	--a--c---	c:\windows\system32\dllcache\sla30nd5.sys
2009-04-08 08:34 . 2001-08-17 12:50	50,432	--a--c---	c:\windows\system32\dllcache\sisv.sys
2009-04-08 08:34 . 2004-08-03 22:31	32,768	--a--c---	c:\windows\system32\dllcache\sisnic.sys
2009-04-08 08:34 . 2004-08-03 23:10	11,136	--a--c---	c:\windows\system32\dllcache\slip.sys
2009-04-08 08:32 . 2001-08-17 22:36	495,616	--a--c---	c:\windows\system32\dllcache\sblfx.dll
2009-04-08 08:31 . 2001-08-17 22:36	86,097	--a--c---	c:\windows\system32\dllcache\reslog32.dll
2009-04-08 08:31 . 2004-08-03 22:59	79,104	--a--c---	c:\windows\system32\dllcache\rocket.sys
2009-04-08 08:31 . 2001-08-17 12:12	37,563	--a--c---	c:\windows\system32\dllcache\rlnet5.sys
2009-04-08 08:31 . 2001-08-17 12:19	30,720	--a--c---	c:\windows\system32\dllcache\rthwcls.sys
2009-04-08 08:31 . 2001-08-17 22:36	26,624	--a--c---	c:\windows\system32\dllcache\rw450ext.dll
2009-04-08 08:31 . 2004-08-04 08:00	26,112	--a--c---	c:\windows\system32\dllcache\romanime.ime
2009-04-08 08:31 . 2001-08-17 22:36	24,576	--a--c---	c:\windows\system32\dllcache\rw430ext.dll
2009-04-08 08:31 . 2004-08-03 22:31	20,992	--a--c---	c:\windows\system32\dllcache\rtl8139.sys
2009-04-08 08:31 . 2001-08-17 13:51	19,584	--a--c---	c:\windows\system32\dllcache\rasirda.sys
2009-04-08 08:31 . 2001-08-17 12:12	19,017	--a--c---	c:\windows\system32\dllcache\rtl8029.sys
2009-04-08 08:31 . 2001-08-17 22:36	9,216	--a--c---	c:\windows\system32\dllcache\rsmgrstr.dll
2009-04-08 08:31 . 2001-08-17 12:19	3,840	--a--c---	c:\windows\system32\dllcache\rpfun.sys
2009-04-08 08:29 . 2004-08-04 08:00	482,304	--a--c---	c:\windows\system32\dllcache\pintlgnt.ime
2009-04-08 08:28 . 2001-08-17 14:05	351,616	--a--c---	c:\windows\system32\dllcache\ovcodek2.sys
2009-04-08 08:27 . 2001-08-17 12:50	198,144	--a--c---	c:\windows\system32\dllcache\nv3.sys
2009-04-08 08:27 . 2001-08-17 22:36	123,776	--a--c---	c:\windows\system32\dllcache\nv3.dll
2009-04-08 08:27 . 2001-08-17 22:36	116,736	--a--c---	c:\windows\system32\dllcache\ovcodec2.dll
2009-04-08 08:27 . 2004-08-03 23:10	61,056	--a--c---	c:\windows\system32\dllcache\ohci1394.sys
2009-04-08 08:27 . 2001-08-17 12:20	54,528	--a--c---	c:\windows\system32\dllcache\opl3sax.sys
2009-04-08 08:27 . 2001-08-17 13:28	54,186	--a--c---	c:\windows\system32\dllcache\otcsercb.sys
2009-04-08 08:27 . 2001-08-17 12:49	51,552	--a--c---	c:\windows\system32\dllcache\ntgrip.sys
2009-04-08 08:27 . 2001-08-17 14:05	48,000	--a--c---	c:\windows\system32\dllcache\ovcam2.sys
2009-04-08 08:27 . 2001-08-17 12:12	43,689	--a--c---	c:\windows\system32\dllcache\otceth5.sys
2009-04-08 08:27 . 2001-08-17 14:05	31,872	--a--c---	c:\windows\system32\dllcache\ovce.sys
2009-04-08 08:27 . 2001-08-17 14:05	28,032	--a--c---	c:\windows\system32\dllcache\ovcd.sys
2009-04-08 08:27 . 2001-08-17 12:12	27,209	--a--c---	c:\windows\system32\dllcache\otc06x5.sys
2009-04-08 08:27 . 2001-08-17 14:05	25,088	--a--c---	c:\windows\system32\dllcache\ovca.sys
2009-04-08 08:25 . 2004-08-04 08:00	229,439	--a--c---	c:\windows\system32\dllcache\multibox.dll
2009-04-08 08:24 . 2004-08-04 08:00	1,875,968	--a--c---	c:\windows\system32\dllcache\msir3jp.lex
2009-04-08 08:24 . 2004-08-04 08:00	98,304	--a--c---	c:\windows\system32\dllcache\msir3jp.dll
2009-04-08 08:24 . 2004-08-04 00:56	56,832	--a--c---	c:\windows\system32\dllcache\msdvbnp.ax
2009-04-08 08:24 . 2004-08-03 23:10	51,328	--a--c---	c:\windows\system32\dllcache\msdv.sys
2009-04-08 08:24 . 2001-08-17 14:02	35,200	--a--c---	c:\windows\system32\dllcache\msgame.sys
2009-04-08 08:24 . 2004-08-03 23:00	22,016	--a--c---	c:\windows\system32\dllcache\msircomm.sys
2009-04-08 08:24 . 2001-08-17 13:52	17,280	--a--c---	c:\windows\system32\dllcache\mraid35x.sys
2009-04-08 08:24 . 2004-08-03 23:10	15,360	--a--c---	c:\windows\system32\dllcache\mpe.sys
2009-04-08 08:24 . 2001-08-17 13:48	12,416	--a--c---	c:\windows\system32\dllcache\msriffwv.sys
2009-04-08 08:24 . 2001-08-17 13:48	6,016	--a--c---	c:\windows\system32\dllcache\msfsio.sys
2009-04-08 08:24 . 2001-08-17 14:00	2,944	--a--c---	c:\windows\system32\dllcache\msmpu401.sys
2009-04-08 08:23 . 2001-08-17 12:50	320,384	--a--c---	c:\windows\system32\dllcache\mgaum.sys
2009-04-08 08:23 . 2001-08-17 14:56	235,648	--a--c---	c:\windows\system32\dllcache\mgaud.dll
2009-04-08 08:23 . 2001-08-17 12:12	164,586	--a--c---	c:\windows\system32\dllcache\mdgndis5.sys
2009-04-08 08:23 . 2001-08-17 22:36	58,880	--a--c---	c:\windows\system32\dllcache\m3092dc.dll
2009-04-08 08:23 . 2001-08-17 12:19	48,768	--a--c---	c:\windows\system32\dllcache\maestro.sys
2009-04-08 08:23 . 2001-08-17 22:36	47,616	--a--c---	c:\windows\system32\dllcache\memgrp.dll
2009-04-08 08:23 . 2004-08-03 23:00	26,112	--a--c---	c:\windows\system32\dllcache\memstpci.sys
2009-04-08 08:23 . 2001-08-17 13:57	16,128	--a--c---	c:\windows\system32\dllcache\modemcsa.sys
2009-04-08 08:23 . 2001-08-17 13:48	12,160	--a--c---	c:\windows\system32\dllcache\mouhid.sys
2009-04-08 08:23 . 2001-08-17 13:58	8,320	--a--c---	c:\windows\system32\dllcache\memcard.sys
2009-04-08 08:23 . 2001-08-17 13:52	7,424	--a--c---	c:\windows\system32\dllcache\mammoth.sys
2009-04-08 08:23 . 2001-08-17 13:52	6,528	--a--c---	c:\windows\system32\dllcache\miniqic.sys
2009-04-08 08:21 . 2004-08-04 08:00	1,158,818	--a--c---	c:\windows\system32\dllcache\korwbrkr.lex
2009-04-08 08:21 . 2001-08-17 22:36	242,176	--a--c---	c:\windows\system32\dllcache\kdsusd.dll
2009-04-08 08:21 . 2004-08-04 08:00	70,656	--a--c---	c:\windows\system32\dllcache\korwbrkr.dll
2009-04-08 08:21 . 2001-08-17 22:36	45,568	--a--c---	c:\windows\system32\dllcache\kdsui.dll
2009-04-08 08:21 . 2001-08-17 22:36	37,376	--a--c---	c:\windows\system32\dllcache\kousd.dll
2009-04-08 08:21 . 2004-08-03 22:58	14,848	--a--c---	c:\windows\system32\dllcache\kbdhid.sys
2009-04-08 08:21 . 2001-08-17 22:36	8,704	--a--c---	c:\windows\system32\dllcache\kbdjpn.dll
2009-04-08 08:21 . 2001-08-17 22:36	8,192	--a--c---	c:\windows\system32\dllcache\kbdkor.dll
2009-04-08 08:21 . 2001-08-17 14:55	6,144	--a--c---	c:\windows\system32\dllcache\kbd106.dll
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 15:30	---------	d-----w	c:\documents and settings\Virginia\Application Data\MSNInstaller
2009-04-06 14:51	---------	d-----w	c:\documents and settings\Virginia\Application Data\Apple Computer
2009-04-06 14:31	---------	d-----w	c:\program files\Common Files\Adobe
2009-03-24 18:35	---------	d-----w	c:\program files\Common Files\Apple
2009-02-23 19:48	---------	d-----w	c:\program files\Angle Interactive
2006-12-11 17:53	85,954	----a-w	c:\program files\10187EZ.pdf
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-16 67128]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-02-24 5537792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-02-24 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 5367664]
"SoundMan"="SOUNDMAN.EXE" [2005-03-11 c:\windows\SOUNDMAN.EXE]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-16 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-01-24 450560]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-12-06 204800]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 20:35 87352 c:\windows\system32\LMIinit.dll
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winxd84.sys]
@="Driver"
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"=
"c:\\Program Files\\Logitech\\SetPoint\\SetPoint.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
 
R0 dnflbrai;dnflbrai;c:\windows\system32\drivers\dnflbrai.sys [2005-08-30 23424]
R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2008-07-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-04-06 47640]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 2d9bd59f0d6f59893e042e9c8d03c1d4;2d9bd59f0d6f59893e042e9c8d03c1d4;c:\windows\system32\2d9bd59f0d6f59893e042e9c8d03c1d4.sys --> c:\windows\system32\2d9bd59f0d6f59893e042e9c8d03c1d4.sys [?]
S0 winxd84;winxd84;c:\windows\system32\Drivers\Winxd84.sys --> c:\windows\system32\Drivers\Winxd84.sys [?]
S1 31f6b743;31f6b743;c:\windows\system32\drivers\31f6b743.sys --> c:\windows\system32\drivers\31f6b743.sys [?]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-06 108289]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-31 33176]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder
 
2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
 
2005-05-20 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE []
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- C:\ [2009-04-08 22:33]
.
- - - - ORPHANS REMOVED - - - -
 
BHO-{386eee7a-3dd8-4b2c-8a5d-2e32e9da0c9b} - c:\windows\system32\batmete.dll
Notify-dimsntfy - (no file)
 
 
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.acornweb.org/
uSearch Bar = hxxp://cgi.verizon.net/bookmarks/bmredir.asp?region=all&bw=dsl&cd=6.1&bm=ho_search
uInternet Settings,ProxyServer = www.stephen.org/wedding
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
Trusted Zone: microsoft.com\UPDATE
Trusted Zone: windowsupdate.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Virginia\Application Data\Mozilla\Firefox\Profiles\gxab0rik.default\
FF - prefs.js: network.proxy.ftp - www.stephen.org/wedding
FF - prefs.js: network.proxy.gopher - www.stephen.org/wedding
FF - prefs.js: network.proxy.http - www.stephen.org/wedding
FF - prefs.js: network.proxy.socks - www.stephen.org/wedding
FF - prefs.js: network.proxy.ssl - www.stephen.org/wedding
FF - prefs.js: network.proxy.type - 1
.
 
**************************************************************************
 
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-08 22:33:53
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(652)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\WRLogonNTF.dll
c:\windows\system32\LMIRfsClientNP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\LogMeIn\x86\ramaint.exe
c:\program files\LogMeIn\x86\LogMeIn.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\LogMeIn\x86\LMIGuardian.exe
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Verizon Online\bin\mpbtn.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\Webroot\Spy Sweeper\ssu.exe
.
**************************************************************************
.
Completion time: 2009-04-08 22:38:22 - machine was rebooted
ComboFix-quarantined-files.txt  2009-04-09 02:38:17
 
Pre-Run: 148,155,998,208 bytes free
Post-Run: 148,343,873,536 bytes free
 
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect
 
Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4
300	--- E O F ---	2009-01-19 02:30:50

Open in new window

0
 
LVL 47

Assisted Solution

by:rpggamergirl
rpggamergirl earned 2000 total points
ID: 24104147

>>>>but I don't have Norton or Symantec installed and there was no running process that seemed related to Norton<<<
I included the task and the folder belonging to Symantec in the script which were showing in the CF log.


Run combofix again using this script. (afterwards and try changing the BITS path to executable again and see if it's successful this time.
1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
KillAll::
File::
c:\windows\Tasks\Symantec NetDetect.job

RootKit::
c:\windows\system32\drivers\dnflbrai.sys
c:\windows\system32\2d9bd59f0d6f59893e042e9c8d03c1d4.sys
c:\windows\system32\Drivers\Winxd84.sys
c:\windows\system32\drivers\31f6b743.sys

Folder::
c:\program files\Symantec

Driver::
dnflbrai
winxd84
31f6b743
2d9bd59f0d6f59893e042e9c8d03c1d4

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\winxd84.sys]
------------------------------------------------------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.

 
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 

Author Comment

by:Ronald Hicks
ID: 24106609
OK, did the above.  New log file attached.  Still cannot edit registry, even with Copy_of_regedit.com.
Has the Registry file been made ReadOnly?  How did Vundo accomplish this trick? What now?

I'm thinking that I should wipe the disk and reinstall, but I've wanted to go as far as I could without doing that.  And by wiping, I mean probably removing it and wiping it with my DriveErase appliance.
ComboFix 09-04-04.01 - Virginia 2009-04-09  8:19:40.3 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.447.158 [GMT -4:00]
Running from: c:\documents and settings\Virginia\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Virginia\Desktop\CFScript.txt
AV: Norton AntiVirus 2005 *On-access scanning enabled* (Updated)
AV: Spy Sweeper with AntiVirus *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *enabled*
 * Created a new restore point
 
FILE ::
c:\windows\Tasks\Symantec NetDetect.job
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\windows\system32\drivers\dnflbrai.sys
 
.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
-------\Legacy_DNFLBRAI
 
 
(((((((((((((((((((((((((   Files Created from 2009-03-09 to 2009-04-09  )))))))))))))))))))))))))))))))
.
 
2009-04-09 07:35 . 2009-04-09 07:35	<DIR>	d--------	c:\documents and settings\NetworkService\Application Data\Webroot
2009-04-08 22:01 . 2009-04-08 22:01	<DIR>	d--------	C:\EmergencyUtils
2009-04-08 08:44 . 2004-08-04 00:56	116,224	--a--c---	c:\windows\system32\dllcache\xrxwiadr.dll
2009-04-08 08:44 . 2001-08-17 22:37	99,865	--a--c---	c:\windows\system32\dllcache\xlog.exe
2009-04-08 08:44 . 2001-08-17 22:37	27,648	--a--c---	c:\windows\system32\dllcache\xrxftplt.exe
2009-04-08 08:44 . 2001-08-17 22:36	23,040	--a--c---	c:\windows\system32\dllcache\xrxwbtmp.dll
2009-04-08 08:44 . 2004-08-03 22:29	19,455	--a--c---	c:\windows\system32\dllcache\wvchntxx.sys
2009-04-08 08:44 . 2004-08-03 23:10	19,328	--a--c---	c:\windows\system32\dllcache\wstcodec.sys
2009-04-08 08:44 . 2001-08-17 22:36	17,408	--a--c---	c:\windows\system32\dllcache\xrxscnui.dll
2009-04-08 08:44 . 2001-08-17 12:11	16,970	--a--c---	c:\windows\system32\dllcache\xem336n5.sys
2009-04-08 08:44 . 2001-08-17 22:37	4,608	--a--c---	c:\windows\system32\dllcache\xrxflnch.exe
2009-04-08 08:43 . 2001-08-17 13:28	771,581	--a--c---	c:\windows\system32\dllcache\winacisa.sys
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winzm.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winsp.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winpy.ime
2009-04-08 08:43 . 2004-08-03 22:31	154,624	--a--c---	c:\windows\system32\dllcache\wlluc48.sys
2009-04-08 08:43 . 2004-08-04 08:00	79,360	--a--c---	c:\windows\system32\dllcache\winar30.ime
2009-04-08 08:43 . 2004-08-04 08:00	69,120	--a--c---	c:\windows\system32\dllcache\wingb.ime
2009-04-08 08:43 . 2004-08-04 08:00	65,536	--a--c---	c:\windows\system32\dllcache\winime.ime
2009-04-08 08:43 . 2001-08-17 12:12	34,890	--a--c---	c:\windows\system32\dllcache\wlandrv2.sys
2009-04-08 08:43 . 2004-08-03 22:29	12,063	--a--c---	c:\windows\system32\dllcache\wsiintxx.sys
2009-04-08 08:43 . 2004-08-03 23:07	8,832	--a--c---	c:\windows\system32\dllcache\wmiacpi.sys
2009-04-08 08:43 . 2004-08-04 00:56	8,192	--a--c---	c:\windows\system32\dllcache\wshirda.dll
2009-04-08 08:41 . 2001-08-17 13:28	794,654	--a--c---	c:\windows\system32\dllcache\usr1801.sys
2009-04-08 08:40 . 2001-08-17 22:36	216,064	--a--c---	c:\windows\system32\dllcache\um34scan.dll
2009-04-08 08:39 . 2001-08-17 22:36	525,568	--a--c---	c:\windows\system32\dllcache\tridxp.dll
2009-04-08 08:39 . 2001-08-17 14:56	440,576	--a--c---	c:\windows\system32\dllcache\tridkb.dll
2009-04-08 08:39 . 2001-08-17 14:56	315,520	--a--c---	c:\windows\system32\dllcache\trid3d.dll
2009-04-08 08:39 . 2001-08-17 14:02	230,912	--a--c---	c:\windows\system32\dllcache\tosdvd03.sys
2009-04-08 08:39 . 2001-08-17 12:51	222,336	--a--c---	c:\windows\system32\dllcache\trid3dm.sys
2009-04-08 08:39 . 2001-08-17 12:51	166,784	--a--c---	c:\windows\system32\dllcache\tridxpm.sys
2009-04-08 08:39 . 2001-08-17 12:51	159,232	--a--c---	c:\windows\system32\dllcache\tridkbm.sys
2009-04-08 08:39 . 2004-08-04 00:56	82,432	--a--c---	c:\windows\system32\dllcache\tp4mon.exe
2009-04-08 08:39 . 2001-08-17 22:35	42,496	--a--c---	c:\windows\system32\dllcache\tp4res.dll
2009-04-08 08:39 . 2001-08-17 12:12	34,375	--a--c---	c:\windows\system32\dllcache\tpro4.sys
2009-04-08 08:39 . 2001-08-17 22:36	31,744	--a--c---	c:\windows\system32\dllcache\tp4.dll
2009-04-08 08:39 . 2001-08-17 13:48	11,520	--a--c---	c:\windows\system32\dllcache\twotrack.sys
2009-04-08 08:39 . 2001-08-17 13:51	4,992	--a--c---	c:\windows\system32\dllcache\toside.sys
2009-04-08 08:37 . 2001-08-17 12:18	285,760	--a--c---	c:\windows\system32\dllcache\stlnata.sys
2009-04-08 08:36 . 2004-08-04 08:00	143,422	--a--c---	c:\windows\system32\dllcache\softkey.dll
2009-04-08 08:36 . 2001-08-17 22:36	114,688	--a--c---	c:\windows\system32\dllcache\sonypi.dll
2009-04-08 08:36 . 2001-08-17 22:36	106,584	--a--c---	c:\windows\system32\dllcache\spdports.dll
2009-04-08 08:36 . 2001-08-17 22:36	99,328	--a--c---	c:\windows\system32\dllcache\srusd.dll
2009-04-08 08:36 . 2001-08-17 13:51	61,824	--a--c---	c:\windows\system32\dllcache\speed.sys
2009-04-08 08:36 . 2001-08-17 12:11	48,736	--a--c---	c:\windows\system32\dllcache\srwlnd5.sys
2009-04-08 08:36 . 2001-08-17 12:51	37,040	--a--c---	c:\windows\system32\dllcache\sonypi.sys
2009-04-08 08:36 . 2001-08-17 22:36	24,660	--a--c---	c:\windows\system32\dllcache\spxupchk.dll
2009-04-08 08:36 . 2001-08-17 12:51	20,752	--a--c---	c:\windows\system32\dllcache\sonync.sys
2009-04-08 08:36 . 2001-08-17 14:07	19,072	--a--c---	c:\windows\system32\dllcache\sparrow.sys
2009-04-08 08:36 . 2001-08-17 13:53	9,600	--a--c---	c:\windows\system32\dllcache\sonymc.sys
2009-04-08 08:36 . 2001-08-17 13:56	7,552	--a--c---	c:\windows\system32\dllcache\sonypvu1.sys
2009-04-08 08:36 . 2004-08-03 23:00	7,552	--a--c---	c:\windows\system32\dllcache\sonyait.sys
2009-04-08 08:34 . 2001-08-17 14:56	252,032	--a--c---	c:\windows\system32\dllcache\sis300iv.dll
2009-04-08 08:34 . 2001-08-17 22:36	238,592	--a--c---	c:\windows\system32\dllcache\sisgrv.dll
2009-04-08 08:34 . 2001-08-17 14:56	157,696	--a--c---	c:\windows\system32\dllcache\sisv256.dll
2009-04-08 08:34 . 2001-08-17 14:56	150,144	--a--c---	c:\windows\system32\dllcache\sis6306v.dll
2009-04-08 08:34 . 2001-08-17 12:50	104,064	--a--c---	c:\windows\system32\dllcache\sisgrp.sys
2009-04-08 08:34 . 2001-08-17 12:50	101,760	--a--c---	c:\windows\system32\dllcache\sis300ip.sys
2009-04-08 08:34 . 2001-08-17 12:12	94,698	--a--c---	c:\windows\system32\dllcache\sk98xwin.sys
2009-04-08 08:34 . 2001-08-17 12:12	91,294	--a--c---	c:\windows\system32\dllcache\skfpwin.sys
2009-04-08 08:34 . 2001-08-17 12:50	68,608	--a--c---	c:\windows\system32\dllcache\sis6306p.sys
2009-04-08 08:34 . 2004-08-03 22:31	63,547	--a--c---	c:\windows\system32\dllcache\sla30nd5.sys
2009-04-08 08:34 . 2001-08-17 12:50	50,432	--a--c---	c:\windows\system32\dllcache\sisv.sys
2009-04-08 08:34 . 2004-08-03 22:31	32,768	--a--c---	c:\windows\system32\dllcache\sisnic.sys
2009-04-08 08:34 . 2004-08-03 23:10	11,136	--a--c---	c:\windows\system32\dllcache\slip.sys
2009-04-08 08:32 . 2001-08-17 22:36	495,616	--a--c---	c:\windows\system32\dllcache\sblfx.dll
2009-04-08 08:31 . 2001-08-17 22:36	86,097	--a--c---	c:\windows\system32\dllcache\reslog32.dll
2009-04-08 08:31 . 2004-08-03 22:59	79,104	--a--c---	c:\windows\system32\dllcache\rocket.sys
2009-04-08 08:31 . 2001-08-17 12:12	37,563	--a--c---	c:\windows\system32\dllcache\rlnet5.sys
2009-04-08 08:31 . 2001-08-17 12:19	30,720	--a--c---	c:\windows\system32\dllcache\rthwcls.sys
2009-04-08 08:31 . 2001-08-17 22:36	26,624	--a--c---	c:\windows\system32\dllcache\rw450ext.dll
2009-04-08 08:31 . 2004-08-04 08:00	26,112	--a--c---	c:\windows\system32\dllcache\romanime.ime
2009-04-08 08:31 . 2001-08-17 22:36	24,576	--a--c---	c:\windows\system32\dllcache\rw430ext.dll
2009-04-08 08:31 . 2004-08-03 22:31	20,992	--a--c---	c:\windows\system32\dllcache\rtl8139.sys
2009-04-08 08:31 . 2001-08-17 13:51	19,584	--a--c---	c:\windows\system32\dllcache\rasirda.sys
2009-04-08 08:31 . 2001-08-17 12:12	19,017	--a--c---	c:\windows\system32\dllcache\rtl8029.sys
2009-04-08 08:31 . 2001-08-17 22:36	9,216	--a--c---	c:\windows\system32\dllcache\rsmgrstr.dll
2009-04-08 08:31 . 2001-08-17 12:19	3,840	--a--c---	c:\windows\system32\dllcache\rpfun.sys
2009-04-08 08:29 . 2004-08-04 08:00	482,304	--a--c---	c:\windows\system32\dllcache\pintlgnt.ime
2009-04-08 08:28 . 2001-08-17 14:05	351,616	--a--c---	c:\windows\system32\dllcache\ovcodek2.sys
2009-04-08 08:27 . 2001-08-17 12:50	198,144	--a--c---	c:\windows\system32\dllcache\nv3.sys
2009-04-08 08:27 . 2001-08-17 22:36	123,776	--a--c---	c:\windows\system32\dllcache\nv3.dll
2009-04-08 08:27 . 2001-08-17 22:36	116,736	--a--c---	c:\windows\system32\dllcache\ovcodec2.dll
2009-04-08 08:27 . 2004-08-03 23:10	61,056	--a--c---	c:\windows\system32\dllcache\ohci1394.sys
2009-04-08 08:27 . 2001-08-17 12:20	54,528	--a--c---	c:\windows\system32\dllcache\opl3sax.sys
2009-04-08 08:27 . 2001-08-17 13:28	54,186	--a--c---	c:\windows\system32\dllcache\otcsercb.sys
2009-04-08 08:27 . 2001-08-17 12:49	51,552	--a--c---	c:\windows\system32\dllcache\ntgrip.sys
2009-04-08 08:27 . 2001-08-17 14:05	48,000	--a--c---	c:\windows\system32\dllcache\ovcam2.sys
2009-04-08 08:27 . 2001-08-17 12:12	43,689	--a--c---	c:\windows\system32\dllcache\otceth5.sys
2009-04-08 08:27 . 2001-08-17 14:05	31,872	--a--c---	c:\windows\system32\dllcache\ovce.sys
2009-04-08 08:27 . 2001-08-17 14:05	28,032	--a--c---	c:\windows\system32\dllcache\ovcd.sys
2009-04-08 08:27 . 2001-08-17 12:12	27,209	--a--c---	c:\windows\system32\dllcache\otc06x5.sys
2009-04-08 08:27 . 2001-08-17 14:05	25,088	--a--c---	c:\windows\system32\dllcache\ovca.sys
2009-04-08 08:25 . 2004-08-04 08:00	229,439	--a--c---	c:\windows\system32\dllcache\multibox.dll
2009-04-08 08:24 . 2004-08-04 08:00	1,875,968	--a--c---	c:\windows\system32\dllcache\msir3jp.lex
2009-04-08 08:24 . 2004-08-04 08:00	98,304	--a--c---	c:\windows\system32\dllcache\msir3jp.dll
2009-04-08 08:24 . 2004-08-04 00:56	56,832	--a--c---	c:\windows\system32\dllcache\msdvbnp.ax
2009-04-08 08:24 . 2004-08-03 23:10	51,328	--a--c---	c:\windows\system32\dllcache\msdv.sys
2009-04-08 08:24 . 2001-08-17 14:02	35,200	--a--c---	c:\windows\system32\dllcache\msgame.sys
2009-04-08 08:24 . 2004-08-03 23:00	22,016	--a--c---	c:\windows\system32\dllcache\msircomm.sys
2009-04-08 08:24 . 2001-08-17 13:52	17,280	--a--c---	c:\windows\system32\dllcache\mraid35x.sys
2009-04-08 08:24 . 2004-08-03 23:10	15,360	--a--c---	c:\windows\system32\dllcache\mpe.sys
2009-04-08 08:24 . 2001-08-17 13:48	12,416	--a--c---	c:\windows\system32\dllcache\msriffwv.sys
2009-04-08 08:24 . 2001-08-17 13:48	6,016	--a--c---	c:\windows\system32\dllcache\msfsio.sys
2009-04-08 08:24 . 2001-08-17 14:00	2,944	--a--c---	c:\windows\system32\dllcache\msmpu401.sys
2009-04-08 08:23 . 2001-08-17 12:50	320,384	--a--c---	c:\windows\system32\dllcache\mgaum.sys
2009-04-08 08:23 . 2001-08-17 14:56	235,648	--a--c---	c:\windows\system32\dllcache\mgaud.dll
2009-04-08 08:23 . 2001-08-17 12:12	164,586	--a--c---	c:\windows\system32\dllcache\mdgndis5.sys
2009-04-08 08:23 . 2001-08-17 22:36	58,880	--a--c---	c:\windows\system32\dllcache\m3092dc.dll
2009-04-08 08:23 . 2001-08-17 12:19	48,768	--a--c---	c:\windows\system32\dllcache\maestro.sys
2009-04-08 08:23 . 2001-08-17 22:36	47,616	--a--c---	c:\windows\system32\dllcache\memgrp.dll
2009-04-08 08:23 . 2004-08-03 23:00	26,112	--a--c---	c:\windows\system32\dllcache\memstpci.sys
2009-04-08 08:23 . 2001-08-17 13:57	16,128	--a--c---	c:\windows\system32\dllcache\modemcsa.sys
2009-04-08 08:23 . 2001-08-17 13:48	12,160	--a--c---	c:\windows\system32\dllcache\mouhid.sys
2009-04-08 08:23 . 2001-08-17 13:58	8,320	--a--c---	c:\windows\system32\dllcache\memcard.sys
2009-04-08 08:23 . 2001-08-17 13:52	7,424	--a--c---	c:\windows\system32\dllcache\mammoth.sys
2009-04-08 08:23 . 2001-08-17 13:52	6,528	--a--c---	c:\windows\system32\dllcache\miniqic.sys
2009-04-08 08:21 . 2004-08-04 08:00	1,158,818	--a--c---	c:\windows\system32\dllcache\korwbrkr.lex
2009-04-08 08:21 . 2001-08-17 22:36	242,176	--a--c---	c:\windows\system32\dllcache\kdsusd.dll
2009-04-08 08:21 . 2004-08-04 08:00	70,656	--a--c---	c:\windows\system32\dllcache\korwbrkr.dll
2009-04-08 08:21 . 2001-08-17 22:36	45,568	--a--c---	c:\windows\system32\dllcache\kdsui.dll
2009-04-08 08:21 . 2001-08-17 22:36	37,376	--a--c---	c:\windows\system32\dllcache\kousd.dll
2009-04-08 08:21 . 2004-08-03 22:58	14,848	--a--c---	c:\windows\system32\dllcache\kbdhid.sys
2009-04-08 08:21 . 2001-08-17 22:36	8,704	--a--c---	c:\windows\system32\dllcache\kbdjpn.dll
2009-04-08 08:21 . 2001-08-17 22:36	8,192	--a--c---	c:\windows\system32\dllcache\kbdkor.dll
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-09 12:01	23,424	----a-w	c:\windows\system32\drivers\bkfuwrms.sys
2009-04-06 15:30	---------	d-----w	c:\documents and settings\Virginia\Application Data\MSNInstaller
2009-04-06 14:51	---------	d-----w	c:\documents and settings\Virginia\Application Data\Apple Computer
2009-04-06 14:31	---------	d-----w	c:\program files\Common Files\Adobe
2009-03-24 18:35	---------	d-----w	c:\program files\Common Files\Apple
2009-02-23 19:48	---------	d-----w	c:\program files\Angle Interactive
2006-12-11 17:53	85,954	----a-w	c:\program files\10187EZ.pdf
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{386eee7a-3dd8-4b2c-8a5d-2e32e9da0c9b}]
c:\windows\system32\batmete.dll [BU]
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-16 67128]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-02-24 5537792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-02-24 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 5367664]
"SoundMan"="SOUNDMAN.EXE" [2005-03-11 c:\windows\SOUNDMAN.EXE]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-16 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-01-24 450560]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-12-06 204800]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 20:35 87352 c:\windows\system32\LMIinit.dll
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"=
"c:\\Program Files\\Logitech\\SetPoint\\SetPoint.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
 
R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-04-06 47640]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-06 108289]
S2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2008-07-24 12856]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-31 33176]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder
 
2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-09 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- C:\ [2009-04-09 08:23]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.acornweb.org/
uInternet Settings,ProxyServer = www.stephen.org/wedding
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
Trusted Zone: microsoft.com\UPDATE
Trusted Zone: windowsupdate.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Virginia\Application Data\Mozilla\Firefox\Profiles\gxab0rik.default\
FF - prefs.js: network.proxy.ftp - www.stephen.org/wedding
FF - prefs.js: network.proxy.gopher - www.stephen.org/wedding
FF - prefs.js: network.proxy.http - www.stephen.org/wedding
FF - prefs.js: network.proxy.socks - www.stephen.org/wedding
FF - prefs.js: network.proxy.ssl - www.stephen.org/wedding
FF - prefs.js: network.proxy.type - 1
.
 
**************************************************************************
 
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-09 08:23:55
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(652)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\WRLogonNTF.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\Common Files\Logitech\KHAL\KHALMNPR.EXE
.
**************************************************************************
.
Completion time: 2009-04-09  8:26:58 - machine was rebooted
ComboFix-quarantined-files.txt  2009-04-09 12:26:55
ComboFix2.txt  2009-04-09 12:10:16
ComboFix3.txt  2009-04-09 02:38:27
 
Pre-Run: 148,333,445,120 bytes free
Post-Run: 148,314,132,480 bytes free
 
269	--- E O F ---	2009-01-19 02:30:50

Open in new window

0
 
LVL 47

Assisted Solution

by:rpggamergirl
rpggamergirl earned 2000 total points
ID: 24107047
You can open the registry right? but it won't save the changes?

Go to this key and change the permission so you can change it.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services


You also would need to change the 'path to executable in these subkeys below:
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\BITS]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wuauserv]
 

2 more bad files that need to go,
Run combofix again using this script.

1. Open Notepad.
2. Now copy/paste the text between the lines below into the Notepad window:
------------------------------------------------------------------------
File::
c:\windows\system32\drivers\bkfuwrms.sys
c:\windows\system32\batmete.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{386eee7a-3dd8-4b2c-8a5d-2e32e9da0c9b}]
------------------------------------------------------------------------
3. Save the above as CFScript.txt on your desktop.
4. Then drag the CFScript.txt into ComboFix.exe. This will start ComboFix again.
 
0
 

Author Comment

by:Ronald Hicks
ID: 24113233
I'm home from my day job and did what you suggested, and it seems to have done the trick.  I was able to install SP3 from updates.microsoft.com.  This is by far the most impressive help I've ever received, at this or any other helpsite.  I'm truly awestruck that you knew what to do so immediately and so completely.  Thank you is so inadequate to express my appreciation.  I'd award 5000 points if that were possible.

Ron Hicks

Oh, I'm attaching the log fille in case it indicates something else that need doing.
ComboFix 09-04-04.01 - Virginia 2009-04-09 22:25:12.4 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.447.198 [GMT -4:00]
Running from: c:\documents and settings\Virginia\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Virginia\Desktop\CFScript.txt
AV: Norton AntiVirus 2005 *On-access scanning enabled* (Updated)
AV: Spy Sweeper with AntiVirus *On-access scanning disabled* (Updated)
FW: Norton Internet Worm Protection *enabled*
 * Created a new restore point
 
FILE ::
c:\windows\system32\batmete.dll
c:\windows\system32\drivers\bkfuwrms.sys
.
 
(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.
 
c:\windows\system32\drivers\bkfuwrms.sys
 
.
(((((((((((((((((((((((((   Files Created from 2009-03-10 to 2009-04-10  )))))))))))))))))))))))))))))))
.
 
2009-04-09 22:23 . 2006-03-03 00:42	73,728	--a------	C:\pv.exe
2009-04-09 07:35 . 2009-04-09 07:35	<DIR>	d--------	c:\documents and settings\NetworkService\Application Data\Webroot
2009-04-08 22:01 . 2009-04-08 22:01	<DIR>	d--------	C:\EmergencyUtils
2009-04-08 08:44 . 2004-08-04 00:56	116,224	--a--c---	c:\windows\system32\dllcache\xrxwiadr.dll
2009-04-08 08:44 . 2001-08-17 22:37	99,865	--a--c---	c:\windows\system32\dllcache\xlog.exe
2009-04-08 08:44 . 2001-08-17 22:37	27,648	--a--c---	c:\windows\system32\dllcache\xrxftplt.exe
2009-04-08 08:44 . 2001-08-17 22:36	23,040	--a--c---	c:\windows\system32\dllcache\xrxwbtmp.dll
2009-04-08 08:44 . 2004-08-03 22:29	19,455	--a--c---	c:\windows\system32\dllcache\wvchntxx.sys
2009-04-08 08:44 . 2004-08-03 23:10	19,328	--a--c---	c:\windows\system32\dllcache\wstcodec.sys
2009-04-08 08:44 . 2001-08-17 22:36	17,408	--a--c---	c:\windows\system32\dllcache\xrxscnui.dll
2009-04-08 08:44 . 2001-08-17 12:11	16,970	--a--c---	c:\windows\system32\dllcache\xem336n5.sys
2009-04-08 08:44 . 2001-08-17 22:37	4,608	--a--c---	c:\windows\system32\dllcache\xrxflnch.exe
2009-04-08 08:43 . 2001-08-17 13:28	771,581	--a--c---	c:\windows\system32\dllcache\winacisa.sys
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winzm.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winsp.ime
2009-04-08 08:43 . 2004-08-04 08:00	156,672	--a--c---	c:\windows\system32\dllcache\winpy.ime
2009-04-08 08:43 . 2004-08-03 22:31	154,624	--a--c---	c:\windows\system32\dllcache\wlluc48.sys
2009-04-08 08:43 . 2004-08-04 08:00	79,360	--a--c---	c:\windows\system32\dllcache\winar30.ime
2009-04-08 08:43 . 2004-08-04 08:00	69,120	--a--c---	c:\windows\system32\dllcache\wingb.ime
2009-04-08 08:43 . 2004-08-04 08:00	65,536	--a--c---	c:\windows\system32\dllcache\winime.ime
2009-04-08 08:43 . 2001-08-17 12:12	34,890	--a--c---	c:\windows\system32\dllcache\wlandrv2.sys
2009-04-08 08:43 . 2004-08-03 22:29	12,063	--a--c---	c:\windows\system32\dllcache\wsiintxx.sys
2009-04-08 08:43 . 2004-08-03 23:07	8,832	--a--c---	c:\windows\system32\dllcache\wmiacpi.sys
2009-04-08 08:43 . 2004-08-04 00:56	8,192	--a--c---	c:\windows\system32\dllcache\wshirda.dll
2009-04-08 08:41 . 2001-08-17 13:28	794,654	--a--c---	c:\windows\system32\dllcache\usr1801.sys
2009-04-08 08:40 . 2001-08-17 22:36	216,064	--a--c---	c:\windows\system32\dllcache\um34scan.dll
2009-04-08 08:39 . 2001-08-17 22:36	525,568	--a--c---	c:\windows\system32\dllcache\tridxp.dll
2009-04-08 08:39 . 2001-08-17 14:56	440,576	--a--c---	c:\windows\system32\dllcache\tridkb.dll
2009-04-08 08:39 . 2001-08-17 14:56	315,520	--a--c---	c:\windows\system32\dllcache\trid3d.dll
2009-04-08 08:39 . 2001-08-17 14:02	230,912	--a--c---	c:\windows\system32\dllcache\tosdvd03.sys
2009-04-08 08:39 . 2001-08-17 12:51	222,336	--a--c---	c:\windows\system32\dllcache\trid3dm.sys
2009-04-08 08:39 . 2001-08-17 12:51	166,784	--a--c---	c:\windows\system32\dllcache\tridxpm.sys
2009-04-08 08:39 . 2001-08-17 12:51	159,232	--a--c---	c:\windows\system32\dllcache\tridkbm.sys
2009-04-08 08:39 . 2004-08-04 00:56	82,432	--a--c---	c:\windows\system32\dllcache\tp4mon.exe
2009-04-08 08:39 . 2001-08-17 22:35	42,496	--a--c---	c:\windows\system32\dllcache\tp4res.dll
2009-04-08 08:39 . 2001-08-17 12:12	34,375	--a--c---	c:\windows\system32\dllcache\tpro4.sys
2009-04-08 08:39 . 2001-08-17 22:36	31,744	--a--c---	c:\windows\system32\dllcache\tp4.dll
2009-04-08 08:39 . 2001-08-17 13:48	11,520	--a--c---	c:\windows\system32\dllcache\twotrack.sys
2009-04-08 08:39 . 2001-08-17 13:51	4,992	--a--c---	c:\windows\system32\dllcache\toside.sys
2009-04-08 08:37 . 2001-08-17 12:18	285,760	--a--c---	c:\windows\system32\dllcache\stlnata.sys
2009-04-08 08:36 . 2004-08-04 08:00	143,422	--a--c---	c:\windows\system32\dllcache\softkey.dll
2009-04-08 08:36 . 2001-08-17 22:36	114,688	--a--c---	c:\windows\system32\dllcache\sonypi.dll
2009-04-08 08:36 . 2001-08-17 22:36	106,584	--a--c---	c:\windows\system32\dllcache\spdports.dll
2009-04-08 08:36 . 2001-08-17 22:36	99,328	--a--c---	c:\windows\system32\dllcache\srusd.dll
2009-04-08 08:36 . 2001-08-17 13:51	61,824	--a--c---	c:\windows\system32\dllcache\speed.sys
2009-04-08 08:36 . 2001-08-17 12:11	48,736	--a--c---	c:\windows\system32\dllcache\srwlnd5.sys
2009-04-08 08:36 . 2001-08-17 12:51	37,040	--a--c---	c:\windows\system32\dllcache\sonypi.sys
2009-04-08 08:36 . 2001-08-17 22:36	24,660	--a--c---	c:\windows\system32\dllcache\spxupchk.dll
2009-04-08 08:36 . 2001-08-17 12:51	20,752	--a--c---	c:\windows\system32\dllcache\sonync.sys
2009-04-08 08:36 . 2001-08-17 14:07	19,072	--a--c---	c:\windows\system32\dllcache\sparrow.sys
2009-04-08 08:36 . 2001-08-17 13:53	9,600	--a--c---	c:\windows\system32\dllcache\sonymc.sys
2009-04-08 08:36 . 2001-08-17 13:56	7,552	--a--c---	c:\windows\system32\dllcache\sonypvu1.sys
2009-04-08 08:36 . 2004-08-03 23:00	7,552	--a--c---	c:\windows\system32\dllcache\sonyait.sys
2009-04-08 08:34 . 2001-08-17 14:56	252,032	--a--c---	c:\windows\system32\dllcache\sis300iv.dll
2009-04-08 08:34 . 2001-08-17 22:36	238,592	--a--c---	c:\windows\system32\dllcache\sisgrv.dll
2009-04-08 08:34 . 2001-08-17 14:56	157,696	--a--c---	c:\windows\system32\dllcache\sisv256.dll
2009-04-08 08:34 . 2001-08-17 14:56	150,144	--a--c---	c:\windows\system32\dllcache\sis6306v.dll
2009-04-08 08:34 . 2001-08-17 12:50	104,064	--a--c---	c:\windows\system32\dllcache\sisgrp.sys
2009-04-08 08:34 . 2001-08-17 12:50	101,760	--a--c---	c:\windows\system32\dllcache\sis300ip.sys
2009-04-08 08:34 . 2001-08-17 12:12	94,698	--a--c---	c:\windows\system32\dllcache\sk98xwin.sys
2009-04-08 08:34 . 2001-08-17 12:12	91,294	--a--c---	c:\windows\system32\dllcache\skfpwin.sys
2009-04-08 08:34 . 2001-08-17 12:50	68,608	--a--c---	c:\windows\system32\dllcache\sis6306p.sys
2009-04-08 08:34 . 2004-08-03 22:31	63,547	--a--c---	c:\windows\system32\dllcache\sla30nd5.sys
2009-04-08 08:34 . 2001-08-17 12:50	50,432	--a--c---	c:\windows\system32\dllcache\sisv.sys
2009-04-08 08:34 . 2004-08-03 22:31	32,768	--a--c---	c:\windows\system32\dllcache\sisnic.sys
2009-04-08 08:34 . 2004-08-03 23:10	11,136	--a--c---	c:\windows\system32\dllcache\slip.sys
2009-04-08 08:32 . 2001-08-17 22:36	495,616	--a--c---	c:\windows\system32\dllcache\sblfx.dll
2009-04-08 08:31 . 2001-08-17 22:36	86,097	--a--c---	c:\windows\system32\dllcache\reslog32.dll
2009-04-08 08:31 . 2004-08-03 22:59	79,104	--a--c---	c:\windows\system32\dllcache\rocket.sys
2009-04-08 08:31 . 2001-08-17 12:12	37,563	--a--c---	c:\windows\system32\dllcache\rlnet5.sys
2009-04-08 08:31 . 2001-08-17 12:19	30,720	--a--c---	c:\windows\system32\dllcache\rthwcls.sys
2009-04-08 08:31 . 2001-08-17 22:36	26,624	--a--c---	c:\windows\system32\dllcache\rw450ext.dll
2009-04-08 08:31 . 2004-08-04 08:00	26,112	--a--c---	c:\windows\system32\dllcache\romanime.ime
2009-04-08 08:31 . 2001-08-17 22:36	24,576	--a--c---	c:\windows\system32\dllcache\rw430ext.dll
2009-04-08 08:31 . 2004-08-03 22:31	20,992	--a--c---	c:\windows\system32\dllcache\rtl8139.sys
2009-04-08 08:31 . 2001-08-17 13:51	19,584	--a--c---	c:\windows\system32\dllcache\rasirda.sys
2009-04-08 08:31 . 2001-08-17 12:12	19,017	--a--c---	c:\windows\system32\dllcache\rtl8029.sys
2009-04-08 08:31 . 2001-08-17 22:36	9,216	--a--c---	c:\windows\system32\dllcache\rsmgrstr.dll
2009-04-08 08:31 . 2001-08-17 12:19	3,840	--a--c---	c:\windows\system32\dllcache\rpfun.sys
2009-04-08 08:29 . 2004-08-04 08:00	482,304	--a--c---	c:\windows\system32\dllcache\pintlgnt.ime
2009-04-08 08:28 . 2001-08-17 14:05	351,616	--a--c---	c:\windows\system32\dllcache\ovcodek2.sys
2009-04-08 08:27 . 2001-08-17 12:50	198,144	--a--c---	c:\windows\system32\dllcache\nv3.sys
2009-04-08 08:27 . 2001-08-17 22:36	123,776	--a--c---	c:\windows\system32\dllcache\nv3.dll
2009-04-08 08:27 . 2001-08-17 22:36	116,736	--a--c---	c:\windows\system32\dllcache\ovcodec2.dll
2009-04-08 08:27 . 2004-08-03 23:10	61,056	--a--c---	c:\windows\system32\dllcache\ohci1394.sys
2009-04-08 08:27 . 2001-08-17 12:20	54,528	--a--c---	c:\windows\system32\dllcache\opl3sax.sys
2009-04-08 08:27 . 2001-08-17 13:28	54,186	--a--c---	c:\windows\system32\dllcache\otcsercb.sys
2009-04-08 08:27 . 2001-08-17 12:49	51,552	--a--c---	c:\windows\system32\dllcache\ntgrip.sys
2009-04-08 08:27 . 2001-08-17 14:05	48,000	--a--c---	c:\windows\system32\dllcache\ovcam2.sys
2009-04-08 08:27 . 2001-08-17 12:12	43,689	--a--c---	c:\windows\system32\dllcache\otceth5.sys
2009-04-08 08:27 . 2001-08-17 14:05	31,872	--a--c---	c:\windows\system32\dllcache\ovce.sys
2009-04-08 08:27 . 2001-08-17 14:05	28,032	--a--c---	c:\windows\system32\dllcache\ovcd.sys
2009-04-08 08:27 . 2001-08-17 12:12	27,209	--a--c---	c:\windows\system32\dllcache\otc06x5.sys
2009-04-08 08:27 . 2001-08-17 14:05	25,088	--a--c---	c:\windows\system32\dllcache\ovca.sys
2009-04-08 08:25 . 2004-08-04 08:00	229,439	--a--c---	c:\windows\system32\dllcache\multibox.dll
2009-04-08 08:24 . 2004-08-04 08:00	1,875,968	--a--c---	c:\windows\system32\dllcache\msir3jp.lex
2009-04-08 08:24 . 2004-08-04 08:00	98,304	--a--c---	c:\windows\system32\dllcache\msir3jp.dll
2009-04-08 08:24 . 2004-08-04 00:56	56,832	--a--c---	c:\windows\system32\dllcache\msdvbnp.ax
2009-04-08 08:24 . 2004-08-03 23:10	51,328	--a--c---	c:\windows\system32\dllcache\msdv.sys
2009-04-08 08:24 . 2001-08-17 14:02	35,200	--a--c---	c:\windows\system32\dllcache\msgame.sys
2009-04-08 08:24 . 2004-08-03 23:00	22,016	--a--c---	c:\windows\system32\dllcache\msircomm.sys
2009-04-08 08:24 . 2001-08-17 13:52	17,280	--a--c---	c:\windows\system32\dllcache\mraid35x.sys
2009-04-08 08:24 . 2004-08-03 23:10	15,360	--a--c---	c:\windows\system32\dllcache\mpe.sys
2009-04-08 08:24 . 2001-08-17 13:48	12,416	--a--c---	c:\windows\system32\dllcache\msriffwv.sys
2009-04-08 08:24 . 2001-08-17 13:48	6,016	--a--c---	c:\windows\system32\dllcache\msfsio.sys
2009-04-08 08:24 . 2001-08-17 14:00	2,944	--a--c---	c:\windows\system32\dllcache\msmpu401.sys
2009-04-08 08:23 . 2001-08-17 12:50	320,384	--a--c---	c:\windows\system32\dllcache\mgaum.sys
2009-04-08 08:23 . 2001-08-17 14:56	235,648	--a--c---	c:\windows\system32\dllcache\mgaud.dll
2009-04-08 08:23 . 2001-08-17 12:12	164,586	--a--c---	c:\windows\system32\dllcache\mdgndis5.sys
2009-04-08 08:23 . 2001-08-17 22:36	58,880	--a--c---	c:\windows\system32\dllcache\m3092dc.dll
2009-04-08 08:23 . 2001-08-17 12:19	48,768	--a--c---	c:\windows\system32\dllcache\maestro.sys
2009-04-08 08:23 . 2001-08-17 22:36	47,616	--a--c---	c:\windows\system32\dllcache\memgrp.dll
2009-04-08 08:23 . 2004-08-03 23:00	26,112	--a--c---	c:\windows\system32\dllcache\memstpci.sys
2009-04-08 08:23 . 2001-08-17 13:57	16,128	--a--c---	c:\windows\system32\dllcache\modemcsa.sys
2009-04-08 08:23 . 2001-08-17 13:48	12,160	--a--c---	c:\windows\system32\dllcache\mouhid.sys
2009-04-08 08:23 . 2001-08-17 13:58	8,320	--a--c---	c:\windows\system32\dllcache\memcard.sys
2009-04-08 08:23 . 2001-08-17 13:52	7,424	--a--c---	c:\windows\system32\dllcache\mammoth.sys
2009-04-08 08:23 . 2001-08-17 13:52	6,528	--a--c---	c:\windows\system32\dllcache\miniqic.sys
2009-04-08 08:21 . 2004-08-04 08:00	1,158,818	--a--c---	c:\windows\system32\dllcache\korwbrkr.lex
2009-04-08 08:21 . 2001-08-17 22:36	242,176	--a--c---	c:\windows\system32\dllcache\kdsusd.dll
2009-04-08 08:21 . 2004-08-04 08:00	70,656	--a--c---	c:\windows\system32\dllcache\korwbrkr.dll
2009-04-08 08:21 . 2001-08-17 22:36	45,568	--a--c---	c:\windows\system32\dllcache\kdsui.dll
2009-04-08 08:21 . 2001-08-17 22:36	37,376	--a--c---	c:\windows\system32\dllcache\kousd.dll
2009-04-08 08:21 . 2004-08-03 22:58	14,848	--a--c---	c:\windows\system32\dllcache\kbdhid.sys
2009-04-08 08:21 . 2001-08-17 22:36	8,704	--a--c---	c:\windows\system32\dllcache\kbdjpn.dll
 
.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-06 15:30	---------	d-----w	c:\documents and settings\Virginia\Application Data\MSNInstaller
2009-04-06 14:51	---------	d-----w	c:\documents and settings\Virginia\Application Data\Apple Computer
2009-04-06 14:31	---------	d-----w	c:\program files\Common Files\Adobe
2009-03-24 18:35	---------	d-----w	c:\program files\Common Files\Apple
2009-02-23 19:48	---------	d-----w	c:\program files\Angle Interactive
2006-12-11 17:53	85,954	----a-w	c:\program files\10187EZ.pdf
.
 
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"LDM"="c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-02-16 67128]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-03-23 1830128]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-02-24 5537792]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-02-24 86016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2008-07-24 63048]
"SpySweeper"="c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 5367664]
"SoundMan"="SOUNDMAN.EXE" [2005-03-11 c:\windows\SOUNDMAN.EXE]
 
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-02-16 67128]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2007-01-24 450560]
Verizon Online Support Center.lnk - c:\program files\Verizon Online\bin\matcli.exe [2005-12-06 204800]
 
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll
 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2008-10-16 20:35 87352 c:\windows\system32\LMIinit.dll
 
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Webroot\\Spy Sweeper\\SpySweeperUI.exe"=
"c:\\Program Files\\Logitech\\SetPoint\\SetPoint.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
 
R1 sasdifsv;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-03-23 9968]
R1 saskutil;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-03-23 72944]
R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\rainfo.sys [2008-07-24 12856]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2009-04-06 47640]
R3 sasenum;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-06 108289]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\NOS\bin\getPlus_HelperSvc.exe [2009-03-31 33176]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpndrv.sys --> c:\windows\system32\DRIVERS\urvpndrv.sys [?]
S4 LMIRfsClientNP;LMIRfsClientNP; [x]
.
Contents of the 'Scheduled Tasks' folder
 
2009-04-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
 
2009-04-10 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-10 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 21:56]
 
2009-04-10 c:\windows\Tasks\wrSpySweeper_LB99127F7A65743E182A02FDE79D003FF.job
- C:\ [2009-04-09 22:26]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.acornweb.org/
uInternet Settings,ProxyServer = www.stephen.org/wedding
uInternet Settings,ProxyOverride = 127.0.0.1;*.local
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
Trusted Zone: microsoft.com\UPDATE
Trusted Zone: windowsupdate.com
Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Virginia\Application Data\Mozilla\Firefox\Profiles\gxab0rik.default\
FF - prefs.js: network.proxy.ftp - www.stephen.org/wedding
FF - prefs.js: network.proxy.gopher - www.stephen.org/wedding
FF - prefs.js: network.proxy.http - www.stephen.org/wedding
FF - prefs.js: network.proxy.socks - www.stephen.org/wedding
FF - prefs.js: network.proxy.ssl - www.stephen.org/wedding
FF - prefs.js: network.proxy.type - 1
.
 
**************************************************************************
 
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-09 22:26:44
Windows 5.1.2600 Service Pack 2 NTFS
 
scanning hidden processes ...  
 
scanning hidden autostart entries ... 
 
scanning hidden files ...  
 
scan completed successfully
hidden files: 0
 
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
 
- - - - - - - > 'winlogon.exe'(648)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\LMIinit.dll
c:\windows\system32\WRLogonNTF.dll
.
Completion time: 2009-04-09 22:28:04
ComboFix-quarantined-files.txt  2009-04-10 02:27:55
ComboFix2.txt  2009-04-09 12:26:59
ComboFix3.txt  2009-04-09 12:10:16
ComboFix4.txt  2009-04-09 02:38:27
 
Pre-Run: 148,292,538,368 bytes free
Post-Run: 148,279,324,672 bytes free
 
254	--- E O F ---	2009-01-19 02:30:50

Open in new window

0
 
LVL 47

Expert Comment

by:rpggamergirl
ID: 24113433
Ron Hicks,

You're welcome... glad to know it's now resolved.
Thanks for the CF log it's fine.
Combofix still detects Norton, you may need to run Norton's removal tool to remove all related files that are still there.
http://service1.symantec.com/Support/tsgeninfo.nsf/docid/2005033108162039 

To uninstall Combofix:
Go to Start > Run and 'copy and paste' next command in the field:

ComboFix /u

The above command will remove Combofix and its files, delete the created backup and reset System Restore.

Thank you so much for the excellent feedback!... it's nice of you. I really appreciate it :)
Your compliments/feedback is worth more than a million points!

Thank you for using Experts-Exchange!
0

Featured Post

Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article investigates the question of whether a computer can really be cleaned once it has been infected, and what the best ways of cleaning a computer might be (in this author's opinion).
Curious about the latest ransomware attack? Check out our timeline of events surrounding the spread of this new virus along with tips on how to mitigate the damage.
Established in 1997, Technology Architects has become one of the most reputable technology solutions companies in the country. TA have been providing businesses with cost effective state-of-the-art solutions and unparalleled service that is designed…
Email security requires an ever evolving service that stays up to date with counter-evolving threats. The Email Laundry perform Research and Development to ensure their email security service evolves faster than cyber criminals. We apply our Threat…

656 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question