avprox777 Posted November 6, 2008 Report Share Posted November 6, 2008 Hi, i just want to say thank you before-hand to everyone thats here for having a website to help people out. I honestly cant remember anything suspicious ive downloaded recently that would have added this malware. The first malware i noticed was one that kept making a clicking noise and would play sound clips randomly. I renamed it as a short fix and fell asleep, and now it has started back up and i have multiple processes that i dont recognize and im SURE are malware. here is my hijackthis log:Logfile of Trend Micro HijackThis v2.0.2Scan saved at 5:29:40 PM, on 11/5/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16441)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\VistaDrive\VistaDrive.exeC:\WINDOWS\ALCXMNTR.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Java\jre1.6.0_07\bin\jusched.exeC:\Program Files\Eset\nod32kui.exeC:\Program Files\Unlocker\UnlockerAssistant.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Xfire\xfiremusic.exeC:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exeC:\Program Files\Creative\Creative Media Lite\CTZDetec.exeC:\Program Files\Creative\Software Update 3\SoftAuto.exeC:\Program Files\Orbitdownloader\orbitdm.exeC:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exeC:\Program Files\Last.fm\LastFM.exeC:\Program Files\SpeedFan\speedfan.exeC:\Program Files\Orbitdownloader\orbitnet.exeC:\Program Files\Steam\steam.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\PnkBstrA.exeC:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\mabidwe.exeC:\WINDOWS\system32\soxpeca.exeC:\Program Files\Xfire\xfire.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dllO2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dllO3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dllO4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exeO4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"O4 - HKCU\..\Run: [softAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-21-1659004503-152049171-725345543-1004\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Robbie')O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')O4 - S-1-5-18 Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: Steam.lnk = ? (User 'SYSTEM')O4 - .DEFAULT Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'Default user')O4 - .DEFAULT Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'Default user')O4 - .DEFAULT Startup: Steam.lnk = ? (User 'Default user')O4 - Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exeO4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exeO4 - Startup: Steam.lnk = ?O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exeO8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: afisicx Service (afisicx) - Unknown owner - C:\WINDOWS\system32\afisicx.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exeO23 - Service: Windows File Manager Services (mscbcosd) - Unknown owner - C:\WINDOWS\system32\mscbco.exeO23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: noytcyr Service (noytcyr) - Unknown owner - C:\WINDOWS\system32\noytcyr.exeO23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exeO23 - Service: root - Unknown owner - C:\Program.exe (file missing)O23 - Service: roytctm Service (roytctm) - Unknown owner - C:\WINDOWS\system32\roytctm.exeO23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exeO23 - Service: tdydowkc Service (tdydowkc) - Unknown owner - C:\WINDOWS\system32\tdydowkc.exeO23 - Service: wsldoekd Service (wsldoekd) - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe--End of file - 11114 bytes Link to post Share on other sites
Rorschach112 Posted November 6, 2008 Report Share Posted November 6, 2008 HelloDownload ComboFix from one of these locations:Link 1Link 2Link 3* IMPORTANT !!! Save ComboFix.exe to your DesktopDisable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our toolsDouble click on ComboFix.exe & follow the prompts.As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:Click on Yes, to continue scanning for malware.When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Link to post Share on other sites
avprox777 Posted November 6, 2008 Author Report Share Posted November 6, 2008 ComboFix 08-11-05.02 - Owner 2008-11-06 10:10:12.1 - NTFSx86Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.740 [GMT -8:00]Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe * Created a new restore point.((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))).c:\windows\Install.txtc:\windows\system32\afisicx.exec:\windows\system32\Install.txtc:\windows\system32\Memman.vxdc:\windows\system32\noytcyr.exec:\windows\system32\roytctm.exec:\windows\system32\skinboxer43.dllc:\windows\system32\tdydowkc.exec:\windows\system32\tpszxyd.sysc:\windows\system32\wsldoekd.exe.((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))).-------\Legacy_AFISICX-------\Legacy_MABIDWE-------\Legacy_NOYTCYR-------\Legacy_ROYTCTM-------\Legacy_SOXPECA-------\Legacy_TDYDOWKC-------\Legacy_WSLDOEKD-------\Service_afisicx-------\Service_noytcyr-------\Service_roytctm-------\Service_tdydowkc-------\Service_wsldoekd((((((((((((((((((((((((( Files Created from 2008-10-06 to 2008-11-06 ))))))))))))))))))))))))))))))).2008-11-06 10:12 . 2008-11-06 10:12 <DIR> d-------- c:\windows\system32\xircom2008-11-06 10:12 . 2008-11-06 10:12 <DIR> d-------- c:\windows\system32\npp2008-11-06 10:12 . 2008-11-06 10:12 <DIR> d-------- c:\windows\srchasst2008-11-06 10:12 . 2008-11-06 10:12 <DIR> d-------- c:\program files\microsoft frontpage2008-11-06 00:27 . 2008-11-06 00:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware2008-11-06 00:27 . 2008-11-06 00:27 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes2008-11-06 00:27 . 2008-11-06 00:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes2008-11-06 00:27 . 2008-10-26 21:53 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys2008-11-06 00:27 . 2008-10-26 21:53 15,504 --a------ c:\windows\system32\drivers\mbam.sys2008-11-06 00:22 . 2008-11-06 00:22 <DIR> d-------- c:\program files\ERUNT2008-11-05 22:03 . 1998-01-14 22:06 304,128 --a------ c:\windows\IsUn0411.exe2008-11-05 17:28 . 2008-11-05 17:28 <DIR> d-------- c:\program files\Trend Micro2008-11-05 14:13 . 2008-11-05 14:13 <DIR> d-------- c:\documents and settings\Robbie\Application Data\Viewpoint2008-11-05 03:25 . 2008-11-05 03:25 <DIR> d-------- c:\documents and settings\Administrator2008-10-29 17:24 . 2008-10-29 17:24 42,320 --a------ c:\windows\system32\xfcodec.dll2008-10-27 15:45 . 2008-10-27 15:45 <DIR> d-------- c:\program files\Sarm Software2008-10-27 00:35 . 2008-10-27 00:35 <DIR> d-------- c:\documents and settings\Owner\Application Data\Xfire Plus2008-10-23 22:25 . 2008-10-23 22:25 0 --ah----- c:\windows\SwSys2.bmp2008-10-23 22:25 . 2008-10-23 22:25 0 --ah----- c:\windows\SwSys1.bmp2008-10-23 22:14 . 2008-10-23 22:14 <DIR> d-------- c:\program files\SystemRequirementsLab2008-10-23 22:14 . 2008-10-23 22:14 <DIR> d-------- c:\documents and settings\Owner\Application Data\SystemRequirementsLab2008-10-23 22:09 . 2008-10-23 22:32 <DIR> d-------- c:\program files\The Suffering2008-10-20 04:05 . 2008-10-20 04:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\YoYoGames2008-10-20 00:59 . 2008-10-20 00:59 <DIR> d-------- c:\documents and settings\Robbie\Application Data\Xfire Plus2008-10-16 14:56 . 2008-10-16 14:56 <DIR> d-------- c:\documents and settings\All Users\Application Data\Last.fm2008-10-16 14:55 . 2008-10-16 14:55 <DIR> d-------- c:\program files\Last.fm2008-10-10 13:43 . 2008-10-10 13:43 <DIR> d-------- c:\program files\7-Zip2008-10-10 13:35 . 2008-10-10 13:35 <DIR> d-------- c:\program files\Xfire Plus.(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))).2008-11-06 18:13 --------- d-----w c:\program files\Steam2008-11-06 18:13 --------- d-----w c:\program files\SpeedFan2008-11-06 18:13 --------- d-----w c:\documents and settings\Owner\Application Data\Orbit2008-11-06 18:04 --------- d-----w c:\documents and settings\Owner\Application Data\Xfire2008-11-06 08:39 --------- d-----w c:\documents and settings\Robbie\Application Data\Orbit2008-11-06 04:42 --------- d-----w c:\program files\mIRC2008-11-06 04:28 --------- d-s---w c:\program files\Xfire2008-11-05 11:30 --------- d-----w c:\program files\HP Optical 4 Button USB Mouse2008-10-31 02:52 --------- d-----w c:\program files\Orbitdownloader2008-10-27 23:45 --------- d--h--w c:\program files\InstallShield Installation Information2008-10-27 09:59 --------- d-----w c:\documents and settings\Owner\Application Data\Azureus2008-10-20 09:04 --------- d-----w c:\documents and settings\Robbie\Application Data\Xfire2008-10-17 11:22 --------- d-----w c:\program files\Cheat Engine2008-10-07 03:47 --------- d-----w c:\program files\LucasArts2008-10-05 19:26 --------- d-----w c:\program files\TuneUp Utilities 20072008-10-05 19:25 --------- d-----w c:\program files\Westwood2008-10-05 19:23 --------- d-----w c:\documents and settings\Owner\Application Data\InstallShield Installation Information2008-10-05 18:57 --------- d--h--r c:\documents and settings\Owner\Application Data\yahoo!2008-10-05 18:57 --------- d-----w c:\program files\Yahoo!2008-10-05 18:57 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!2008-10-01 18:57 --------- d-----w c:\program files\Common Files\Adobe2008-09-25 08:40 --------- d-----w c:\documents and settings\Owner\Application Data\U32008-09-23 05:47 --------- d-----w c:\documents and settings\Robbie\Application Data\U32008-09-22 15:53 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft2008-09-22 15:51 --------- d-----w c:\program files\Lavasoft2008-09-22 15:51 --------- d-----w c:\program files\Common Files\Wise Installation Wizard2008-09-21 14:01 --------- d-----w c:\program files\Spybot - Search & Destroy2008-09-17 01:13 --------- d-----w c:\program files\World of Warcraft2008-09-15 15:52 --------- d--h--r c:\documents and settings\Robbie\Application Data\yahoo!2008-09-14 03:14 --------- d-----w c:\documents and settings\Robbie\Application Data\Notepad++2007-03-09 07:12 27,648 --sha-w c:\windows\system32\AVSredirect.dll2008-04-03 21:37 80 --sh--r c:\windows\system32\B007C43AE0.dll2007-05-21 15:30 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012007052120070522\index.dat.((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))..*Note* empty entries & legit default entries are not shown REGEDIT4[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 139264]"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-11 15360]"CTZDetec.exe"="c:\program files\Creative\Creative Media Lite\CTZDetec.exe" [2008-04-24 368640]"SoftAuto.exe"="c:\program files\Creative\Software Update 3\SoftAuto.exe" [2008-05-27 401408][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]"VistaDrive"="c:\windows\VistaDrive\VistaDrive.exe" [2006-10-05 280779]"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-20 118784]"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 57344]"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]"nod32kui"="c:\program files\Eset\nod32kui.exe" [2007-06-05 949376]"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15872]"WinampAgent"="c:\program files\Winamp\winampa.exe" [2008-01-15 37376]"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-01-31 385024]"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]"Xfire Music"="c:\program files\Xfire\xfiremusic.exe" [2006-11-20 253650]"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]"AtiPTA"="atiptaxx.exe" [2006-02-21 c:\windows\system32\atiptaxx.exe][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696][HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]"nltide_3"="advpack.dll" [2007-03-07 c:\windows\system32\advpack.dll]c:\documents and settings\Owner\Start Menu\Programs\Startup\Last.fm.lnk - c:\program files\Last.fm\LastFM.exe [2008-10-16 1138688]SpeedFan.lnk - c:\program files\SpeedFan\speedfan.exe [2007-09-17 2902528]Steam.lnk - c:\windows\Installer\{048298C9-A4D3-490B-9FF9-AB023A9238F3}\Icon048298C91.exe [2007-05-21 27648]c:\documents and settings\All Users\Start Menu\Programs\Startup\Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2008-04-14 1707208][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]"ForceClassicControlPanel"= 1 (0x1)"NoSMConfigurePrograms"= 1 (0x1)[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]"ForceClassicControlPanel"= 1 (0x1)"NoSMConfigurePrograms"= 1 (0x1)[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]"msacm.l3acm"= l3codecp.acm"msacm.ac3filter"= ac3filter.acm"msacm.l3codec"= l3codecp.acm"VIDC.XFR1"= xfcodec.dll[HKLM\~\startupfolder\C:^Documents and Settings^Owner^Start Menu^Programs^Startup^Camio Viewer.lnk]path=c:\documents and settings\Owner\Start Menu\Programs\Startup\Camio Viewer.lnkbackup=c:\windows\pss\Camio Viewer.lnkStartup[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]--a------ 2007-04-27 13:17 50736 c:\program files\AIM6\aim6.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BtcMaestro]--------- 2007-10-22 22:48 344064 c:\program files\HP USB Multimedia Keyboard\Kmaestro.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]--a------ 2007-01-19 09:54 5674352 c:\program files\MSN Messenger\msnmsgr.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]--a------ 2008-04-17 15:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PSwitch]--a------ 2007-07-28 22:42 1129472 c:\program files\Proxy Switcher Standard\ProxySwitcher.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]--a------ 2008-01-31 23:13 385024 c:\program files\QuickTime\QTTask.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]--a------ 2008-10-08 18:52 1410296 c:\program files\Steam\steam.exe[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]--a------ 2006-09-07 09:19 15872 c:\program files\Unlocker\UnlockerAssistant.exe[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]"EnableFirewall"= 0 (0x0)[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\system32\\sessmgr.exe"="c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="c:\\Program Files\\MSN Messenger\\msnmsgr.exe"="c:\\Program Files\\MSN Messenger\\livecall.exe"="c:\\Program Files\\Xfire\\xfire.exe"="c:\\Program Files\\Azureus\\Azureus.exe"="c:\\Program Files\\FrostWire\\FrostWire.exe"="c:\\Program Files\\iTunes\\iTunes.exe"="c:\\Program Files\\Orbitdownloader\\orbitdm.exe"="c:\\Program Files\\Orbitdownloader\\orbitnet.exe"="c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=R1 atitray;atitray;c:\program files\Radeon Omega Drivers\v3.8.252\ATI Tray Tools\atitray.sys [2006-02-28 12032]R2 root;root;c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt --defaults-file=c:\program files\MySQL\MySQL Server 5.0\my.ini root [ ]R2 UxTuneUp;TuneUp Theme Extension;c:\windows\System32\svchost.exe [2004-08-11 14336]R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);c:\windows\system32\DRIVERS\RMSPPPOE.SYS [2002-10-02 31424]R3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;c:\windows\system32\DRIVERS\usb8023.sys [2004-08-11 12672]S3 gttap1;GoTrusted TAP Adapter;c:\windows\system32\DRIVERS\gttap1.sys [ ]S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\DRIVERS\SCR3XX2K.sys [2007-10-17 56448]HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcsUxTuneUp[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19060-796b-11dd-854e-000fdb1ba9ca}]\Shell\AutoRun\command - D:\LaunchU3.exe -a[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19061-796b-11dd-854e-000fdb1ba9ca}]\Shell\AutoRun\command - pdemvwpm.exe\Shell\explore\Command - pdemvwpm.exe\Shell\open\Command - pdemvwpm.exe[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{E0837E00-F502-AF00-E8CB-A02CC30C5E5B}]c:\windows\system32\svchost.exe.Contents of the 'Scheduled Tasks' folder2008-11-01 c:\windows\Tasks\1-Click Maintenance.job- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2007-04-26 18:51].- - - - ORPHANS REMOVED - - - -WebBrowser-{8FF5E180-ABDE-46EB-B09E-D2AAB95CABE3} - (no file)MSConfigStartUp-Yahoo! Pager - c:\program files\Yahoo!\Messenger\YahooMessenger.exe.------- Supplementary Scan -------.FireFox -: Profile - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/FF -: plugin - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\extensions\[email protected]\plugins\NPYYGInstantPlay.dllFF -: plugin - c:\program files\iTunes\Mozilla Plugins\npitunes.dllFF -: plugin - c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll.**************************************************************************catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-11-06 10:13:15Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ... scanning hidden autostart entries ...scanning hidden files ... scan completed successfullyhidden files: 0**************************************************************************[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\root]"ImagePath"="\"c:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt\" --defaults-file=\"c:\program files\MySQL\MySQL Server 5.0\my.ini\" root".------------------------ Other Running Processes ------------------------.c:\windows\system32\ati2evxx.exec:\program files\Lavasoft\Ad-Aware\aawservice.exec:\windows\system32\scardsvr.exec:\windows\system32\ati2evxx.exec:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exec:\windows\system32\CTSVCCDA.EXEc:\program files\Creative\Shared Files\CTDevSrv.exec:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exec:\program files\Orbitdownloader\orbitnet.exec:\program files\ESET\nod32krn.exec:\windows\system32\PnkBstrA.exec:\program files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exec:\program files\iPod\bin\iPodService.exec:\windows\system32\wscntfy.exec:\windows\system32\verclsid.exe.**************************************************************************.Completion time: 2008-11-06 10:21:44 - machine was rebootedComboFix-quarantined-files.txt 2008-11-06 18:21:39Pre-Run: 109,634,826,240 bytes freePost-Run: 109,635,780,608 bytes freeWindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe[boot loader]timeout=2default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS[operating systems]c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdconsmulti(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect260 Link to post Share on other sites
Rorschach112 Posted November 6, 2008 Report Share Posted November 6, 2008 HelloPlease download the OTMoveIt3 by OldTimer or from here. Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)::Processesexplorer.exe:Services:Reg[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19060-796b-11dd-854e-000fdb1ba9ca}][-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19061-796b-11dd-854e-000fdb1ba9ca}]:Filesc:\windows\SwSys2.bmpc:\windows\SwSys1.bmp:Commands[purity][emptytemp][start explorer][Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.Click the red Moveit! button.Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.Close OTMoveIt3Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.Please download Malwarebytes' Anti-Malware from Here or HereDouble Click mbam-setup.exe to install the application.Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.If an update is found, it will download and install the latest version.Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.When the scan is complete, click OK, then Show Results to view the results.Make sure that everything is checked, and click Remove Selected.When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.Copy&Paste the entire report in your next reply.Extra Note:If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.Go to Kaspersky website and perform an online antivirus scan.Read through the requirements and privacy statement and click on Accept button.It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.When the downloads have finished, click on Settings.Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programsArchivesMail databases[*]Click on My Computer under Scan.[*]Once the scan is complete, it will display the results. Click on View Scan Report.[*]You will see a list of infected items there. Click on Save Report As....[*]Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Link to post Share on other sites
avprox777 Posted November 7, 2008 Author Report Share Posted November 7, 2008 ========== PROCESSES ==========Process explorer.exe killed successfully.========== SERVICES/DRIVERS ==================== REGISTRY ==========Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19060-796b-11dd-854e-000fdb1ba9ca}\\ deleted successfully.Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ada19061-796b-11dd-854e-000fdb1ba9ca}\\ deleted successfully.========== FILES ==========c:\windows\SwSys2.bmp moved successfully.c:\windows\SwSys1.bmp moved successfully.========== COMMANDS ==========File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_CBXGJZs2Jd1khXZQCauD scheduled to be deleted on reboot.File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\Perflib_Perfdata_894.dat scheduled to be deleted on reboot.User's Temp folder emptied.User's Temporary Internet Files folder emptied.User's Internet Explorer cache folder emptied.Local Service Temp folder emptied.File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.Local Service Temporary Internet Files folder emptied.Windows Temp folder emptied.Java cache emptied.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\urlclassifier3.sqlite scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\XUL.mfl scheduled to be deleted on reboot.FireFox cache emptied.Opera cache emptied.Temp folders emptied.Explorer started successfullyOTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11062008_183837Files moved on Reboot...File C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_CBXGJZs2Jd1khXZQCauD not found!File C:\DOCUME~1\Owner\LOCALS~1\Temp\Perflib_Perfdata_894.dat not found!C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_001_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_002_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_003_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_MAP_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\urlclassifier3.sqlite moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\XUL.mfl moved successfully. Link to post Share on other sites
avprox777 Posted November 7, 2008 Author Report Share Posted November 7, 2008 Malwarebytes' Anti-Malware 1.30Database version: 1368Windows 5.1.2600 Service Pack 211/6/2008 6:49:42 PMmbam-log-2008-11-06 (18-49-42).txtScan type: Quick ScanObjects scanned: 52578Time elapsed: 3 minute(s), 2 second(s)Memory Processes Infected: 2Memory Modules Infected: 0Registry Keys Infected: 21Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 9Memory Processes Infected:C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Unloaded process successfully.C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Unloaded process successfully.Memory Modules Infected:(No malicious items detected)Registry Keys Infected:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully.HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully.Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> Delete on reboot.C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\msnioed.exe (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\noytcyr.exe (Trojan.Agent) -> Delete on reboot.C:\WINDOWS\system32\roytctm.exe (Trojan.Agent) -> Delete on reboot.C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Quarantined and deleted successfully.C:\WINDOWS\system32\tdydowkc.exe (Trojan.Agent) -> Delete on reboot.C:\WINDOWS\system32\wsldoekd.exe (Trojan.Agent) -> Delete on reboot. Link to post Share on other sites
Rorschach112 Posted November 7, 2008 Report Share Posted November 7, 2008 Ok post the Kaspersky log and a new HJT log Link to post Share on other sites
avprox777 Posted November 7, 2008 Author Report Share Posted November 7, 2008 kapersky log isnt going to be here until later in the day. i started it earlier, and after 3 hours it was still barely 38% and i had things i needed to get done, so im going to start it up and let it run while i sleep. Link to post Share on other sites
Rorschach112 Posted November 8, 2008 Report Share Posted November 8, 2008 ok Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 --------------------------------------------------------------------------------KASPERSKY ONLINE SCANNER 7 REPORT Saturday, November 8, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Saturday, November 08, 2008 17:23:19 Records in database: 1374606--------------------------------------------------------------------------------Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yesScan area - My Computer: C:\ E:\ F:\ G:\ H:\ J:\ K:\Scan statistics: Files scanned: 199610 Threat name: 19 Infected objects: 42 Suspicious objects: 0 Duration of the scan: 08:45:26File name / Threat name / Threats countC:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\kailleraclient.dll Infected: Trojan-Downloader.Win32.Agent.ahtr 1C:\Documents and Settings\Owner\Desktop\emu shit\emu shit.rar Infected: Trojan-Downloader.Win32.Agent.ahtr 1C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\kailleraclient.dll Infected: Trojan-Downloader.Win32.Agent.ahtr 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE Pro\WPE PRO - modified.exe Infected: HackTool.Win32.Sniffer.WpePro.v 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE Pro\WpeSpy.dll Infected: HackTool.Win32.Sniffer.WpePro.w 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE PRO - modified.exe Infected: HackTool.Win32.Sniffer.WpePro.v 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE Pro.rar Infected: HackTool.Win32.Sniffer.WpePro.v 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE Pro.rar Infected: HackTool.Win32.Sniffer.WpePro.w 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WpeSpy.dll Infected: HackTool.Win32.Sniffer.WpePro.w 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter.rar Infected: HackTool.Win32.Sniffer.WpePro.v 1C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter.rar Infected: HackTool.Win32.Sniffer.WpePro.w 1C:\Documents and Settings\Owner\Desktop\Rarely Used Shortcuts\CBS Refresh.exe Infected: Trojan-Spy.Win32.Pophot.cpc 1C:\Documents and Settings\Robbie\Desktop\ZwinkySetup2.2.60.11-2.ZJfox000.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.bc 1C:\Program Files\ESET\infected\DFCJCFBA.NQF Infected: not-a-virus:Monitor.Win32.WinSpy.bq 1C:\Program Files\ESET\infected\DFCJCFBA.NQF Infected: not-a-virus:Monitor.Win32.WinSpy.a 4C:\Program Files\ESET\infected\DFCJCFBA.NQF Infected: Trojan-Spy.Win32.SpyWin.a 2C:\Program Files\ESET\infected\JRLWLZDA.NQF Infected: not-a-virus:Monitor.Win32.ActualSpy.252 1C:\Program Files\ESET\infected\S1RYSHCA.NQF Infected: Hoax.Win32.Renos.he 1C:\Program Files\ESET\infected\T3KYZ5BA.NQF Infected: HackTool.Win32.Sniffer.WpePro.w 1C:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1C:\WINDOWS\system32\afisicx.exe Infected: Trojan.Win32.Agent.amej 1C:\WINDOWS\system32\cmdow.exe Infected: not-a-virus:RiskTool.Win32.HideWindows 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\48WD6HP8\af[1].bin Infected: Trojan.Win32.Agent.amej 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\af[1].bin Infected: Trojan.Win32.Agent.amej 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\msusp[1].bin Infected: Trojan.Win32.Agent.ambw 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\no[1].bin Infected: Trojan.Win32.Agent.gpa 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\td[1].bin Infected: Trojan.Win32.Agent.gpd 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\td[2].bin Infected: Trojan.Win32.Agent.gpd 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S16YRF8K\ws[2].bin Infected: Trojan.Win32.Agent.gpe 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1QTPL3I\no[1].bin Infected: Trojan.Win32.Agent.gpa 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1QTPL3I\ro[1].bin Infected: Trojan.Win32.Agent.gpc 1C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\S1QTPL3I\ro[2].bin Infected: Trojan.Win32.Agent.gpc 1C:\WINDOWS\system32\msnioed.exe Infected: Trojan.Win32.Agent.ambw 1C:\WINDOWS\system32\noytcyr.exe Infected: Trojan.Win32.Agent.gpa 1C:\WINDOWS\system32\roytctm.exe Infected: Trojan.Win32.Agent.gpc 1C:\WINDOWS\system32\tdydowkc.exe Infected: Trojan.Win32.Agent.gpd 1C:\WINDOWS\system32\wsldoekd.exe Infected: Trojan.Win32.Agent.gpe 1C:\WINDOWS\system32\zzzzz.zzz Infected: Trojan.Win32.Agent.amaz 1The selected area was scanned. Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 10:07:38 PM, on 11/8/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16441)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\VistaDrive\VistaDrive.exeC:\WINDOWS\ALCXMNTR.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Java\jre1.6.0_07\bin\jusched.exeC:\Program Files\Eset\nod32kui.exeC:\Program Files\Unlocker\UnlockerAssistant.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Xfire\xfiremusic.exeC:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exeC:\Program Files\Creative\Creative Media Lite\CTZDetec.exeC:\Program Files\Creative\Software Update 3\SoftAuto.exeC:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exeC:\Program Files\Orbitdownloader\orbitnet.exeC:\Program Files\SpeedFan\speedfan.exeC:\Program Files\Steam\steam.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\PnkBstrA.exeC:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wscntfy.exeC:\WINDOWS\system32\soxpeca.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dllO2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dllO3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dllO4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exeO4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"O4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"O4 - HKCU\..\Run: [softAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')O4 - S-1-5-18 Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: Steam.lnk = ? (User 'SYSTEM')O4 - .DEFAULT Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'Default user')O4 - .DEFAULT Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'Default user')O4 - .DEFAULT Startup: Steam.lnk = ? (User 'Default user')O4 - Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exeO4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exeO4 - Startup: Steam.lnk = ?O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exeO8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: afisicx - Unknown owner - C:\WINDOWS\system32\afisicx.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exe (file missing)O23 - Service: Windows File Manager Services (mscbcosd) - Unknown owner - C:\WINDOWS\system32\mscbco.exeO23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: noytcyr - Unknown owner - C:\WINDOWS\system32\noytcyr.exeO23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exeO23 - Service: root - Unknown owner - C:\Program.exe (file missing)O23 - Service: roytctm - Unknown owner - C:\WINDOWS\system32\roytctm.exeO23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exeO23 - Service: tdydowkc - Unknown owner - C:\WINDOWS\system32\tdydowkc.exeO23 - Service: wsldoekd - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe--End of file - 10032 bytes Link to post Share on other sites
Rorschach112 Posted November 9, 2008 Report Share Posted November 9, 2008 You got a lot of junk on your PC. I suggest you reconsider downloading hacks/cheats/packed editors in the futurePlease download the OTMoveIt3 by OldTimer or from here. Save it to your desktop. Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy)::Processesexplorer.exe:Services:Reg:FilesC:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\kailleraclient.dll C:\Documents and Settings\Owner\Desktop\emu shit\emu shit.rar C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079C:\Documents and Settings\Owner\Desktop\Rarely Used Shortcuts\CBS Refresh.exeC:\Documents and Settings\Robbie\Desktop\ZwinkySetup2.2.60.11-2.ZJfox000.exeC:\WINDOWS\system32\msnioed.exe C:\WINDOWS\system32\noytcyr.exe C:\WINDOWS\system32\roytctm.exe C:\WINDOWS\system32\tdydowkc.exe C:\WINDOWS\system32\wsldoekd.exeC:\WINDOWS\system32\zzzzz.zzzC:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter:Commands[purity][emptytemp][start explorer][Reboot] Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.Click the red Moveit! button.Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.Close OTMoveIt3Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.Also post a new HJT log Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 yeah, i havent reformatted my HDD for a good 3 years, so im definately due for it.========== PROCESSES ==========Process explorer.exe killed successfully.========== SERVICES/DRIVERS ==================== REGISTRY ==================== FILES ==========DllUnregisterServer procedure not found in C:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\kailleraclient.dllC:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\kailleraclient.dll NOT unregistered.C:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\kailleraclient.dll moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\emu shit.rar moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\ScreenShots moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\save moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\plugin moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\Lang moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9 moved successfully.C:\Documents and Settings\Owner\Desktop\emu shit\M64K_079 moved successfully.C:\Documents and Settings\Owner\Desktop\Rarely Used Shortcuts\CBS Refresh.exe moved successfully.C:\Documents and Settings\Robbie\Desktop\ZwinkySetup2.2.60.11-2.ZJfox000.exe moved successfully.C:\WINDOWS\system32\msnioed.exe moved successfully.C:\WINDOWS\system32\noytcyr.exe moved successfully.C:\WINDOWS\system32\roytctm.exe moved successfully.C:\WINDOWS\system32\tdydowkc.exe moved successfully.C:\WINDOWS\system32\wsldoekd.exe moved successfully.C:\WINDOWS\system32\zzzzz.zzz moved successfully.C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter\WPE Pro moved successfully.C:\Documents and Settings\Owner\Desktop\Modified_WPE___Filter moved successfully.========== COMMANDS ==========File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_5RSHXQmaI50Uwpp scheduled to be deleted on reboot.File delete failed. C:\DOCUME~1\Owner\LOCALS~1\Temp\Perflib_Perfdata_a40.dat scheduled to be deleted on reboot.User's Temp folder emptied.User's Temporary Internet Files folder emptied.User's Internet Explorer cache folder emptied.Local Service Temp folder emptied.File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.Local Service Temporary Internet Files folder emptied.File delete failed. C:\WINDOWS\temp\mta115464.dll scheduled to be deleted on reboot.File delete failed. C:\WINDOWS\temp\mta40322.dll scheduled to be deleted on reboot.File delete failed. C:\WINDOWS\temp\mta70383.dll scheduled to be deleted on reboot.File delete failed. C:\WINDOWS\temp\mta95314.dll scheduled to be deleted on reboot.File delete failed. C:\WINDOWS\temp\mta99655.dll scheduled to be deleted on reboot.Windows Temp folder emptied.Java cache emptied.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\urlclassifier3.sqlite scheduled to be deleted on reboot.File delete failed. C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\XUL.mfl scheduled to be deleted on reboot.FireFox cache emptied.Opera cache emptied.Temp folders emptied.Explorer started successfullyOTMoveIt3 by OldTimer - Version 1.0.7.0 log created on 11092008_110058Files moved on Reboot...File C:\DOCUME~1\Owner\LOCALS~1\Temp\etilqs_5RSHXQmaI50Uwpp not found!File C:\DOCUME~1\Owner\LOCALS~1\Temp\Perflib_Perfdata_a40.dat not found!C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat moved successfully.C:\WINDOWS\temp\mta115464.dll unregistered successfully.C:\WINDOWS\temp\mta115464.dll moved successfully.C:\WINDOWS\temp\mta40322.dll unregistered successfully.C:\WINDOWS\temp\mta40322.dll moved successfully.C:\WINDOWS\temp\mta70383.dll unregistered successfully.C:\WINDOWS\temp\mta70383.dll moved successfully.C:\WINDOWS\temp\mta95314.dll unregistered successfully.C:\WINDOWS\temp\mta95314.dll moved successfully.C:\WINDOWS\temp\mta99655.dll unregistered successfully.C:\WINDOWS\temp\mta99655.dll moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_001_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_002_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_003_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\Cache\_CACHE_MAP_ moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\urlclassifier3.sqlite moved successfully.C:\Documents and Settings\Owner\Local Settings\Application Data\Mozilla\Firefox\Profiles\3szpobj6.default\XUL.mfl moved successfully. Link to post Share on other sites
Rorschach112 Posted November 9, 2008 Report Share Posted November 9, 2008 Ok post a new HJT logTheres one thing respawning Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:17:50 AM, on 11/9/2008Platform: Windows XP SP2 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16441)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\VistaDrive\VistaDrive.exeC:\WINDOWS\ALCXMNTR.EXEC:\WINDOWS\AGRSMMSG.exeC:\Program Files\Java\jre1.6.0_07\bin\jusched.exeC:\Program Files\Eset\nod32kui.exeC:\Program Files\Unlocker\UnlockerAssistant.exeC:\Program Files\Winamp\winampa.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\Xfire\xfiremusic.exeC:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exeC:\Program Files\Creative\Creative Media Lite\CTZDetec.exeC:\Program Files\Creative\Software Update 3\SoftAuto.exeC:\Program Files\Orbitdownloader\orbitdm.exeC:\Program Files\Last.fm\LastFM.exeC:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exeC:\Program Files\SpeedFan\speedfan.exeC:\Program Files\Orbitdownloader\orbitnet.exeC:\Program Files\Steam\steam.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\WINDOWS\system32\CTsvcCDA.exeC:\Program Files\Creative\Shared Files\CTDevSrv.exeC:\Program Files\Eset\nod32krn.exeC:\WINDOWS\system32\PnkBstrA.exeC:\Program Files\MySQL\MySQL Server 5.0\bin\mysqld-nt.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\iPod\bin\iPodService.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Program Files\Xfire\xfire.exeC:\WINDOWS\system32\msnioed.exeC:\WINDOWS\system32\mabidwe.exeC:\WINDOWS\system32\soxpeca.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.htmlR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.comR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dllO2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dllO2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dllO2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - (no file)O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: MegaIEMn - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - C:\Program Files\Megaupload\Mega Manager\MegaIEMn.dllO3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~2\MEGAUP~1.DLLO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dllO4 - HKLM\..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exeO4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXEO4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exeO4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exeO4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICEO4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exeO4 - HKLM\..\Run: [unlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [Xfire Music] "C:\Program Files\Xfire\xfiremusic.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [iMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32O4 - HKLM\..\Run: [iMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXEO4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNCO4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNCO4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMENameO4 - HKCU\..\Run: [bgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [CTZDetec.exe] "C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe"O4 - HKCU\..\Run: [softAuto.exe] "C:\Program Files\Creative\Software Update 3\SoftAuto.exe"O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'Default user')O4 - S-1-5-18 Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'SYSTEM')O4 - S-1-5-18 Startup: Steam.lnk = ? (User 'SYSTEM')O4 - .DEFAULT Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exe (User 'Default user')O4 - .DEFAULT Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exe (User 'Default user')O4 - .DEFAULT Startup: Steam.lnk = ? (User 'Default user')O4 - Startup: Last.fm.lnk = C:\Program Files\Last.fm\LastFM.exeO4 - Startup: SpeedFan.lnk = C:\Program Files\SpeedFan\speedfan.exeO4 - Startup: Steam.lnk = ?O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exeO8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htmO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: afisicx - Unknown owner - C:\WINDOWS\system32\afisicx.exeO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exeO23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: mabidwe Service (mabidwe) - Unknown owner - C:\WINDOWS\system32\mabidwe.exeO23 - Service: Windows File Manager Services (mscbcosd) - Unknown owner - C:\WINDOWS\system32\mscbco.exeO23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exeO23 - Service: noytcyr - Unknown owner - C:\WINDOWS\system32\noytcyr.exeO23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exeO23 - Service: root - Unknown owner - C:\Program.exe (file missing)O23 - Service: roytctm - Unknown owner - C:\WINDOWS\system32\roytctm.exeO23 - Service: soxpeca Service (soxpeca) - Unknown owner - C:\WINDOWS\system32\soxpeca.exeO23 - Service: tdydowkc - Unknown owner - C:\WINDOWS\system32\tdydowkc.exeO23 - Service: wsldoekd - Unknown owner - C:\WINDOWS\system32\wsldoekd.exe--End of file - 10626 bytes Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 also, there seems to be a process called "udxfytw.sys" that hijackthis isnt picking up, that i know is the source of some of the malware. Link to post Share on other sites
Rorschach112 Posted November 9, 2008 Report Share Posted November 9, 2008 You seem to have a rootkitBefore we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.Download SDFix and save it to your Desktop.Double click SDFix.exe and it will extract the files to %systemdrive%(Drive that contains the Windows Directory, typically C:\SDFix)Please then reboot your computer in Safe Mode by doing the following :Restart your computerAfter hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;Instead of Windows loading as normal, the Advanced Options Menu should appear;Select the first option, to run Windows in Safe Mode, then press Enter.Choose your usual account. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt(Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste the contents of the Report.txt back on the forum. Download OTScanIt2.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt2 on your desktop.Open the OTScanIt2 folder and double-click on OTScanIt.exe to start the program.Under File Age at the top, change it from 30 days to 90 daysUnder Additional Scans check the boxes beside Reg - ColumnHandlers, Reg - Desktop Components, Reg - Disabled MS Config Items, Reg - File Associations, Reg - NetSvcs, Reg - Protocol Filters, Reg - Protocol Handlers, Reg - Session Manager Settings, Reg - Winsock2 Catalogs, File - Lop Check, File - Purity Scan, Files - Signature Check, and Evnt - EventViewer Logs ( Last 10 Errors).Under Rootkit Search change it to YesNow click the Run Scan button on the toolbar.When the scan is complete Notepad will open with the report file loaded in it.Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.Use the Add Reply button and post the information back here in an attachment. I will review it when it comes in. The last line is < End of Report >, so make sure that is the last line in the attached report.Make sure you attach the report in your reply. If it is too big to upload, then zip the text file and upload it that way Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 (edited) Do I use OTScanIt2 in normal or safe mode?Also, I just want to say that I really appreciate you taking time out of your day to help me. Edited November 9, 2008 by avprox777 Link to post Share on other sites
Rorschach112 Posted November 9, 2008 Report Share Posted November 9, 2008 Do OTScanIt2 in normal mode for me Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 SDFix: Version 1.240 Run by Owner on Sun 11/09/2008 at 01:10 PMMicrosoft Windows XP [Version 5.1.2600]Running From: C:\SDFixChecking Services :Restoring Default Security ValuesRestoring Default Hosts FileRebootingChecking Files : Trojan Files Found:C:\WINDOWS\system32\comsa32.sys - DeletedRemoving Temp FilesADS Check : Final Check :catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.netRootkit scan 2008-11-09 14:36:30Windows 5.1.2600 Service Pack 2 NTFSscanning hidden processes ...C:\WINDOWS\system32\afisicx.exe [1884] 0x85F37020C:\WINDOWS\system32\noytcyr.exe [1236] 0x85CC3C18C:\WINDOWS\system32\roytctm.exe [1312] 0x85CBB638C:\WINDOWS\system32\tdydowkc.exe [1776] 0x84B4DDA0C:\WINDOWS\system32\wsldoekd.exe [1968] 0x84B41C80scanning hidden services & system hive ...[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\d347prt\Cfg\0Jf40]"khjeh"=hex:20,02,00,00,a6,d3,71,e9,1b,3a,37,c4,62,55,97,4c,9d,bd,dd,fb,66,.."hj34z0"=hex:d1,8e,77,fc,dd,09,81,38,8d,e1,ca,8f,f2,95,de,02,f2,a4,99,c6,77,..scanning hidden registry entries ...[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.\x2558\x2524ä\OpenWithProgids]"X%$%ä?_?a?u?t?o?_?f?i?l?e?"=hex(0):scanning hidden files ...scan completed successfullyhidden processes: 5hidden services: 0hidden files: 0Remaining Services :Authorized Application Key Export:[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader""C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1""C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)""C:\\Program Files\\Xfire\\xfire.exe"="C:\\Program Files\\Xfire\\xfire.exe:*:Enabled:Xfire""C:\\Program Files\\Azureus\\Azureus.exe"="C:\\Program Files\\Azureus\\Azureus.exe:*:Enabled:Azureus""C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:LimeWire""C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes""C:\\Program Files\\Orbitdownloader\\orbitdm.exe"="C:\\Program Files\\Orbitdownloader\\orbitdm.exe:*:Enabled:Orbit""C:\\Program Files\\Orbitdownloader\\orbitnet.exe"="C:\\Program Files\\Orbitdownloader\\orbitnet.exe:*:Enabled:Orbit""C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe:*:Enabled:MySpaceIM"[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000""%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019""C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1""C:\\Program Files\\MSN Messenger\\livecall.exe"="C:\\Program Files\\MSN Messenger\\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"Remaining Files :File Backups: - C:\SDFix\backups\backups.zipFiles with Hidden Attributes :Thu 8 Mar 2007 258,560 A..H. --- "C:\Program Files\Adobe\upx.exe"Sun 26 Jun 2005 616,448 A.SHR --- "C:\Program Files\Replay Converter\cygwin1.dll"Tue 21 Jun 2005 45,568 A.SHR --- "C:\Program Files\Replay Converter\cygz.dll"Mon 9 Dec 2002 102,437 A..HR --- "C:\Program Files\Replay Converter\drv13260.dll"Mon 9 Dec 2002 176,165 A..HR --- "C:\Program Files\Replay Converter\drv23260.dll"Mon 9 Dec 2002 208,935 A..HR --- "C:\Program Files\Replay Converter\drv33260.dll"Mon 9 Dec 2002 217,127 A..HR --- "C:\Program Files\Replay Converter\drv43260.dll"Sun 9 Jun 2002 40,448 A..HR --- "C:\Program Files\Replay Converter\dspr3260.dll"Sat 3 Nov 2001 225,280 A..HR --- "C:\Program Files\Replay Converter\ivvideo.dll"Tue 10 Apr 2001 225,280 A..HR --- "C:\Program Files\Replay Converter\qtmlClient.dll"Fri 20 Feb 2004 232,960 A..HR --- "C:\Program Files\Replay Converter\raac.dll"Sun 9 Jun 2002 525,824 A..HR --- "C:\Program Files\Replay Converter\rnco3260.dll"Mon 9 Dec 2002 245,805 A..HR --- "C:\Program Files\Replay Converter\rnlt3260.dll"Mon 9 Dec 2002 45,093 A..HR --- "C:\Program Files\Replay Converter\rv103260.dll"Mon 9 Dec 2002 98,341 A..HR --- "C:\Program Files\Replay Converter\rv203260.dll"Mon 9 Dec 2002 94,247 A..HR --- "C:\Program Files\Replay Converter\rv303260.dll"Mon 9 Dec 2002 90,151 A..HR --- "C:\Program Files\Replay Converter\rv403260.dll"Sun 9 Jun 2002 49,152 A..HR --- "C:\Program Files\Replay Converter\tokr3260.dll"Wed 30 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"Wed 30 Jul 2008 1,829,712 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"Thu 8 Mar 2007 27,648 A.SH. --- "C:\WINDOWS\system32\AVSredirect.dll"Thu 3 Apr 2008 80 ..SHR --- "C:\WINDOWS\system32\B007C43AE0.dll"Tue 11 Apr 2006 2,461,696 A..H. --- "C:\Documents and Settings\Owner\Application Data\U3\temp\Launchpad Removal.exe"Tue 11 Apr 2006 2,461,696 A..H. --- "C:\Documents and Settings\Robbie\Application Data\U3\temp\Launchpad Removal.exe"Thu 7 Jun 2001 339,968 A..H. --- "C:\Documents and Settings\Owner\Desktop\Downloads\M64K_079\Mupen64K 0.7.9\MSVCR70.dll"Thu 7 Jun 2001 339,968 A..H. --- "C:\_OTMoveIt\MovedFiles\11092008_110058\Documents and Settings\Owner\Desktop\emu shit\M64K_079\Mupen64K 0.7.9\MSVCR70.dll"Finished! Link to post Share on other sites
avprox777 Posted November 9, 2008 Author Report Share Posted November 9, 2008 Here's the OTScanIt report.OTScanIt.Txt Link to post Share on other sites
Rorschach112 Posted November 10, 2008 Report Share Posted November 10, 2008 HelloStart OTScanIt2. Copy/Paste the information in the quotebox below into the panel where it says "Paste fix here" and then click the Run Fix button.[Kill Explorer][unregister Dlls][Processes - Safe List]YN -> aawservice.exe -> %ProgramFiles%\Lavasoft\Ad-Aware\aawservice.exeYY -> mabidwe.exe -> %SystemRoot%\system32\mabidwe.exeYY -> soxpeca.exe -> %SystemRoot%\system32\soxpeca.exe[Win32 Services - Safe List]YY -> (afisicx) afisicx [Win32_Own | Auto | Running] -> %SystemRoot%\system32\afisicx.exeYY -> (mabidwe) mabidwe Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\mabidwe.exeYY -> (noytcyr) noytcyr [Win32_Own | Auto | Running] -> %SystemRoot%\system32\noytcyr.exeYY -> (roytctm) roytctm [Win32_Own | Auto | Running] -> %SystemRoot%\system32\roytctm.exeYY -> (soxpeca) soxpeca Service [Win32_Own | Auto | Running] -> %SystemRoot%\system32\soxpeca.exeYY -> (tdydowkc) tdydowkc [Win32_Own | Auto | Running] -> %SystemRoot%\system32\tdydowkc.exeYY -> (wsldoekd) wsldoekd [Win32_Own | Auto | Running] -> %SystemRoot%\system32\wsldoekd.exe[Registry - Safe List]< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\YN -> {5A263CF7-56A6-4D68-A8CF-345BE45BC911} [HKLM] -> Reg Error: Key does not exist or could not be opened. [Yahoo! IE Suggest][Files/Folders - Created Within 90 Days]NY -> 1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmpNY -> msnioed.exe -> %SystemRoot%\System32\msnioed.exeNY -> SDFix -> %SystemDrive%\SDFixNY -> SDFix.exe -> %UserProfile%\Desktop\SDFix.exeNY -> _OTMoveIt -> %SystemDrive%\_OTMoveItNY -> OTMoveIt3.exe -> %UserProfile%\Desktop\OTMoveIt3.exeNY -> SysRestorePoint_v13 -> %UserProfile%\Desktop\SysRestorePoint_v13[Files/Folders - Modified Within 90 Days]NY -> mta101265.dll -> C:\WINDOWS\Temp\mta101265.dllNY -> mta106596.dll -> C:\WINDOWS\Temp\mta106596.dllNY -> mta18811.dll -> C:\WINDOWS\Temp\mta18811.dllNY -> mta68642.dll -> C:\WINDOWS\Temp\mta68642.dllNY -> mta73987.dll -> C:\WINDOWS\Temp\mta73987.dllNY -> mta74163.dll -> C:\WINDOWS\Temp\mta74163.dllNY -> mta87714.dll -> C:\WINDOWS\Temp\mta87714.dllNY -> msnioed.exe -> %SystemRoot%\System32\msnioed.exe[File - Lop Check]NY -> Viewpoint -> C:\Documents and Settings\Owner\Application Data\Viewpoint[Custom Items]:filesC:\Program Files\Adobe\upx.exeC:\WINDOWS\system32\B007C43AE0.dll:end[Empty Temp Folders][start Explorer][Reboot]The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information back hereI will review the information when it comes back in.Also post a new HJT log Link to post Share on other sites
avprox777 Posted November 10, 2008 Author Report Share Posted November 10, 2008 well, i was running OTScanIt2 and it got an error halfway through. it finished and asked if i wanted to reboot, i said yes, and it wouldnt reboot. so i manually restarted (held down the power button) and when i turned my computer back on, it got to the login screen and there were no users to log onto. the screen was just blank. so i went into safe mode, and it was the same. i ended up just formatting my computer, so i guess you can close this thread, because the issue is resolved. thanks again for all the help, i really appreciate it. Link to post Share on other sites
Rorschach112 Posted November 10, 2008 Report Share Posted November 10, 2008 Thats very strange, it shouldn't be due to anything we have done.Sorry it ended like that. Here are some suggestions for the futureBelow I have included a number of recommendations for how to protect your computer against malware infections.* Keep Windows updated by regularly checking their website at :http://windowsupdate.microsoft.com/This will ensure your computer has always the latest security updates available installed on your computer.* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:SpywareBlaster protects against bad ActiveXIE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all Have a look at this tutorial for IE-Spyad here* SpywareGuard offers realtime protection from spyware installation attempts. Make sure you are only running one real-time anti-spyware protection program or there will be a conflict.Make Internet Explorer more secureClick Start > RunType Inetcpl.cpl & click OKClick on the Security tabClick Reset all zones to default levelMake sure the Internet Zone is selected & Click Custom levelIn the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".Next Click OK, then Apply button and then OK to exit the Internet Properties page.*ATF Cleaner - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders.*NoScript - Addon for Firefox that stops all scripts from running on websites. Stops malicious software from invading via flash, java, javascript, and many other entry points.*Keep a backup of your important files - Now, more than ever, it's especially important to protect your digital files and memories. This article is full of good information on alternatives for home backup solutions.* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop upblocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from Here* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'HereThank you for your patience, and performing all of the procedures requested. Link to post Share on other sites
Rorschach112 Posted November 14, 2008 Report Share Posted November 14, 2008 Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic. Link to post Share on other sites
Recommended Posts