Login Loop Windows Xp[INACTIVE]

lgoncalves · December 22, 2008

Hi,

I am running windows xp s 2 and I got on a web page << removed site >> and my computer got a virus that I could not remove. In addition, when I start the computer and I try to log in, the program gets me back to logon screen, something like a loop logon/logoff.

I can just log on in safe mode and I have run hijackthis. The log is following:

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 7:46:52 PM, on 12/21/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode with network support

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\userinit.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Grisoft\AVG7\avgcc.exe

C:\LuisG Documents\HiJackThis.exe

C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.ve/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.toshibadirect.com/dpdstart

F2 - REG:system.ini: UserInit=userinit.exe

O1 - Hosts: 127.0.0.2 ymsdasdw1.cn

O1 - Hosts: 127.0.0.3 h96b.info

O1 - Hosts: 127.0.0.0 www.bypk.com

O1 - Hosts: 127.0.0.2 bnasnd83nd.cn

O1 - Hosts: 127.0.0.0 www.gamehacker.com.cn

O1 - Hosts: 127.0.0.0 gamehacker.com.cn

O1 - Hosts: 127.0.0.3 adlaji.cn

O1 - Hosts: 127.1.1.1 bnasnd83nd.cn

O1 - Hosts: 127.0.0.0 user1.12-27.net

O1 - Hosts: 127.0.0.0 fengent.cn

O1 - Hosts: 127.0.0.0 www.sony888.cn

O1 - Hosts: 127.0.0.0 user1.asp-33.cn

O1 - Hosts: 127.0.0.0 www.netkwek.cn

O1 - Hosts: 127.0.0.0 ymsdkad6.cn

O1 - Hosts: 127.0.0.0 www.lkwueir.cn

O1 - Hosts: 127.0.1.1 user1.23-17.net

O1 - Hosts: 127.0.0.0 upa.luzhiai.net

O1 - Hosts: 127.0.0.0 www.guccia.net

O1 - Hosts: 127.0.0.0 4m9mnlmi.cn

O1 - Hosts: 127.0.0.0 mm119mkssd.cn

O1 - Hosts: 127.0.0.0 61.128.171.115:8080

O1 - Hosts: 127.0.0.0 www.1119111.com

O1 - Hosts: 127.0.0.0 win.nihao69.cn

O1 - Hosts: 127.0.0.0 puc.lianxiac.net

O1 - Hosts: 127.0.0.0 pud.lianxiac.net

O1 - Hosts: 127.0.0.0 210.76.0.133

O1 - Hosts: 127.0.0.0 61.166.32.2

O1 - Hosts: 127.0.0.0 218.92.186.27

O1 - Hosts: 127.0.0.0 www.fsfsfag.cn

O1 - Hosts: 127.0.0.0 ovo.ovovov.cn

O1 - Hosts: 127.0.0.0 dw.com.com

O1 - Hosts: 127.0.0.0 t.myblank.cn

O1 - Hosts: 127.0.0.0 x.myblank.cn

O1 - Hosts: 127.0.0.0 qq-xing.com.cn

O1 - Hosts: 127.0.0.0 59.125.231.177:17777

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll

O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O3 - Toolbar: PDF de Adobe - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll

O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll

O4 - HKLM\..\Run: [TDispVol] TDispVol.exe

O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup

O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe

O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe

O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe

O4 - HKLM\..\Run: [TPSMain] TPSMain.exe

O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\DLACTRLW.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [TomcatStartup 2.5] C:\Program Files\Hewlett-Packard\Toolbox\hpbpsttp.exe

O4 - HKLM\..\Run: [iVPServiceMgr] C:\toshiba\ivp\ism\ivpsvmgr.exe

O4 - HKLM\..\Run: [DataLayer] C:\Program Files\Common Files\PCSuite\DataLayer\DataLayer.exe

O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP

O4 - HKLM\..\RunOnce: [0000 - C:\Documents and Settings\Yamileth_Dominguez\Start Menu\Programs\HP DeskJet 930C Series v2.1] C:\WINDOWS\command.com /c rmdir "C:\Documents and Settings\Yamileth_Dominguez\Start Menu\Programs\HP DeskJet 930C Series v2.1"

O4 - HKLM\..\RunOnce: [0007 - C:\Documents and Settings\Yamileth_Dominguez\Start Menu\Programs\Printable Expressions] C:\WINDOWS\command.com /c rmdir "C:\Documents and Settings\Yamileth_Dominguez\Start Menu\Programs\Printable Expressions"

O4 - HKLM\..\RunOnce: [spybotDeletingA3257] command /c del "c:\autorun.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingC6609] cmd /c del "c:\autorun.exe"

O4 - HKLM\..\RunOnce: [spybotDeletingA998] command /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingC7057] cmd /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingA5979] command /c del "C:\WINDOWS\wt\data.wts"

O4 - HKLM\..\RunOnce: [spybotDeletingC3697] cmd /c del "C:\WINDOWS\wt\data.wts"

O4 - HKLM\..\RunOnce: [spybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\RunOnce: [spybotDeletingB9158] command /c del "c:\autorun.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD8296] cmd /c del "c:\autorun.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB1939] command /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKCU\..\RunOnce: [spybotDeletingD9138] cmd /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKCU\..\RunOnce: [spybotDeletingB1896] command /c del "C:\WINDOWS\wt\data.wts"

O4 - HKCU\..\RunOnce: [spybotDeletingD2061] cmd /c del "C:\WINDOWS\wt\data.wts"

O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')

O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

O4 - Global Startup: Inicio rÃ¡pido de Adobe Acrobat.lnk = ?

O4 - Global Startup: Metamail Trust Manager.lnk = C:\Program Files\Metamail Inc\Metamail Tray\Metamail Trust Manager.exe

O4 - Global Startup: MightyFAX Controller.lnk = C:\Program Files\Mightyfax\MFNTCTL.EXE

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm

O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

O8 - Extra context menu item: Convertir a PDF de Adobe - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir a PDF existente - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir destino de vÃnculo a PDF existente - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir destino de vÃnculo en archivo PDF de Adobe - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir selecciÃ³n a archivo PDF existente - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Convertir selecciÃ³n a PDF de Adobe - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Convertir vÃnculos seleccionados a PDF de Adobe - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Convertir vÃnculos seleccionados a PDF existente - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?7aeb37f469a34e778e0d2206232b2866

O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?7aeb37f469a34e778e0d2206232b2866

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll

O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://dyamileth0.spaces.live.com//PhotoUpload/MsnPUpld.cab

O20 - AppInit_DLLs: HBJXSJ.dll,HBWOW.dll,HBJTLQ.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe

O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe

O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe

O23 - Service: IntelÂ® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Kerberos Key Distribution Centers (kkdc) - Unknown owner - C:\WINDOWS\lsass.exe (file missing)

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

O23 - Service: IntelÂ® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: IntelÂ® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe

--

End of file - 15431 bytes

sarahw · December 23, 2008

Hi,

Can you please try using Safe Mode with Networking for the duration of this fix.

While you will have internet access, stay off the internet as you may be infecting others, or sending spam etc.

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

lgoncalves · December 25, 2008

Hi Sarahw,

I have run combofix tool as guide says; only one difference: when it finished, it asked for reboot and the computer restarted automatically. Attached you will find the Combofix.txt log.

I cannot still log in windows xp.

Thanks in advance

ComboFix.txt

sarahw · December 29, 2008

Hi,

Can you please uninstall Spybot Search and Destroy. Its a good program, but I want to remove it as it can affect our fix. Post back with a fresh Hijack This log when you have done this.

lgoncalves · December 30, 2008

Hi,

The Spybot, Search and Destroy is uninstalled. However, in register section of log I could see registry entries about spybot.

Attached is the fresh hijasckthis.log.

Thanks again

hijackthis.txt

sarahw · December 31, 2008

Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below.

O4 - HKCU\..\RunOnce: [spybotDeletingB9158] command /c del "c:\autorun.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingD8296] cmd /c del "c:\autorun.exe"

O4 - HKCU\..\RunOnce: [spybotDeletingB1939] command /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKCU\..\RunOnce: [spybotDeletingD9138] cmd /c del "C:\WINDOWS\wt\webdriver.dll"

O4 - HKCU\..\RunOnce: [spybotDeletingB1896] command /c del "C:\WINDOWS\wt\data.wts"

O4 - HKCU\..\RunOnce: [spybotDeletingD2061] cmd /c del "C:\WINDOWS\wt\data.wts"

Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis.

Please download the Killbox by Option^Explicit.

Note: In the event you already have Killbox, this is a new version that I need you to download.

Save it to your desktop.
Please double-click Killbox.exe to run it.
Select:
- Delete on Reboot
- then Click on the All Files button.
[*]Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):
c:\autorun.exe
C:\WINDOWS\wt
Post another Hijack This log
[*] Return to Killbox, go to the File menu, and choose Paste from Clipboard.
[*]Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let me know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click here to download and run missingfilesetup.exe. Then try Killbox again.

lgoncalves · January 2, 2009

Hi Sarahw,

Happy new year!

Following the activities I have run, according to your recommendations:

- Run Hijackthis and fix check the entries

- Run killbox.exe. I tried twice delete on reboot both file paths, but I think it failed. I never found "C:\autorun.exe" neither before nor after (I think is hidden) and "c:\windows\wt" is still there.

Attached you will find the hijackthis log and killbox.exe log.

I have tried log in but it happens the same gets me back off. I have just log in safe mode.

Thanks

kb.txt

hijackthis.txt

sarahw · January 3, 2009

Hi,

Can you please run combofix again.

Note: Post the log in the forum (Copy and paste the notepad contents into this thread, do not upload the txt file.

lgoncalves · January 6, 2009

Hi,

Sorry for the uploads.

Here is the combofix.log:

ComboFix 09-01-05.05 - Yamileth_Dominguez 2009-01-06 16:41:16.2 - NTFSx86 NETWORK

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.760 [GMT -4.5:30]

Running from: c:\documents and settings\Yamileth_Dominguez\Desktop\ComboFix.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\windows\system32\userinit.exe . . . is infected!!

.

((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))

.

2009-01-02 10:40 . 2009-01-02 10:40 <DIR> d-------- C:\!KillBox

2008-12-13 23:20 . 2008-12-30 12:57 <DIR> d-------- c:\program files\Spybot - Search & Destroy

2008-12-13 23:20 . 2008-12-30 12:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-06 21:10 --------- d-----w c:\documents and settings\All Users\Application Data\avg7

2009-01-06 21:08 --------- d-----w c:\documents and settings\Yamileth_Dominguez\Application Data\U3

2008-12-22 00:03 --------- d-----w c:\documents and settings\Yamileth_Dominguez\Application Data\AVG7

2007-05-14 04:27 462,933 ----a-w c:\documents and settings\Yamileth_Dominguez\gotomypc_280.exe

2007-03-16 15:52 92,064 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmmdm.sys

2007-03-16 15:52 9,232 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmmdfl.sys

2007-03-16 15:52 79,328 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmserd.sys

2007-03-16 15:52 66,656 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmbus.sys

2007-03-16 15:52 6,208 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmcmnt.sys

2007-03-16 15:52 5,936 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmwhnt.sys

2007-03-16 15:52 4,048 ----a-w c:\documents and settings\Yamileth_Dominguez\mqdmcr.sys

2007-03-16 15:52 25,600 ----a-w c:\documents and settings\Yamileth_Dominguez\usbsermptxp.sys

2007-03-16 15:52 22,768 ----a-w c:\documents and settings\Yamileth_Dominguez\usbsermpt.sys

2004-02-23 08:00 1,386,496 --sh--r c:\windows\system32\msvbvm60.dll

2007-08-23 18:46 10 --sh--r c:\windows\system32\sistem.sys

.

------- Sigcheck -------

2008-04-13 19:42 26112 a93aee1928a9d7ce3e16d24ec7380f89 c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\userinit.exe

2004-08-10 07:30 24576 c8c88e8285de0d2c52e4ab4aff758a7e c:\windows\system32\userinit.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

"TOSCDSPD"="c:\program files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2004-12-30 65536]

"MsnMsgr"="c:\program files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 5674352]

"PcSync"="c:\program files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2005-06-24 860160]

"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-26 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]

"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784]

"PSQLLauncher"="c:\program files\Protector Suite QL\launcher.exe" [2005-12-21 30208]

"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]

"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256]

"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-12-16 82009]

"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 761945]

"LtMoh"="c:\program files\ltmoh\Ltmoh.exe" [2004-08-18 184320]

"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 73728]

"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]

"dla"="c:\windows\system32\dla\DLACTRLW.exe" [2005-10-06 122940]

"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718]

"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182]

"Acrobat Assistant 7.0"="c:\program files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 483328]

"TomcatStartup 2.5"="c:\program files\Hewlett-Packard\Toolbox\hpbpsttp.exe" [2003-06-10 155648]

"IVPServiceMgr"="c:\toshiba\ivp\ism\ivpsvmgr.exe" [2003-10-20 475136]

"DataLayer"="c:\program files\Common Files\PCSuite\DataLayer\DataLayer.exe" [2005-06-07 819712]

"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-02-19 49152]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]

"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-04 267048]

"TDispVol"="TDispVol.exe" [2005-03-11 c:\windows\system32\TDispVol.exe]

"TPSMain"="TPSMain.exe" [2005-06-01 c:\windows\system32\TPSMain.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]

AutoCAD Startup Accelerator.lnk - c:\program files\Common Files\Autodesk Shared\acstart16.exe [2005-03-05 10872]

HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]

Inicio rÂ pido de Adobe Acrobat.lnk - c:\windows\Installer\{AC76BA86-1034-4700-7760-000000000002}\SC_Acrobat.exe [2006-08-07 25214]

Metamail Trust Manager.lnk - c:\program files\Metamail Inc\Metamail Tray\Metamail Trust Manager.exe [2006-08-07 329472]

MightyFAX Controller.lnk - c:\program files\Mightyfax\MFNTCTL.EXE [2007-09-25 491520]

RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-02-15 155648]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2007-04-19 13:41 294912 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]

2005-12-22 00:12 40448 c:\windows\system32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=HBJXSJ.dll,HBWOW.dll,HBJTLQ.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\regedt32.exe]

"Debugger"=setuprs1.PIF

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli psqlpwd

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=

"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe

"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=

"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=

"c:\\Program Files\\America Online 9.0\\waol.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=

"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=

"c:\\Program Files\\Common Files\\AOL\\1140083713\\EE\\AOLServiceHost.exe"=

"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"=

"c:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"=

"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=

"c:\\Program Files\\Hewlett-Packard\\Toolbox\\jre\\bin\\javaw.exe"=

"c:\\StubInstaller.exe"=

"c:\\Program Files\\LimeWire\\LimeWire.exe"=

"c:\\Program Files\\Messenger\\msmsgs.exe"=

"c:\\NM2100em\\bin\\NM2100EM.exe"=

"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=

"c:\\Program Files\\MSN Messenger\\livecall.exe"=

"c:\\LuisG Documents\\Emule\\eMule.exe"=

"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

"c:\\Program Files\\iTunes\\iTunes.exe"=

"c:\\Program Files\\uTorrent\\uTorrent.exe"=

"c:\\WINDOWS\\system32\\ftp.exe"=

"c:\\LuisG Documents\\Utorrent\\utorrent.exe"=

S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-05-28 8944]

S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-05-28 55024]

S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-05-28 7408]

S4 FdRedir;FdRedir;c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2005-12-22 13568]

S4 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2005-12-22 33024]

S4 kkdc;Kerberos Key Distribution Centers;c:\windows\lsass.exe -netsvcs --> c:\windows\lsass.exe -netsvcs [?]

S4 smihlp;SMI helper driver;c:\program files\Protector Suite QL\smihlp.sys [2005-12-21 3456]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{55e985f5-343d-11db-a70f-00038a000015}]

\Shell\AutoRun\command - E:\xyw9tmdj.com

\Shell\explore\Command - E:\xyw9tmdj.com

\Shell\open\Command - E:\xyw9tmdj.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c1ae7726-a2b3-11db-a785-00038a000015}]

\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ea1eedf7-3217-11db-a70b-00038a000015}]

\Shell\AutoRun\command - E:\ntde1ect.com

\Shell\explore\Command - E:\ntde1ect.com

\Shell\open\Command - E:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fd77ccb2-781a-11db-a762-00038a000015}]

\Shell\AutoRun\command - E:\xyw9tmdj.com

\Shell\explore\Command - E:\xyw9tmdj.com

\Shell\open\Command - E:\xyw9tmdj.com

.

Contents of the 'Scheduled Tasks' folder

2008-10-23 c:\windows\Tasks\AppleSoftwareUpdate.job

- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:27]

2008-10-31 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job

- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 10:50]

2008-10-27 c:\windows\Tasks\Norton Security Scan.job

- c:\program files\Norton Security Scan\Nss.exe [2008-01-09 04:08]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.google.co.ve/

uInternet Connection Wizard,ShellNext = iexplore

uInternet Settings,ProxyOverride = <local>

uSearchURL,(Default) = hxxp://www.google.com/search?q=%s

IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm

IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx

IE: Convertir a PDF de Adobe - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir a PDF existente - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir destino de vÃnculo a PDF existente - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir destino de vÃnculo en archivo PDF de Adobe - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir selecciÃ³n a archivo PDF existente - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

IE: Convertir selecciÃ³n a PDF de Adobe - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

IE: Convertir vÃnculos seleccionados a PDF de Adobe - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

IE: Convertir vÃnculos seleccionados a PDF existente - c:\program files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?7aeb37f469a34e778e0d2206232b2866

IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?7aeb37f469a34e778e0d2206232b2866

FF - ProfilePath -

.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-01-06 16:46:39

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ã˜â€¢â‚¬|Ã¿Ã¿Ã¿Ã¿â€¢â‚¬|Ã¹â€¢A~*NULL*]

"A0C0110900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(608)

c:\program files\SUPERAntiSpyware\SASWINLO.dll

c:\windows\system32\psqlpwd.dll

c:\program files\Protector Suite QL\infra.dll

c:\program files\Protector Suite QL\homefus2.dll

c:\windows\system32\biologon.dll

c:\program files\Protector Suite QL\homepass.dll

c:\program files\Protector Suite QL\bio.dll

c:\program files\Protector Suite QL\remote.dll

c:\program files\Protector Suite QL\crypto.dll

- - - - - - - > 'lsass.exe'(664)

c:\windows\system32\psqlpwd.dll

c:\program files\Protector Suite QL\infra.dll

c:\program files\Protector Suite QL\homefus2.dll

.

Completion time: 2009-01-06 16:50:11 - machine was rebooted

ComboFix-quarantined-files.txt 2009-01-06 21:20:09

ComboFix2.txt 2008-12-25 18:27:27

Pre-Run: 61,773,996,032 bytes free

Post-Run: 61,759,807,488 bytes free

213 --- E O F --- 2008-10-27 16:26:30

sarahw · January 7, 2009

Hi,

Locate your Windows installation CD.

Go to Start, then to Run, and type in SFC.EXE /SCANNOW Then press Enter.

The program may (or it may not) ask you for your Windows XP installation CD - please insert it at the prompt.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\system32\HBJXSJ.dll
c:\windows\system32\HBWOW.dll
c:\windows\system32\HBJTLQ.dll
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=-

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

lgoncalves · January 12, 2009

Hi Sarah,

Give me a couple of days, because I am on a job trip.

Thank you very much

sarahw · January 13, 2009

Ok, Not a problem

lgoncalves · January 21, 2009

Hi Sarah,

I could not find my windows installation CD. When I have run sfc /scannow showed that it will be needed copy some files to dll cache.

I would like if you could recommend any good antivirus an any good firewall, because I uninstalled the original antivirus.

Now I can log in windows, but I am worried about the missing files that it were detected.

Thanks a lot for your help.

Following the combofixlog:

ComboFix 09-01-19.05 - Yamileth_Dominguez 2009-01-20 23:06:54.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1014.543 [GMT -4.5:30]

Running from: c:\documents and settings\Yamileth_Dominguez\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Yamileth_Dominguez\Desktop\CFScript.txt

* Created a new restore point

FILE ::

c:\windows\system32\HBJTLQ.dll

c:\windows\system32\HBJXSJ.dll

c:\windows\system32\HBWOW.dll

.

((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))

.

2009-01-20 23:04 . 2009-01-20 23:06 <DIR> d-------- C:\32788R22FWJFW

2009-01-20 22:53 . 2004-08-04 00:56 116,224 --a--c--- c:\windows\system32\dllcache\xrxwiadr.dll

2009-01-20 22:53 . 2001-08-17 22:37 27,648 --a--c--- c:\windows\system32\dllcache\xrxftplt.exe

2009-01-20 22:53 . 2001-08-17 22:36 23,040 --a--c--- c:\windows\system32\dllcache\xrxwbtmp.dll

2009-01-20 22:53 . 2001-08-17 22:36 17,408 --a--c--- c:\windows\system32\dllcache\xrxscnui.dll

2009-01-20 22:53 . 2001-08-17 22:37 4,608 --a--c--- c:\windows\system32\dllcache\xrxflnch.exe

2009-01-20 22:51 . 2001-08-17 13:28 765,884 --a--c--- c:\windows\system32\dllcache\usrti.sys

2009-01-20 22:50 . 2001-08-17 13:28 794,654 --a--c--- c:\windows\system32\dllcache\usr1801.sys

2009-01-20 22:49 . 2001-08-17 22:36 525,568 --a--c--- c:\windows\system32\dllcache\tridxp.dll

2009-01-20 22:48 . 2004-08-10 07:30 185,344 --a--c--- c:\windows\system32\dllcache\thawbrkr.dll

2009-01-20 22:47 . 2001-08-17 12:18 285,760 --a--c--- c:\windows\system32\dllcache\stlnata.sys

2009-01-20 22:46 . 2004-08-10 07:30 456,704 --a--c--- c:\windows\system32\dllcache\smtpsvc.dll

2009-01-20 22:45 . 2001-08-17 22:36 386,560 --a--c--- c:\windows\system32\dllcache\sgiul50.dll

2009-01-20 22:44 . 2001-08-17 22:36 495,616 --a--c--- c:\windows\system32\dllcache\sblfx.dll

2009-01-20 22:43 . 2001-08-17 13:28 714,762 --a--c--- c:\windows\system32\dllcache\r2mdmkxx.sys

2009-01-20 22:42 . 2001-08-17 13:28 899,146 --a--c--- c:\windows\system32\dllcache\r2mdkxga.sys

2009-01-20 22:41 . 2004-08-04 00:56 259,328 --a--c--- c:\windows\system32\dllcache\perm3dd.dll

2009-01-20 22:40 . 2004-08-04 00:56 4,274,816 --a--c--- c:\windows\system32\dllcache\nv4_disp.dll

2009-01-20 22:39 . 2004-08-10 07:30 226,816 --a--c--- c:\windows\system32\dllcache\npdrmv2.dll

2009-01-20 22:38 . 2004-08-04 00:56 1,737,856 --a--c--- c:\windows\system32\dllcache\mtxparhd.dll

2009-01-20 22:37 . 2001-08-17 13:28 802,683 --a--c--- c:\windows\system32\dllcache\ltsm.sys

2009-01-20 22:36 . 2001-08-17 22:36 242,176 --a--c--- c:\windows\system32\dllcache\kdsusd.dll

2009-01-20 22:35 . 2004-08-04 00:56 702,845 --a--c--- c:\windows\system32\dllcache\i81xdnt5.dll

2009-01-20 22:34 . 2004-08-03 22:41 1,041,536 --a--c--- c:\windows\system32\dllcache\hsfdpsp2.sys

2009-01-20 22:33 . 2001-08-17 14:56 1,733,120 --a--c--- c:\windows\system32\dllcache\g400d.dll

2009-01-20 22:32 . 2001-08-17 13:28 595,647 --a--c--- c:\windows\system32\dllcache\es56cvmp.sys

2009-01-20 22:31 . 2001-08-17 13:28 634,134 --a--c--- c:\windows\system32\dllcache\el656ct5.sys

2009-01-20 22:30 . 2001-08-17 12:14 952,007 --a--c--- c:\windows\system32\dllcache\diwan.sys

2009-01-20 22:29 . 2004-08-04 00:56 249,856 --a--c--- c:\windows\system32\dllcache\ctmasetp.dll

2009-01-20 22:28 . 2001-08-17 12:13 980,034 --a--c--- c:\windows\system32\dllcache\cicap.sys

2009-01-20 22:27 . 2001-08-17 13:28 714,698 --a--c--- c:\windows\system32\dllcache\cbmdmkxx.sys

2009-01-20 22:26 . 2001-08-17 13:28 871,388 --a--c--- c:\windows\system32\dllcache\bcmdm.sys

2009-01-20 22:25 . 2004-08-04 00:56 1,888,992 --a--c--- c:\windows\system32\dllcache\ati3duag.dll

2009-01-20 22:24 . 2004-08-10 07:30 2,134,528 --a--c--- c:\windows\system32\dllcache\smtpsnap.dll

2009-01-20 22:23 . 2004-05-13 00:39 876,653 --a--c--- c:\windows\system32\dllcache\fp4awel.dll

2009-01-02 10:40 . 2009-01-02 10:40 <DIR> d-------- C:\!KillBox

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-01-06 21:10 --------- d-----w c:\documents and settings\All Users\Application Data\avg7

2009-01-06 21:08 --------- d-----w c:\documents and settings\Yamileth_Dominguez\Application Data\U3

2008-12-30 17:27 --------- d-----w c:\program files\Spybot - Search & Destroy

2008-12-30 17:27 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy