Computer is Infected with Trojan.downloader and Will Not Delete Via MBAM

bvauilt · #1 12th Apr 2009, 20:07

Hey guys, I've ran SUPERantispyware and MBAM and I just cant seem to get rid of these trojans. I've tried doing the scan on reboot option that MBAM says but the trojans must be blocking it from actually bringing up the scanner like it normally does on reboot. Here are my logs. Help if you can!! :)

MBAM

Malwarebytes' Anti-Malware 1.36
Database version: 1964
Windows 5.1.2600 Service Pack 3

4/12/2009 10:04:23 PM
mbam-log-2009-04-12 (22-04-23).txt

Scan type: Quick Scan
Objects scanned: 80174
Time elapsed: 2 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 3
Registry Values Infected: 4
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{89876561-f3e9-421a-8381-ed30415fef51} (Trojan.Downloader) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{89876561-f3e9-421a-8381-ed30415fef51} (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89876561-f3e9-421a-8381-ed30415fef51} (Trojan.Downloader) -> Delete on reboot.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\autodis.dll (Trojan.Downloader) -> Delete on reboot.

HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:58:51 PM, on 4/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\CSHelper.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=1080529
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6f74-2d53-2644-206d7942484f} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {89876561-F3E9-421A-8381-ED30415FEF51} - C:\WINDOWS\system32\autodis.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {dbc80044-a445-435b-bc74-9c25c1c588a9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [dellsupportcenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Roxio\CinePlayer\DMXLauncher.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mlbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {dfb852a3-47f8-48c4-a200-58cab36fd2a2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: !saswinlogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CopySafe Helper Service (CSHelper) - Unknown owner - C:\WINDOWS\system32\CSHelper.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service (lavasoft ad-aware service) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 9752 bytes

**sjb007** · #2 13th Apr 2009, 04:11

Hi there and welcome to the Computer Juice Forums

I'm Steve and I will be helping you thoughout this fix.

First we need to disable your TeaTimer as it may interfere with the fixes that we need to make.

1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
5) Restart your computer.

Download ResetTeaTimer.bat by right-clicking on the link, and choosing Save As.

* Save it to your Desktop.
* Double-click ResetTeaTimer.zip
* Double-click ResetTeaTimer.bat and click Run to remove all entries set by TeaTimer.

After all of the fixes are complete it is very important that you enable TeaTimer again, I will let you know when it is safe to do so.

A Tutorial for Tea Timer can be found here -> http://russelltexas.com/malware/teatimer.htm

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

bvauilt · #3 13th Apr 2009, 09:54

here is the combo fix log

ComboFix 09-04-13.A2 - Caleb Brandt 2009-04-13 11:48.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2528 [GMT -5:00]
Running from: c:\documents and settings\Caleb Brandt\Desktop\ComboFix.exe
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated)
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
c:\windows\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
c:\windows\system32\gxvxccounter
c:\windows\system32\gxvxciwwxvoukyqhvtafyvxqsgxvwyobmbcac.dll
c:\windows\system32\ovfsthagwnaektsvkxvyyaggsgpcbyccfgsjch.dll
c:\windows\system32\ovfsthkjvidvyrhlofdygxpayeykvgfimnenvq.dat
c:\windows\system32\ovfsthoautlmrhrbsjwbtjchfdnjajvfnkvcpu.dat
c:\windows\system32\ovfsthpwxcfvyggolseebokmxbuseqtlwqfood.dll
c:\windows\system32\ovfsthqhlgicdpbsiamludhrjfllwohgkmgtbo.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_ovfsthmiwmyviwuiygolikkemsgdscudslhsqh
-------\Service_gxvxcserv.sys

((((((((((((((((((((((((( Files Created from 2009-03-13 to 2009-04-13 )))))))))))))))))))))))))))))))
.

2009-04-13 04:42 . 2009-04-13 04:42 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\U3
2009-04-13 03:50 . 2009-04-13 16:48 -------- d-----w C:\QUARANTINE
2009-04-13 03:45 . 2007-10-25 20:06 280 ----a-w c:\windows\system32\epoPGPsdk.dll.sig
2009-04-13 03:45 . 2007-10-25 20:06 1495552 ----a-w c:\windows\system32\epoPGPsdk.dll
2009-04-13 03:44 . 2008-05-23 01:50 33960 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-04-13 03:44 . 2008-05-23 01:50 72936 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 64232 ----a-w c:\windows\system32\drivers\mfeapfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 52104 ----a-w c:\windows\system32\drivers\mfetdik.sys
2009-04-13 03:44 . 2008-05-23 01:50 174952 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-04-13 02:01 . 2009-04-13 02:01 2524 ----a-w C:\autorun.PNF
2009-04-11 02:49 . 2009-04-11 02:49 61440 ----a-w c:\windows\system32\drivers\cxcdjqyt.sys
2009-04-11 02:46 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 02:46 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-04-10 21:20 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 20:59 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 20:58 . 2009-04-10 20:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-10 04:55 . 2009-04-10 04:55 1181022 ----a-w c:\windows\system32\TmpA513508750
2009-04-10 04:36 . 2009-04-10 04:36 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\NetMedia Providers
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Publish Providers
2009-04-10 04:21 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\Sony
2009-03-28 05:32 . 2009-03-28 05:32 1181022 ----a-w c:\windows\system32\TmpA586875
2009-03-28 05:30 . 2009-03-28 05:30 1181022 ----a-w c:\windows\system32\TmpA479968
2009-03-28 05:28 . 2009-03-28 05:28 1181022 ----a-w c:\windows\system32\TmpA359296
2009-03-28 05:25 . 2009-03-28 05:25 1181022 ----a-w c:\windows\system32\TmpA197312
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\PACE Anti-Piracy
2009-03-28 03:50 . 2003-06-20 17:28 1777664 ----a-w c:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-13 16:35 . 2008-06-02 16:58 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-13 03:45 . 2009-04-13 03:45 -------- d-----w c:\program files\Common Files\Cisco Systems
2009-04-13 03:45 . 2009-04-13 03:44 -------- d-----w c:\program files\McAfee
2009-04-13 03:45 . 2008-05-29 17:11 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-04-13 03:44 . 2009-04-13 03:44 -------- d-----w c:\program files\Common Files\McAfee
2009-04-13 03:43 . 2008-12-29 05:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-11 02:51 . 2008-12-29 14:47 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-11 02:47 . 2009-04-11 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 02:02 . 2009-04-11 02:02 -------- d-----w c:\program files\Trend Micro
2009-04-11 01:45 . 2009-04-10 21:38 1512 ----a-w C:\aaw7boot.log
2009-04-10 21:21 . 2008-06-02 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-10 20:58 . 2009-04-10 20:58 -------- d-----w c:\program files\Lavasoft
2009-04-10 20:58 . 2008-06-02 16:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-10 20:54 . 2008-05-29 17:04 -------- d-----w c:\program files\Java
2009-04-10 05:16 . 2009-04-10 04:03 -------- d-----w c:\program files\Audacity
2009-04-10 04:57 . 2009-03-08 20:29 491328 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 04:57 . 2008-06-02 17:08 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\LimeWire
2009-04-10 04:18 . 2009-04-10 04:18 -------- d-----w c:\program files\Sony Setup
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Autodesk
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-05 21:31 . 2008-09-17 21:48 -------- d-----w c:\program files\World of Warcraft Public Test
2009-04-02 03:33 . 2008-06-02 16:54 -------- d-----w c:\program files\World of Warcraft
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\program files\Common Files\PACE Anti-Piracy
2009-03-27 14:07 . 2008-12-09 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-24 17:23 . 2008-06-02 17:08 -------- d-----w c:\program files\LimeWire
2009-03-24 17:14 . 2009-01-06 16:14 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-17 01:33 . 2008-12-29 20:15 34 ----a-w c:\documents and settings\Caleb Brandt\jagex_runescape_preferences.dat
2009-03-12 22:18 . 2009-03-12 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-03-12 22:18 . 2008-06-02 16:46 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\ATI
2009-03-12 22:15 . 2008-05-29 17:06 -------- d-----w c:\program files\ATI Technologies
2009-03-12 22:15 . 2008-05-29 17:06 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 22:12 . 2009-04-10 21:35 -------- d-----w c:\documents and settings\Administrator\Application Data\ATI
2009-03-12 22:06 . 2009-03-12 22:06 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-10 22:28 . 2008-08-27 00:45 930 ----a-w c:\documents and settings\Caleb Brandt\Application Data\wklnhst.dat
2009-03-09 10:19 . 2009-01-07 23:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-09 02:36 . 2008-05-29 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Dell
2009-03-08 20:43 . 2008-06-02 16:46 103632 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-08 20:34 . 2009-03-08 20:31 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-03-08 20:33 . 2009-03-08 20:31 -------- d-----w c:\program files\AutoCAD 2009
2009-03-08 20:29 . 2008-12-09 18:57 -------- d-----w c:\program files\MSBuild
2009-03-08 20:28 . 2009-03-08 20:28 -------- d-----w c:\program files\Reference Assemblies
2009-02-09 11:13 . 2008-10-14 18:58 1846784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 17:51 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-04 07:27 . 2008-05-29 16:48 3488768 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2009-02-04 05:57 . 2008-09-24 02:09 11702272 ----a-w c:\windows\system32\atioglxx.dll
2009-02-04 05:03 . 2008-05-29 16:48 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-04 04:56 . 2008-05-29 16:48 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-04 04:55 . 2008-05-29 16:48 324096 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-04 04:44 . 2008-05-29 16:48 196608 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-04 04:44 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-04 04:43 . 2008-05-29 16:48 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-04 04:43 . 2008-05-29 16:48 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-04 04:43 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-04 04:41 . 2008-05-29 16:48 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-04 04:40 . 2008-05-29 16:48 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-04 04:30 . 2008-05-29 16:48 3884768 ----a-w c:\windows\system32\ati3duag.dll
2009-02-04 04:14 . 2008-05-29 16:48 2645504 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-04 03:58 . 2008-09-24 01:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-04 03:54 . 2008-05-29 16:48 471040 ----a-w c:\windows\system32\atikvmag.dll
2009-02-04 03:53 . 2008-09-24 01:19 122880 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-04 03:52 . 2008-05-29 16:48 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-04 03:46 . 2008-05-29 16:48 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-04 03:44 . 2008-05-29 16:48 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-04 02:43 . 2009-02-04 02:43 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-04 02:42 . 2009-02-04 02:42 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-04 02:40 . 2009-02-04 02:40 3244032 ----a-w c:\windows\system32\aticaldd.dll
2009-02-04 02:05 . 2008-11-10 06:45 593920 ------w c:\windows\system32\ati2sgag.exe
2009-01-23 03:50 . 2009-01-23 03:50 1939 ----a-w C:\temp.png
2008-08-14 06:02 . 2008-08-14 06:02 22328 ----a-w c:\documents and settings\Caleb Brandt\Application Data\PnkBstrK.sys
2008-07-01 20:43 . 2008-07-01 20:42 12408864 ----a-w c:\documents and settings\Caleb Brandt\WoW-2.4.2.8278-to-0.4.3.8478-enUS-patch.exe
2008-06-02 16:46 . 2008-06-02 16:46 135 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\fusioncache.dat
2008-05-29 17:21 . 2009-04-10 21:35 33416 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-05-29 17:21 . 2009-04-10 21:35 128 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2007-11-22 04:2007-11-19 14:44 06:50 . c:\program files\mozilla firefox\plugins\SetupHelper.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-02 68856]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2006-07-26 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-22 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]

c:\documents and settings\Caleb Brandt\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-29 12:16 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R0 rtrckic;rtrckic; [x]
R3 sasenum;sasenum;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 hmlztxtx;hmlztxtx;c:\windows\system32\drivers\hmlztxtx.sys [2004-08-04 23424]
S0 lbd;lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 sasdifsv;sasdifsv;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2008-10-30 192512]
S2 lavasoft ad-aware service;lavasoft ad-aware service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-09-23 84992]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\
\Shell\Open\command - RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe0ad4c4-27ce-11de-85b9-001d099e8832}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 14:06]

2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{89876561-F3E9-421A-8381-ED30415FEF51} - c:\windows\system32\autodis.dll
HKCU-Run-SUPERAntiSpyware - c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Caleb Brandt\Application Data\Mozilla\Firefox\Profiles\5ho2rf82.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCopysafe35.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 11:51
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll
.
Completion time: 2009-04-13 11:52
ComboFix-quarantined-files.txt 2009-04-13 16:52
ComboFix2.txt 2009-01-07 22:39

Pre-Run: 178,263,318,528 bytes free
Post-Run: 178,606,923,776 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
265 --- E O F --- 2009-03-13 08:01

**sjb007** · #4 13th Apr 2009, 12:27

Hi there

Please ensure spybot's tea timer is not running

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Skipfix::

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\C]

Driver::
rtrckic

RegLock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\Curr entVersion\Run\OptionalComponents\MSFS]

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

=======================================

Once done....

Please download ATF Cleaner by Atribune.
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner.

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

This animation will guide you through the process:

**Note**

To optimize scanning time and produce a more sensible report for review:
Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan. You may disconnect from the internet once you begin the scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

=======================================

Go to Start menu > Select Run and copy/paste the following into the Run box and click OK:

C:\Qoobox\Add-Remove Programs.txt

A text file should open. Please post the contents of that file in your next reply.

=======================================

Please post back with:
The new combofix log
The log from Kaspersky
Add-Remove Programs.txt
Update me on how your system is running now....

bvauilt · #5 13th Apr 2009, 19:24

Combo Fix:

ComboFix 09-04-13.A2 - Caleb Brandt 2009-04-13 19:48.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2587 [GMT -5:00]
Running from: c:\documents and settings\Caleb Brandt\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Caleb Brandt\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated)
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-13 04:42 . 2009-04-13 04:42 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\U3
2009-04-13 03:50 . 2009-04-13 16:50 -------- d-----w C:\QUARANTINE
2009-04-13 03:45 . 2007-10-25 20:06 280 ----a-w c:\windows\system32\epoPGPsdk.dll.sig
2009-04-13 03:45 . 2007-10-25 20:06 1495552 ----a-w c:\windows\system32\epoPGPsdk.dll
2009-04-13 03:44 . 2008-05-23 01:50 33960 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-04-13 03:44 . 2008-05-23 01:50 72936 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 64232 ----a-w c:\windows\system32\drivers\mfeapfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 52104 ----a-w c:\windows\system32\drivers\mfetdik.sys
2009-04-13 03:44 . 2008-05-23 01:50 174952 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-04-13 02:01 . 2009-04-13 02:01 2524 ----a-w C:\autorun.PNF
2009-04-11 02:49 . 2009-04-11 02:49 61440 ----a-w c:\windows\system32\drivers\cxcdjqyt.sys
2009-04-11 02:46 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 02:46 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-04-10 21:20 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 20:59 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 20:58 . 2009-04-10 20:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-10 04:55 . 2009-04-10 04:55 1181022 ----a-w c:\windows\system32\TmpA513508750
2009-04-10 04:36 . 2009-04-10 04:36 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\NetMedia Providers
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Publish Providers
2009-04-10 04:21 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\Sony
2009-03-28 05:32 . 2009-03-28 05:32 1181022 ----a-w c:\windows\system32\TmpA586875
2009-03-28 05:30 . 2009-03-28 05:30 1181022 ----a-w c:\windows\system32\TmpA479968
2009-03-28 05:28 . 2009-03-28 05:28 1181022 ----a-w c:\windows\system32\TmpA359296
2009-03-28 05:25 . 2009-03-28 05:25 1181022 ----a-w c:\windows\system32\TmpA197312
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\PACE Anti-Piracy
2009-03-28 03:50 . 2003-06-20 17:28 1777664 ----a-w c:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 00:34 . 2008-06-02 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 16:35 . 2008-06-02 16:58 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-13 03:45 . 2009-04-13 03:45 -------- d-----w c:\program files\Common Files\Cisco Systems
2009-04-13 03:45 . 2009-04-13 03:44 -------- d-----w c:\program files\McAfee
2009-04-13 03:45 . 2008-05-29 17:11 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-04-13 03:44 . 2009-04-13 03:44 -------- d-----w c:\program files\Common Files\McAfee
2009-04-13 03:43 . 2008-12-29 05:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-11 02:51 . 2008-12-29 14:47 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-11 02:47 . 2009-04-11 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 02:02 . 2009-04-11 02:02 -------- d-----w c:\program files\Trend Micro
2009-04-11 01:45 . 2009-04-10 21:38 1512 ----a-w C:\aaw7boot.log
2009-04-10 20:58 . 2009-04-10 20:58 -------- d-----w c:\program files\Lavasoft
2009-04-10 20:58 . 2008-06-02 16:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-10 20:54 . 2008-05-29 17:04 -------- d-----w c:\program files\Java
2009-04-10 05:16 . 2009-04-10 04:03 -------- d-----w c:\program files\Audacity
2009-04-10 04:57 . 2009-03-08 20:29 491328 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 04:57 . 2008-06-02 17:08 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\LimeWire
2009-04-10 04:18 . 2009-04-10 04:18 -------- d-----w c:\program files\Sony Setup
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Autodesk
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-05 21:31 . 2008-09-17 21:48 -------- d-----w c:\program files\World of Warcraft Public Test
2009-04-02 03:33 . 2008-06-02 16:54 -------- d-----w c:\program files\World of Warcraft
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\program files\Common Files\PACE Anti-Piracy
2009-03-27 14:07 . 2008-12-09 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-24 17:23 . 2008-06-02 17:08 -------- d-----w c:\program files\LimeWire
2009-03-24 17:14 . 2009-01-06 16:14 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-17 01:33 . 2008-12-29 20:15 34 ----a-w c:\documents and settings\Caleb Brandt\jagex_runescape_preferences.dat
2009-03-12 22:18 . 2009-03-12 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-03-12 22:18 . 2008-06-02 16:46 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\ATI
2009-03-12 22:15 . 2008-05-29 17:06 -------- d-----w c:\program files\ATI Technologies
2009-03-12 22:15 . 2008-05-29 17:06 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 22:12 . 2009-04-10 21:35 -------- d-----w c:\documents and settings\Administrator\Application Data\ATI
2009-03-12 22:06 . 2009-03-12 22:06 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-10 22:28 . 2008-08-27 00:45 930 ----a-w c:\documents and settings\Caleb Brandt\Application Data\wklnhst.dat
2009-03-09 10:19 . 2009-01-07 23:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-09 02:36 . 2008-05-29 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Dell
2009-03-08 20:43 . 2008-06-02 16:46 103632 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-08 20:34 . 2009-03-08 20:31 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-03-08 20:33 . 2009-03-08 20:31 -------- d-----w c:\program files\AutoCAD 2009
2009-03-08 20:29 . 2008-12-09 18:57 -------- d-----w c:\program files\MSBuild
2009-03-08 20:28 . 2009-03-08 20:28 -------- d-----w c:\program files\Reference Assemblies
2009-02-09 11:13 . 2008-10-14 18:58 1846784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 17:51 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-04 07:27 . 2008-05-29 16:48 3488768 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2009-02-04 05:57 . 2008-09-24 02:09 11702272 ----a-w c:\windows\system32\atioglxx.dll
2009-02-04 05:03 . 2008-05-29 16:48 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-04 04:56 . 2008-05-29 16:48 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-04 04:55 . 2008-05-29 16:48 324096 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-04 04:44 . 2008-05-29 16:48 196608 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-04 04:44 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-04 04:43 . 2008-05-29 16:48 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-04 04:43 . 2008-05-29 16:48 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-04 04:43 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-04 04:41 . 2008-05-29 16:48 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-04 04:40 . 2008-05-29 16:48 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-04 04:30 . 2008-05-29 16:48 3884768 ----a-w c:\windows\system32\ati3duag.dll
2009-02-04 04:14 . 2008-05-29 16:48 2645504 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-04 03:58 . 2008-09-24 01:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-04 03:54 . 2008-05-29 16:48 471040 ----a-w c:\windows\system32\atikvmag.dll
2009-02-04 03:53 . 2008-09-24 01:19 122880 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-04 03:52 . 2008-05-29 16:48 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-04 03:46 . 2008-05-29 16:48 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-04 03:44 . 2008-05-29 16:48 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-04 02:43 . 2009-02-04 02:43 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-04 02:42 . 2009-02-04 02:42 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-04 02:40 . 2009-02-04 02:40 3244032 ----a-w c:\windows\system32\aticaldd.dll
2009-02-04 02:05 . 2008-11-10 06:45 593920 ------w c:\windows\system32\ati2sgag.exe
2009-01-23 03:50 . 2009-01-23 03:50 1939 ----a-w C:\temp.png
2008-08-14 06:02 . 2008-08-14 06:02 22328 ----a-w c:\documents and settings\Caleb Brandt\Application Data\PnkBstrK.sys
2008-07-01 20:43 . 2008-07-01 20:42 12408864 ----a-w c:\documents and settings\Caleb Brandt\WoW-2.4.2.8278-to-0.4.3.8478-enUS-patch.exe
2008-06-02 16:46 . 2008-06-02 16:46 135 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\fusioncache.dat
2008-05-29 17:21 . 2009-04-10 21:35 33416 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-05-29 17:21 . 2009-04-10 21:35 128 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2007-11-22 04:2007-11-19 14:44 06:50 . c:\program files\mozilla firefox\plugins\SetupHelper.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-13_11.51.31.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 00:43 . 2009-04-14 00:43 16384 c:\windows\temp\Perflib_Perfdata_4e8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89876561-F3E9-421A-8381-ED30415FEF51}]
c:\windows\system32\autodis.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-02 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2006-07-26 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-22 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]

c:\documents and settings\Caleb Brandt\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-29 12:16 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R0 rtrckic;rtrckic; [x]
R2 lavasoft ad-aware service;lavasoft ad-aware service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
R3 sasenum;sasenum;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 hmlztxtx;hmlztxtx;c:\windows\system32\drivers\hmlztxtx.sys [2004-08-04 23424]
S0 lbd;lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 sasdifsv;sasdifsv;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2008-10-30 192512]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-09-23 84992]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\
\Shell\Open\command - RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe0ad4c4-27ce-11de-85b9-001d099e8832}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 14:06]

2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Caleb Brandt\Application Data\Mozilla\Firefox\Profiles\5ho2rf82.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCopysafe35.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-13 19:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2776)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-04-13 19:50
ComboFix-quarantined-files.txt 2009-04-14 00:50
ComboFix2.txt 2009-04-14 00:38
ComboFix3.txt 2009-04-13 16:52
ComboFix4.txt 2009-01-07 22:39

Pre-Run: 178,594,275,328 bytes free
Post-Run: 178,576,703,488 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
268 --- E O F --- 2009-03-13 08:01

Kaspersky:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, April 13, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Tuesday, April 14, 2009 01:41:07
Records in database: 2041925
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\

Scan statistics:
Files scanned: 90377
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 01:15:25

File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd_.sys.zip Infected: Rootkit.Win32.Agent.iuh 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\gxvxciwwxvoukyqhvtafyvxqsgxvwyobmbcac.dll.vir Infected: Trojan.Win32.Agent2.hoq 1

The selected area was scanned.

Add-Remove programs:

2007 Microsoft Office Suite Service Pack 1 (SP1)
Ad-Aware
Adobe Anchor Service CS3
Adobe Asset Services CS3
Adobe Bridge CS3
Adobe Bridge Start Meeting
Adobe Camera Raw 4.0
Adobe CMaps
Adobe Color - Photoshop Specific
Adobe Color Common Settings
Adobe Color EU Extra Settings
Adobe Color JA Extra Settings
Adobe Color NA Recommended Settings
Adobe Default Language CS3
Adobe Device Central CS3
Adobe ExtendScript Toolkit 2
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Fonts All
Adobe Help Viewer CS3
Adobe Linguistics CS3
Adobe PDF Library Files
Adobe Photoshop CS3
Adobe Reader 8.1.3
Adobe Setup
Adobe Shockwave Player
Adobe Stock Photos CS3
Adobe Type Support
Adobe Update Manager CS3
Adobe Version Cue CS3 Client
Adobe WinSoft Linguistics Plugin
Adobe XMP Panels CS3
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Catalyst Control Center
ATI Display Driver
AutoCAD 2009 - English
AutoUpdate
BitLord 1.1
Bonjour
Browser Address Error Redirector
Catalyst Control Center - Branding
Catalyst Control Center Core Implementation
Catalyst Control Center Graphics Full Existing
Catalyst Control Center Graphics Full New
Catalyst Control Center Graphics Light
Catalyst Control Center Graphics Previews Common
Catalyst Control Center HydraVision Full
ccc-core-preinstall
ccc-core-static
ccc-utility
CCC Help English
Compatibility Pack for the 2007 Office system
Copysafe Web Plugin
Critical Update for Windows Media Player 11 (KB959772)
Curse Client
Dell DataSafe Online
Dell Driver Reset Tool
Dell Support Center (Support Software)
Dell System Restore
DivX Codec
DivX Converter
DivX Player
DivX Web Player
Documentation & Support Launcher
Express Burn
Games, Music, & Photos Launcher
Google Toolbar for Internet Explorer
GoToAssist 8.0.0.514
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel(R) PRO Network Connections Drivers
Internet Service Offers Launcher
iTunes
Java(TM) 6 Update 13
LimeWire 5.1.2
Malwarebytes' Anti-Malware
McAfee VirusScan Enterprise
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Software Update for Web Folders (English) 12
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Mozilla Firefox (3.0.8)
MSXML 6.0 Parser (KB933579)
Musicmatch for Windows Media Player
Opera 9.63
PDF Settings
QuickTime
Realtek High Definition Audio Driver
Roxio CinePlayer Surround
Roxio Creator Audio
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler 3
Roxio Update Manager
Safari
SearchAssist
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB958439)
Security Update for Microsoft Office Excel 2007 (KB958437)
Security Update for Microsoft Office OneNote 2007 (KB950130)
Security Update for Microsoft Office PowerPoint 2007 (KB951338)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Skins
Spybot - Search & Destroy
SUPERAntiSpyware Free Edition
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Office 2007 (KB946691)
Update for Outlook 2007 Junk Email Filter (kb962871)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Ventrilo Client
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
World of Warcraft
World of Warcraft Public Test

My computer is running well the only thing I have now is when using google I get redirected to a different link than the one I click on. Probably something to do with that Rootkit?

**sjb007** · #6 14th Apr 2009, 05:46

Hi there

The rootkit what has been picked up by kaspersky has already been quarantined by combofix, however I want to run a gmer rootkit scan later in this fix to check for other potential rootkits.

Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.

There is a newer version of Adobe Acrobat Reader available.

Please go to this link Adobe Acrobat Reader Download Link
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts

When the installation is complete go to Add/Remove Programs and uninstall all previous versions.

Once done....

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Killall::

File::
c:\windows\system32\drivers\cxcdjqyt.sys
c:\windows\system32\drivers\hmlz txtx.sys
C:\autorun.PNF
c:\windows\system32\TmpA513508750
c:\windows\system32\SelfDel.bat
c:\windows\system32\TmpA586875
c:\windows\system32\TmpA479968
c:\windows\system32\TmpA359296
c:\windows\system32\TmpA197312

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\C]

Driver::
cxcdjqyt
rtrckic
hmlztxtx

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO.

Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following ...
- Sections
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
Save it where you can easily find it, such as your desktop and copy and paste this in your next reply

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries

Post back with both logs in your next reply

bvauilt · #7 14th Apr 2009, 14:20

There is a problem when I try to remove/update Adobe reader. It reads:

ERROR 1402. COULD NOT OPEN KEY.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponants\MSFS.

ComboFix log:

ComboFix 09-04-13.A2 - Caleb Brandt 2009-04-14 11:40.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2451 [GMT -5:00]
Running from: c:\documents and settings\Caleb Brandt\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Caleb Brandt\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
C:\autorun.PNF
c:\windows\system32\drivers\cxcdjqyt.sys
c:\windows\system32\drivers\hmlz txtx.sys
c:\windows\system32\SelfDel.bat
c:\windows\system32\TmpA197312
c:\windows\system32\TmpA359296
c:\windows\system32\TmpA479968
c:\windows\system32\TmpA513508750
c:\windows\system32\TmpA586875
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.PNF
c:\windows\system32\drivers\cxcdjqyt.sys
c:\windows\system32\SelfDel.bat
c:\windows\system32\TmpA197312
c:\windows\system32\TmpA359296
c:\windows\system32\TmpA479968
c:\windows\system32\TmpA513508750
c:\windows\system32\TmpA586875

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_hmlztxtx
-------\Service_hmlztxtx
-------\Service_rtrckic

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-14 16:34 . 2009-04-14 16:39 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-13 04:42 . 2009-04-13 04:42 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\U3
2009-04-13 03:50 . 2009-04-13 16:50 -------- d-----w C:\QUARANTINE
2009-04-13 03:45 . 2007-10-25 20:06 280 ----a-w c:\windows\system32\epoPGPsdk.dll.sig
2009-04-13 03:45 . 2007-10-25 20:06 1495552 ----a-w c:\windows\system32\epoPGPsdk.dll
2009-04-13 03:44 . 2008-05-23 01:50 33960 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-04-13 03:44 . 2008-05-23 01:50 72936 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 64232 ----a-w c:\windows\system32\drivers\mfeapfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 52104 ----a-w c:\windows\system32\drivers\mfetdik.sys
2009-04-13 03:44 . 2008-05-23 01:50 174952 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-04-11 02:46 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 02:46 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-04-10 21:20 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 20:59 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 20:58 . 2009-04-10 20:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\NetMedia Providers
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Publish Providers
2009-04-10 04:21 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\Sony
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\PACE Anti-Piracy
2009-03-28 03:50 . 2003-06-20 17:28 1777664 ----a-w c:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 16:44 . 2009-04-14 16:44 1454 ----a-w C:\avenger.txt
2009-04-14 16:39 . 2009-04-14 16:34 -------- d-----w c:\program files\NOS
2009-04-14 16:38 . 2008-05-29 17:10 -------- d-----w c:\program files\Common Files\Adobe
2009-04-14 03:11 . 2008-06-02 16:58 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-14 00:34 . 2008-06-02 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 03:45 . 2009-04-13 03:45 -------- d-----w c:\program files\Common Files\Cisco Systems
2009-04-13 03:45 . 2009-04-13 03:44 -------- d-----w c:\program files\McAfee
2009-04-13 03:45 . 2008-05-29 17:11 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-04-13 03:44 . 2009-04-13 03:44 -------- d-----w c:\program files\Common Files\McAfee
2009-04-13 03:43 . 2008-12-29 05:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-11 02:51 . 2008-12-29 14:47 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-11 02:47 . 2009-04-11 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 02:02 . 2009-04-11 02:02 -------- d-----w c:\program files\Trend Micro
2009-04-11 01:45 . 2009-04-10 21:38 1512 ----a-w C:\aaw7boot.log
2009-04-10 20:58 . 2009-04-10 20:58 -------- d-----w c:\program files\Lavasoft
2009-04-10 20:58 . 2008-06-02 16:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-10 20:54 . 2008-05-29 17:04 -------- d-----w c:\program files\Java
2009-04-10 05:16 . 2009-04-10 04:03 -------- d-----w c:\program files\Audacity
2009-04-10 04:57 . 2009-03-08 20:29 491328 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 04:57 . 2008-06-02 17:08 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\LimeWire
2009-04-10 04:18 . 2009-04-10 04:18 -------- d-----w c:\program files\Sony Setup
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Autodesk
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-05 21:31 . 2008-09-17 21:48 -------- d-----w c:\program files\World of Warcraft Public Test
2009-04-02 03:33 . 2008-06-02 16:54 -------- d-----w c:\program files\World of Warcraft
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\program files\Common Files\PACE Anti-Piracy
2009-03-27 14:07 . 2008-12-09 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-24 17:23 . 2008-06-02 17:08 -------- d-----w c:\program files\LimeWire
2009-03-24 17:14 . 2009-01-06 16:14 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-17 01:33 . 2008-12-29 20:15 34 ----a-w c:\documents and settings\Caleb Brandt\jagex_runescape_preferences.dat
2009-03-12 22:18 . 2009-03-12 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-03-12 22:18 . 2008-06-02 16:46 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\ATI
2009-03-12 22:15 . 2008-05-29 17:06 -------- d-----w c:\program files\ATI Technologies
2009-03-12 22:15 . 2008-05-29 17:06 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 22:12 . 2009-04-10 21:35 -------- d-----w c:\documents and settings\Administrator\Application Data\ATI
2009-03-12 22:06 . 2009-03-12 22:06 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-10 22:28 . 2008-08-27 00:45 930 ----a-w c:\documents and settings\Caleb Brandt\Application Data\wklnhst.dat
2009-03-09 10:19 . 2009-01-07 23:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-09 02:36 . 2008-05-29 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Dell
2009-03-08 20:43 . 2008-06-02 16:46 103632 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-08 20:34 . 2009-03-08 20:31 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-03-08 20:33 . 2009-03-08 20:31 -------- d-----w c:\program files\AutoCAD 2009
2009-03-08 20:29 . 2008-12-09 18:57 -------- d-----w c:\program files\MSBuild
2009-03-08 20:28 . 2009-03-08 20:28 -------- d-----w c:\program files\Reference Assemblies
2009-02-09 11:13 . 2008-10-14 18:58 1846784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 17:51 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-04 07:27 . 2008-05-29 16:48 3488768 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2009-02-04 05:57 . 2008-09-24 02:09 11702272 ----a-w c:\windows\system32\atioglxx.dll
2009-02-04 05:03 . 2008-05-29 16:48 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-04 04:56 . 2008-05-29 16:48 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-04 04:55 . 2008-05-29 16:48 324096 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-04 04:44 . 2008-05-29 16:48 196608 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-04 04:44 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-04 04:43 . 2008-05-29 16:48 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-04 04:43 . 2008-05-29 16:48 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-04 04:43 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-04 04:41 . 2008-05-29 16:48 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-04 04:40 . 2008-05-29 16:48 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-04 04:30 . 2008-05-29 16:48 3884768 ----a-w c:\windows\system32\ati3duag.dll
2009-02-04 04:14 . 2008-05-29 16:48 2645504 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-04 03:58 . 2008-09-24 01:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-04 03:54 . 2008-05-29 16:48 471040 ----a-w c:\windows\system32\atikvmag.dll
2009-02-04 03:53 . 2008-09-24 01:19 122880 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-04 03:52 . 2008-05-29 16:48 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-04 03:46 . 2008-05-29 16:48 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-04 03:44 . 2008-05-29 16:48 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-04 02:43 . 2009-02-04 02:43 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-04 02:42 . 2009-02-04 02:42 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-04 02:40 . 2009-02-04 02:40 3244032 ----a-w c:\windows\system32\aticaldd.dll
2009-02-04 02:05 . 2008-11-10 06:45 593920 ------w c:\windows\system32\ati2sgag.exe
2009-01-23 03:50 . 2009-01-23 03:50 1939 ----a-w C:\temp.png
2008-08-14 06:02 . 2008-08-14 06:02 22328 ----a-w c:\documents and settings\Caleb Brandt\Application Data\PnkBstrK.sys
2008-07-01 20:43 . 2008-07-01 20:42 12408864 ----a-w c:\documents and settings\Caleb Brandt\WoW-2.4.2.8278-to-0.4.3.8478-enUS-patch.exe
2008-06-02 16:46 . 2008-06-02 16:46 135 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\fusioncache.dat
2008-05-29 17:21 . 2009-04-10 21:35 33416 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-05-29 17:21 . 2009-04-10 21:35 128 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2007-11-22 04:2007-11-19 14:44 06:50 . c:\program files\mozilla firefox\plugins\SetupHelper.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-13_11.51.31.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 16:44 . 2009-04-14 16:44 16384 c:\windows\temp\Perflib_Perfdata_468.dat
+ 2009-04-14 16:43 . 2005-10-21 01:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89876561-F3E9-421A-8381-ED30415FEF51}]
c:\windows\system32\autodis.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-02 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-13 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-03 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2006-07-26 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-22 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]

c:\documents and settings\Caleb Brandt\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 12:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-29 12:16 10536 c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=

R3 sasenum;sasenum;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 hmlztxtx;hmlztxtx;c:\windows\system32\drivers\hmlztxtx.sys [2004-08-04 23424]
S0 lbd;lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 sasdifsv;sasdifsv;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2008-10-30 192512]
S2 lavasoft ad-aware service;lavasoft ad-aware service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-09-23 84992]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - HMLZTXTX

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\
\Shell\Open\command - RECYCLER\S-1-0-85-100013187-100008332-100024652-5811.com c:\

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe0ad4c4-27ce-11de-85b9-001d099e8832}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 14:06]

2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Caleb Brandt\Application Data\Mozilla\Firefox\Profiles\5ho2rf82.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCopysafe35.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 11:45
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange"="1"
"Installed"="1"
@=""

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed"="1"
@=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(3152)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\searchprotocolhost.exe
c:\windows\system32\searchfilterhost.exe
.
**************************************************************************
.
Completion time: 2009-04-14 11:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-14 16:50
ComboFix2.txt 2009-04-14 00:50
ComboFix3.txt 2009-04-14 00:38
ComboFix4.txt 2009-04-13 16:52
ComboFix5.txt 2009-04-14 16:40

Pre-Run: 178,341,580,800 bytes free
Post-Run: 178,221,936,640 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
320 --- E O F --- 2009-03-13 08:01

GMER LOG:

GMER 1.0.15.14966 - http://www.gmer.net
Rootkit scan 2009-04-14 16:17:36
Windows 5.1.2600 Service Pack 3

---- System - GMER 1.0.15 ----

SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwCreateKey [0xBA10887E]
SSDT sphq.sys ZwEnumerateKey [0xB9EC6CA2]
SSDT sphq.sys ZwEnumerateValueKey [0xB9EC7030]
SSDT sphq.sys ZwOpenKey [0xB9EA80C0]
SSDT sphq.sys ZwQueryKey [0xB9EC7108]
SSDT sphq.sys ZwQueryValueKey [0xB9EC6F88]
SSDT Lbd.sys (Boot Driver/Lavasoft AB) ZwSetValueKey [0xBA108C10]

INT 0x73 ? 8AF9DBF8
INT 0x73 ? 8AF9DBF8
INT 0x73 ? 8AF9DBF8
INT 0x73 ? 8AF9DBF8
INT 0x73 ? 8AF29BF8
INT 0x73 ? 8AF29BF8
INT 0x73 ? 8AF9DBF8
INT 0x84 ? 8AF29BF8
INT 0x94 ? 8AF29BF8
INT 0xA4 ? 8AF29BF8

Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteKey [0xA91CEA54]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwDeleteValueKey [0xA91CEA80]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwRenameKey [0xA91CEA6A]
Code \SystemRoot\system32\drivers\mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.) ZwTerminateProcess [0xA91CEAAC]
Code \??\C:\DOCUME~1\CALEBB~1\LOCALS~1\Temp\catchme.sys pIofCallDriver

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs 8AF281F8

AttachedDevice \FileSystem\Ntfs \Ntfs mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \FileSystem\Fastfat \FatCdrom 89A9C1F8

AttachedDevice \Driver\Tcpip \Device\Ip mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\NetBT \Device\NetBT_Tcpip_{DD395220-A3CD-4525-B125-1FDA6D75FFF2} 8A489500
Device \Driver\usbuhci \Device\USBPDO-0 8AD4B1F8
Device \Driver\usbehci \Device\USBPDO-1 8AD151F8
Device \Driver\usbuhci \Device\USBPDO-2 8AD4B1F8
Device \Driver\usbuhci \Device\USBPDO-3 8AD4B1F8
Device \Driver\usbuhci \Device\USBPDO-4 8AD4B1F8

AttachedDevice \Driver\Tcpip \Device\Tcp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\usbuhci \Device\USBPDO-5 8AD4B1F8
Device \Driver\PCI_PNP7072 \Device\00000049 sphq.sys
Device \Driver\usbehci \Device\USBPDO-6 8AD151F8
Device \Driver\sptd \Device\919127072 sphq.sys
Device \Driver\usbuhci \Device\USBPDO-7 8AD4B1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 8AF2A1F8
Device \Driver\Ftdisk \Device\HarddiskVolume2 8AF2A1F8
Device \Driver\Cdrom \Device\CdRom0 8ACCC500
Device \Driver\Cdrom \Device\CdRom1 8ACCC500
Device \Driver\Ftdisk \Device\HarddiskVolume3 8AF2A1F8
Device \Driver\NetBT \Device\NetBt_Wins_Export 8A489500
Device \Driver\NetBT \Device\NetbiosSmb 8A489500

AttachedDevice \Driver\Tcpip \Device\Udp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice \Driver\Tcpip \Device\RawIp mfetdik.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device \Driver\usbuhci \Device\USBFDO-0 8AD4B1F8
Device \Driver\usbuhci \Device\USBFDO-1 8AD4B1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8AC61500
Device \Driver\usbuhci \Device\USBFDO-2 8AD4B1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8AC61500
Device \Driver\usbehci \Device\USBFDO-3 8AD151F8
Device \Driver\usbuhci \Device\USBFDO-4 8AD4B1F8
Device \Driver\Ftdisk \Device\FtControl 8AF2A1F8
Device \Driver\usbuhci \Device\USBFDO-5 8AD4B1F8
Device \Driver\usbuhci \Device\USBFDO-6 8AD4B1F8
Device \Driver\usbehci \Device\USBFDO-7 8AD151F8
Device \Driver\agfdnkbp \Device\Scsi\agfdnkbp1Port4Path0Target0Lun0 8AC991F8
Device \Driver\agfdnkbp \Device\Scsi\agfdnkbp1 8AC991F8
Device \FileSystem\Fastfat \Fat 89A9C1F8

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat mfehidk.sys (Host Intrusion Detection Link Driver/McAfee, Inc.)

Device \FileSystem\Cdfs \Cdfs 8A39F500

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@imagepath \systemroot\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules@gxvxcserv \\?\globalroot\systemroot\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
Reg HKLM\SYSTEM\ControlSet001\Services\gxvxcserv.sys\modules@gxvxcl \\?\globalroot\systemroot\system32\gxvxciwwxvoukyqhvtafyvxqsgxvwyobmbcac.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh@imagepath \systemroot\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh@inst 0
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@ver icv060409
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@cid 01
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@bid 1421049472-237912401-1248710768-2720550489
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@aid 303617
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@sid 203
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@feed 0x22 0x64 0x78 0x36 ...
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main@cmddelay 14401
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\delete
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\ff
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\ff@extension \\?\C:\Program Files\Mozilla Firefox\extensions\{C65E1F81-8E49-4EB7-B392-B8B166EE024D}
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\ff@version 1
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\injector
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\injector@iexplore.exe ovfsthwi.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\injector@explorer.exe ovfsthff.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\main\tasks
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsth.sys \systemroot\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsth.dll \systemroot\system32\ovfsthpwxcfvyggolseebokmxbuseqtlwqfood.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsthlog.dat \systemroot\system32\ovfsthkjvidvyrhlofdygxpayeykvgfimnenvq.dat
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsthwi.dll \systemroot\system32\ovfsthqhlgicdpbsiamludhrjfllwohgkmgtbo.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsthff.dll \systemroot\system32\ovfsthagwnaektsvkxvyyaggsgpcbyccfgsjch.dll
Reg HKLM\SYSTEM\ControlSet001\Services\ovfsthmiwmyviwuiygolikkemsgdscudslhsqh\modules@ovfsth.dat \systemroot\system32\ovfsthoautlmrhrbsjwbtjchfdnjajvfnkvcpu.dat
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0x79 0x87 0x92 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x6A 0x7C 0x0D 0x4C ...
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC6 0x5F 0x27 0x27 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0x79 0x87 0x92 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x6A 0x7C 0x0D 0x4C ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC6 0x5F 0x27 0x27 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0x79 0x87 0x92 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x6A 0x7C 0x0D 0x4C ...
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xFF 0x23 0xF6 0x4B ...
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 2
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 35
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 4
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceType 7
Reg HKLM\SYSTEM\controlset004\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties@DeviceCharacteristics 256
Reg HKLM\SYSTEM\controlset004\Services\MRxDAV\EncryptedDirectories@
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0x79 0x87 0x92 ...
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x6A 0x7C 0x0D 0x4C ...
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\controlset004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC6 0x5F 0x27 0x27 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL@
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@NoChange 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI@
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@Installed 1
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS@

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\config\software.LOG (size mismatch) 1024/24576 bytes

---- EOF - GMER 1.0.15 ----

**sjb007** · #8 14th Apr 2009, 16:10

Hi there

One of the files detected in your latest logs is a known password stealer trojan.

Backdoor Trojans, IRCBots and Infostealers are very dangerous because they provide a means of accessing a computer system that bypasses security mechanisms and steal sensitive information like passwords, personal and financial data which they send back to the hacker. Remote attackers use backdoor Trojans as part of an exploit to to gain unauthorized access to a computer and take control of it without your knowledge.

If your computer was used for online banking, has credit card information or other sensitive data on it, you should immediately disconnect from the Internet until your system is cleaned.
All passwords should be changed immediately to include those used for banking, email, eBay and forums. You should consider them to be compromised. They should be changed by using a different computer and not the infected one. If not, an attacker may get the new passwords and transaction information. Banking and credit card institutions should be notified of the possible security breach.

P2P - I see you have P2P software ( BitLord/Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here and here.

I would strongly recommend that you uninstall them. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Code:

http://www.computer-juice.com/forums/f49/computer-infected-trojan-downloader-will-not-delete-via-mbam-22999/#post108109
Killall::

Collect::
c:\windows\system32\gxvxciwwxvoukyqhvtafyvxqsgxvwyobmbcac.dll
c:\windows\system32\ovfsthagwnaektsvkxvyyaggsgpcbyccfgsjch.dll
c:\windows\system32\ovfsthpwxcfvyggolseebokmxbuseqtlwqfood.dll
c:\windows\system32\ovfsthqhlgicdpbsiamludhrjfllwohgkmgtbo.dll
c:\windows\system32\ovfsthagwnaektsvkxvyyaggsgpcbyccfgsjch.dll

File::
c:\windows\system32\autodis.dll
c:\windows\system32\drivers\hmlztxtx.sys
c:\windows\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
c:\windows\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
c:\windows\system32\ovfsthkjvidvyrhlofdygxpayeykvgfimnenvq.dat
c:\windows\system32\ovfsthoautlmrhrbsjwbtjchfdnjajvfnkvcpu.dat

Reglock::
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89876561-F3E9-421A-8381-ED30415FEF51}]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]

Driver::
gxvxcqumsautrofynuvuggmutlchldhjieyyv
ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd
gxvxcserv
hmlztxtx

Save this as CFScript.txt, in the same location as ComboFix.exe

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

In addition, it will prompt you to submit some files for analyzing.

Click OK.

Combofix will then upload the files automatically. Please do not close Combofix's window.

Do not mouse click on Combofix while it is running. That may cause it to stall.

=====================

Please update and generate a fresh MBAM log for me

Start MalwareBytes AntiMalware
Update Malwarebytes' Anti-Malware
Select the Update tab
Click Update
When the update is complete, select the Scanner tab
Select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

=====================
Post back with the combofix results and the results from MBAM, update me on how things are running

bvauilt · #9 14th Apr 2009, 16:51

ComboFix:

ComboFix 09-04-15.03 - Caleb Brandt 04/14/2009 18:36.9 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2577 [GMT -5:00]
Running from: c:\documents and settings\Caleb Brandt\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Caleb Brandt\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\autodis.dll
c:\windows\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
c:\windows\system32\drivers\hmlztxtx.sys
c:\windows\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
c:\windows\system32\ovfsthkjvidvyrhlofdygxpayeykvgfimnenvq.dat
c:\windows\system32\ovfsthoautlmrhrbsjwbtjchfdnjajvfnkvcpu.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\system32\drivers\hmlztxtx.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_HMLZTXTX
-------\Service_hmlztxtx
-------\Legacy_HMLZTXTX

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-14 16:34 . 2009-04-14 16:39 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-13 04:42 . 2009-04-13 04:42 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\U3
2009-04-13 03:50 . 2009-04-13 16:50 -------- d-----w C:\QUARANTINE
2009-04-13 03:45 . 2007-10-25 20:06 280 ----a-w c:\windows\system32\epoPGPsdk.dll.sig
2009-04-13 03:45 . 2007-10-25 20:06 1495552 ----a-w c:\windows\system32\epoPGPsdk.dll
2009-04-13 03:44 . 2008-05-23 01:50 33960 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-04-13 03:44 . 2008-05-23 01:50 72936 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 64232 ----a-w c:\windows\system32\drivers\mfeapfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 52104 ----a-w c:\windows\system32\drivers\mfetdik.sys
2009-04-13 03:44 . 2008-05-23 01:50 174952 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-04-11 02:46 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 02:46 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-04-10 21:20 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 20:59 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 20:58 . 2009-04-10 20:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\NetMedia Providers
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Publish Providers
2009-04-10 04:21 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\Sony
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\PACE Anti-Piracy
2009-03-28 03:50 . 2003-06-20 17:28 1777664 ----a-w c:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 23:22 . 2004-08-10 17:51 23424 ----a-w c:\windows\system32\drivers\czuinylj.sys
2009-04-14 19:39 . 2008-06-02 16:54 -------- d-----w c:\program files\World of Warcraft
2009-04-14 16:44 . 2009-04-14 16:44 1454 ----a-w C:\avenger.txt
2009-04-14 16:39 . 2009-04-14 16:34 -------- d-----w c:\program files\NOS
2009-04-14 16:38 . 2008-05-29 17:10 -------- d-----w c:\program files\Common Files\Adobe
2009-04-14 03:11 . 2008-06-02 16:58 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-14 00:34 . 2008-06-02 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 03:45 . 2009-04-13 03:45 -------- d-----w c:\program files\Common Files\Cisco Systems
2009-04-13 03:45 . 2009-04-13 03:44 -------- d-----w c:\program files\McAfee
2009-04-13 03:45 . 2008-05-29 17:11 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-04-13 03:44 . 2009-04-13 03:44 -------- d-----w c:\program files\Common Files\McAfee
2009-04-13 03:43 . 2008-12-29 05:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-11 02:51 . 2008-12-29 14:47 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-11 02:47 . 2009-04-11 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 02:02 . 2009-04-11 02:02 -------- d-----w c:\program files\Trend Micro
2009-04-11 01:45 . 2009-04-10 21:38 1512 ----a-w C:\aaw7boot.log
2009-04-10 20:58 . 2009-04-10 20:58 -------- d-----w c:\program files\Lavasoft
2009-04-10 20:58 . 2008-06-02 16:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-10 20:54 . 2008-05-29 17:04 -------- d-----w c:\program files\Java
2009-04-10 05:16 . 2009-04-10 04:03 -------- d-----w c:\program files\Audacity
2009-04-10 04:57 . 2009-03-08 20:29 491328 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 04:57 . 2008-06-02 17:08 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\LimeWire
2009-04-10 04:18 . 2009-04-10 04:18 -------- d-----w c:\program files\Sony Setup
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Autodesk
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-05 21:31 . 2008-09-17 21:48 -------- d-----w c:\program files\World of Warcraft Public Test
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\program files\Common Files\PACE Anti-Piracy
2009-03-27 14:07 . 2008-12-09 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-24 17:23 . 2008-06-02 17:08 -------- d-----w c:\program files\LimeWire
2009-03-24 17:14 . 2009-01-06 16:14 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-17 01:33 . 2008-12-29 20:15 34 ----a-w c:\documents and settings\Caleb Brandt\jagex_runescape_preferences.dat
2009-03-12 22:18 . 2009-03-12 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-03-12 22:18 . 2008-06-02 16:46 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\ATI
2009-03-12 22:15 . 2008-05-29 17:06 -------- d-----w c:\program files\ATI Technologies
2009-03-12 22:15 . 2008-05-29 17:06 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 22:12 . 2009-04-10 21:35 -------- d-----w c:\documents and settings\Administrator\Application Data\ATI
2009-03-12 22:06 . 2009-03-12 22:06 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-10 22:28 . 2008-08-27 00:45 930 ----a-w c:\documents and settings\Caleb Brandt\Application Data\wklnhst.dat
2009-03-09 10:19 . 2009-01-07 23:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-09 02:36 . 2008-05-29 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Dell
2009-03-08 20:43 . 2008-06-02 16:46 103632 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-08 20:34 . 2009-03-08 20:31 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-03-08 20:33 . 2009-03-08 20:31 -------- d-----w c:\program files\AutoCAD 2009
2009-03-08 20:29 . 2008-12-09 18:57 -------- d-----w c:\program files\MSBuild
2009-03-08 20:28 . 2009-03-08 20:28 -------- d-----w c:\program files\Reference Assemblies
2009-02-09 11:13 . 2008-10-14 18:58 1846784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 17:51 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-04 07:27 . 2008-05-29 16:48 3488768 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2009-02-04 05:57 . 2008-09-24 02:09 11702272 ----a-w c:\windows\system32\atioglxx.dll
2009-02-04 05:03 . 2008-05-29 16:48 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-04 04:56 . 2008-05-29 16:48 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-04 04:55 . 2008-05-29 16:48 324096 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-04 04:44 . 2008-05-29 16:48 196608 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-04 04:44 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-04 04:43 . 2008-05-29 16:48 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-04 04:43 . 2008-05-29 16:48 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-04 04:43 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-04 04:41 . 2008-05-29 16:48 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-04 04:40 . 2008-05-29 16:48 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-04 04:30 . 2008-05-29 16:48 3884768 ----a-w c:\windows\system32\ati3duag.dll
2009-02-04 04:14 . 2008-05-29 16:48 2645504 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-04 03:58 . 2008-09-24 01:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-04 03:54 . 2008-05-29 16:48 471040 ----a-w c:\windows\system32\atikvmag.dll
2009-02-04 03:53 . 2008-09-24 01:19 122880 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-04 03:52 . 2008-05-29 16:48 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-04 03:46 . 2008-05-29 16:48 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-04 03:44 . 2008-05-29 16:48 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-04 02:43 . 2009-02-04 02:43 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-04 02:42 . 2009-02-04 02:42 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-04 02:40 . 2009-02-04 02:40 3244032 ----a-w c:\windows\system32\aticaldd.dll
2009-02-04 02:05 . 2008-11-10 06:45 593920 ------w c:\windows\system32\ati2sgag.exe
2009-01-23 03:50 . 2009-01-23 03:50 1939 ----a-w C:\temp.png
2008-08-14 06:02 . 2008-08-14 06:02 22328 ----a-w c:\documents and settings\Caleb Brandt\Application Data\PnkBstrK.sys
2008-07-01 20:43 . 2008-07-01 20:42 12408864 ----a-w c:\documents and settings\Caleb Brandt\WoW-2.4.2.8278-to-0.4.3.8478-enUS-patch.exe
2008-06-02 16:46 . 2008-06-02 16:46 135 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\fusioncache.dat
2008-05-29 17:21 . 2009-04-10 21:35 33416 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-05-29 17:21 . 2009-04-10 21:35 128 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2007-11-22 04:2007-11-19 14:44 06:50 . c:\program files\mozilla firefox\plugins\SetupHelper.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-13_11.51.31.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 23:39 . 2009-04-14 23:39 16384 c:\windows\temp\Perflib_Perfdata_724.dat
+ 2004-08-10 17:51 . 2009-04-14 23:22 23424 c:\windows\system32\drivers\czuinylj.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 23424 c:\windows\system32\drivers\czuinylj.sys
+ 2009-04-14 23:38 . 2005-10-21 01:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-02 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-04 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2006-07-26 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-23 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-07-17 16132608]

c:\documents and settings\Caleb Brandt\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 17:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-29 17:16 10536 ----a-w c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

R3 sasenum;sasenum;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 lbd;lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 sasdifsv;sasdifsv;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2008-10-30 192512]
S2 lavasoft ad-aware service;lavasoft ad-aware service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-09-24 84992]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe0ad4c4-27ce-11de-85b9-001d099e8832}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Caleb Brandt\Application Data\Mozilla\Firefox\Profiles\5ho2rf82.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCopysafe35.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 18:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2472)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-14 18:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-14 23:44
ComboFix2.txt 2009-04-14 16:50
ComboFix3.txt 2009-04-14 00:50
ComboFix4.txt 2009-04-14 00:38
ComboFix5.txt 2009-04-14 23:21

Pre-Run: 176,603,004,928 bytes free
Post-Run: 176,535,314,432 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
289 --- E O F --- 2009-03-13 08:01

ComboFix 09-04-15.03 - Caleb Brandt 04/14/2009 18:36.9 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3070.2577 [GMT -5:00]
Running from: c:\documents and settings\Caleb Brandt\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Caleb Brandt\Desktop\CFScript.txt
AV: McAfee VirusScan Enterprise *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\system32\autodis.dll
c:\windows\system32\drivers\gxvxcqumsautrofynuvuggmutlchldhjieyyv.sys
c:\windows\system32\drivers\hmlztxtx.sys
c:\windows\system32\drivers\ovfsthbdfwhpgcservdbfvpfrpmbtcbbmeamkd.sys
c:\windows\system32\ovfsthkjvidvyrhlofdygxpayeykvgfimnenvq.dat
c:\windows\system32\ovfsthoautlmrhrbsjwbtjchfdnjajvfnkvcpu.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\windows\system32\drivers\hmlztxtx.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_HMLZTXTX
-------\Service_hmlztxtx
-------\Legacy_HMLZTXTX

((((((((((((((((((((((((( Files Created from 2009-03-14 to 2009-04-14 )))))))))))))))))))))))))))))))
.

2009-04-14 16:34 . 2009-04-14 16:39 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-04-13 04:42 . 2009-04-13 04:42 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\U3
2009-04-13 03:50 . 2009-04-13 16:50 -------- d-----w C:\QUARANTINE
2009-04-13 03:45 . 2007-10-25 20:06 280 ----a-w c:\windows\system32\epoPGPsdk.dll.sig
2009-04-13 03:45 . 2007-10-25 20:06 1495552 ----a-w c:\windows\system32\epoPGPsdk.dll
2009-04-13 03:44 . 2008-05-23 01:50 33960 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-04-13 03:44 . 2008-05-23 01:50 72936 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 64232 ----a-w c:\windows\system32\drivers\mfeapfk.sys
2009-04-13 03:44 . 2008-05-23 01:50 52104 ----a-w c:\windows\system32\drivers\mfetdik.sys
2009-04-13 03:44 . 2008-05-23 01:50 174952 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-04-11 02:46 . 2009-04-06 20:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-11 02:46 . 2009-04-06 20:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-10 21:36 . 2009-04-10 21:36 -------- d-----w c:\documents and settings\Administrator\Local Settings\Application Data\Opera
2009-04-10 21:20 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-10 20:59 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-10 20:58 . 2009-04-10 20:58 -------- dc-h--w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\NetMedia Providers
2009-04-10 04:22 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Publish Providers
2009-04-10 04:21 . 2009-04-10 04:22 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\Sony
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\All Users\Application Data\PACE Anti-Piracy
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\PACE Anti-Piracy
2009-03-28 03:50 . 2003-06-20 17:28 1777664 ----a-w c:\windows\system32\gdiplus.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-14 23:22 . 2004-08-10 17:51 23424 ----a-w c:\windows\system32\drivers\czuinylj.sys
2009-04-14 19:39 . 2008-06-02 16:54 -------- d-----w c:\program files\World of Warcraft
2009-04-14 16:44 . 2009-04-14 16:44 1454 ----a-w C:\avenger.txt
2009-04-14 16:39 . 2009-04-14 16:34 -------- d-----w c:\program files\NOS
2009-04-14 16:38 . 2008-05-29 17:10 -------- d-----w c:\program files\Common Files\Adobe
2009-04-14 03:11 . 2008-06-02 16:58 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-14 00:34 . 2008-06-02 16:58 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-13 03:45 . 2009-04-13 03:45 -------- d-----w c:\program files\Common Files\Cisco Systems
2009-04-13 03:45 . 2009-04-13 03:44 -------- d-----w c:\program files\McAfee
2009-04-13 03:45 . 2008-05-29 17:11 -------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-04-13 03:44 . 2009-04-13 03:44 -------- d-----w c:\program files\Common Files\McAfee
2009-04-13 03:43 . 2008-12-29 05:38 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-04-11 02:51 . 2008-12-29 14:47 -------- d-----w c:\program files\SUPERAntiSpyware
2009-04-11 02:47 . 2009-04-11 02:46 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-04-11 02:02 . 2009-04-11 02:02 -------- d-----w c:\program files\Trend Micro
2009-04-11 01:45 . 2009-04-10 21:38 1512 ----a-w C:\aaw7boot.log
2009-04-10 20:58 . 2009-04-10 20:58 -------- d-----w c:\program files\Lavasoft
2009-04-10 20:58 . 2008-06-02 16:57 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-04-10 20:54 . 2008-05-29 17:04 -------- d-----w c:\program files\Java
2009-04-10 05:16 . 2009-04-10 04:03 -------- d-----w c:\program files\Audacity
2009-04-10 04:57 . 2009-03-08 20:29 491328 ----a-w c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-04-10 04:57 . 2008-06-02 17:08 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\LimeWire
2009-04-10 04:18 . 2009-04-10 04:18 -------- d-----w c:\program files\Sony Setup
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\Autodesk
2009-04-06 17:44 . 2009-03-08 20:31 -------- d-----w c:\documents and settings\All Users\Application Data\Autodesk
2009-04-05 21:31 . 2008-09-17 21:48 -------- d-----w c:\program files\World of Warcraft Public Test
2009-03-28 05:23 . 2009-03-28 05:23 -------- d-----w c:\program files\Common Files\PACE Anti-Piracy
2009-03-27 14:07 . 2008-12-09 18:54 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-03-24 17:23 . 2008-06-02 17:08 -------- d-----w c:\program files\LimeWire
2009-03-24 17:14 . 2009-01-06 16:14 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-03-17 01:33 . 2008-12-29 20:15 34 ----a-w c:\documents and settings\Caleb Brandt\jagex_runescape_preferences.dat
2009-03-12 22:18 . 2009-03-12 22:18 -------- d-----w c:\documents and settings\All Users\Application Data\ATI
2009-03-12 22:18 . 2008-06-02 16:46 -------- d-----w c:\documents and settings\Caleb Brandt\Application Data\ATI
2009-03-12 22:15 . 2008-05-29 17:06 -------- d-----w c:\program files\ATI Technologies
2009-03-12 22:15 . 2008-05-29 17:06 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-12 22:12 . 2009-04-10 21:35 -------- d-----w c:\documents and settings\Administrator\Application Data\ATI
2009-03-12 22:06 . 2009-03-12 22:06 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-03-10 22:28 . 2008-08-27 00:45 930 ----a-w c:\documents and settings\Caleb Brandt\Application Data\wklnhst.dat
2009-03-09 10:19 . 2009-01-07 23:08 410984 ----a-w c:\windows\system32\deploytk.dll
2009-03-09 02:36 . 2008-05-29 17:08 -------- d-----w c:\documents and settings\All Users\Application Data\Dell
2009-03-08 20:43 . 2008-06-02 16:46 103632 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-03-08 20:34 . 2009-03-08 20:31 -------- d-----w c:\program files\Common Files\Autodesk Shared
2009-03-08 20:33 . 2009-03-08 20:31 -------- d-----w c:\program files\AutoCAD 2009
2009-03-08 20:29 . 2008-12-09 18:57 -------- d-----w c:\program files\MSBuild
2009-03-08 20:28 . 2009-03-08 20:28 -------- d-----w c:\program files\Reference Assemblies
2009-02-09 11:13 . 2008-10-14 18:58 1846784 ------w c:\windows\system32\dllcache\win32k.sys
2009-02-09 11:13 . 2004-08-10 17:51 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-04 07:27 . 2008-05-29 16:48 3488768 ----a-w c:\windows\system32\dllcache\ati2mtag.sys
2009-02-04 05:57 . 2008-09-24 02:09 11702272 ----a-w c:\windows\system32\atioglxx.dll
2009-02-04 05:03 . 2008-05-29 16:48 290816 ----a-w c:\windows\system32\atiok3x2.dll
2009-02-04 04:56 . 2008-05-29 16:48 442368 ----a-w c:\windows\system32\ATIDEMGX.dll
2009-02-04 04:55 . 2008-05-29 16:48 324096 ----a-w c:\windows\system32\ati2dvag.dll
2009-02-04 04:44 . 2008-05-29 16:48 196608 ----a-w c:\windows\system32\atipdlxx.dll
2009-02-04 04:44 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\Oemdspif.dll
2009-02-04 04:43 . 2008-05-29 16:48 26112 ----a-w c:\windows\system32\Ati2mdxx.exe
2009-02-04 04:43 . 2008-05-29 16:48 43520 ----a-w c:\windows\system32\ati2edxx.dll
2009-02-04 04:43 . 2008-05-29 16:48 155648 ----a-w c:\windows\system32\ati2evxx.dll
2009-02-04 04:41 . 2008-05-29 16:48 602112 ----a-w c:\windows\system32\ati2evxx.exe
2009-02-04 04:40 . 2008-05-29 16:48 53248 ----a-w c:\windows\system32\ATIDDC.DLL
2009-02-04 04:30 . 2008-05-29 16:48 3884768 ----a-w c:\windows\system32\ati3duag.dll
2009-02-04 04:14 . 2008-05-29 16:48 2645504 ----a-w c:\windows\system32\ativvaxx.dll
2009-02-04 03:58 . 2008-09-24 01:24 49664 ----a-w c:\windows\system32\amdpcom32.dll
2009-02-04 03:54 . 2008-05-29 16:48 471040 ----a-w c:\windows\system32\atikvmag.dll
2009-02-04 03:53 . 2008-09-24 01:19 122880 ----a-w c:\windows\system32\atiadlxx.dll
2009-02-04 03:52 . 2008-05-29 16:48 17408 ----a-w c:\windows\system32\atitvo32.dll
2009-02-04 03:46 . 2008-05-29 16:48 626688 ----a-w c:\windows\system32\ati2cqag.dll
2009-02-04 03:44 . 2008-05-29 16:48 307200 ----a-w c:\windows\system32\atiiiexx.dll
2009-02-04 02:43 . 2009-02-04 02:43 45056 ----a-w c:\windows\system32\aticalrt.dll
2009-02-04 02:42 . 2009-02-04 02:42 45056 ----a-w c:\windows\system32\aticalcl.dll
2009-02-04 02:40 . 2009-02-04 02:40 3244032 ----a-w c:\windows\system32\aticaldd.dll
2009-02-04 02:05 . 2008-11-10 06:45 593920 ------w c:\windows\system32\ati2sgag.exe
2009-01-23 03:50 . 2009-01-23 03:50 1939 ----a-w C:\temp.png
2008-08-14 06:02 . 2008-08-14 06:02 22328 ----a-w c:\documents and settings\Caleb Brandt\Application Data\PnkBstrK.sys
2008-07-01 20:43 . 2008-07-01 20:42 12408864 ----a-w c:\documents and settings\Caleb Brandt\WoW-2.4.2.8278-to-0.4.3.8478-enUS-patch.exe
2008-06-02 16:46 . 2008-06-02 16:46 135 ----a-w c:\documents and settings\Caleb Brandt\Local Settings\Application Data\fusioncache.dat
2008-05-29 17:21 . 2009-04-10 21:35 33416 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-05-29 17:21 . 2009-04-10 21:35 128 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2007-11-22 04:2007-11-19 14:44 06:50 . c:\program files\mozilla firefox\plugins\SetupHelper.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-04-13_11.51.31.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-14 23:39 . 2009-04-14 23:39 16384 c:\windows\temp\Perflib_Perfdata_724.dat
+ 2004-08-10 17:51 . 2009-04-14 23:22 23424 c:\windows\system32\drivers\czuinylj.sys
- 2004-08-10 17:51 . 2004-08-04 10:00 23424 c:\windows\system32\drivers\czuinylj.sys
+ 2009-04-14 23:38 . 2005-10-21 01:02 163328 c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-06-02 68856]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dellsupportcenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-14 206064]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-04 61440]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-03-11 16384]
"DMXLauncher"="c:\program files\Roxio\CinePlayer\DMXLauncher.exe" [2006-07-26 102400]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"ShStatEXE"="c:\program files\McAfee\VirusScan Enterprise\SHSTAT.EXE" [2008-05-23 111952]
"McAfeeUpdaterUI"="c:\program files\McAfee\Common Framework\UdaterUI.exe" [2007-10-25 136512]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.EXE [2007-07-17 16132608]

c:\documents and settings\Caleb Brandt\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-7 101440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-27 304128]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-12-22 17:05 356352 ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\GoToAssist]
2008-05-29 17:16 10536 ----a-w c:\program files\Citrix\GoToAssist\514\g2awinlogon.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\lavasoft ad-aware service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe"=
"c:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=

R3 sasenum;sasenum;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-03-23 7408]
S0 lbd;lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S1 sasdifsv;sasdifsv;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2009-03-23 9968]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2009-03-23 72944]
S2 CSHelper;CopySafe Helper Service;c:\windows\system32\CSHelper.exe [2008-10-30 192512]
S2 lavasoft ad-aware service;lavasoft ad-aware service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
S3 AtiHdmiService;ATI Function Driver for HDMI Service;c:\windows\system32\drivers\AtiHdmi.sys [2007-09-24 84992]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fe0ad4c4-27ce-11de-85b9-001d099e8832}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2009-04-10 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:06]

2009-04-10 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell.com
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Caleb Brandt\Application Data\Mozilla\Firefox\Profiles\5ho2rf82.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCopysafe35.dll
.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-14 18:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
c:\program files\Citrix\GoToAssist\514\G2AWinLogon.dll

- - - - - - - > 'explorer.exe'(2472)
c:\program files\Windows Desktop Search\deskbar.dll
c:\program files\Windows Desktop Search\en-us\dbres.dll.mui
c:\program files\Windows Desktop Search\dbres.dll
c:\program files\Windows Desktop Search\wordwheel.dll
c:\program files\Windows Desktop Search\en-us\msnlExtRes.dll.mui
c:\program files\Windows Desktop Search\msnlExtRes.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\McAfee\Common Framework\FrameworkService.exe
c:\program files\McAfee\VirusScan Enterprise\Mcshield.exe
c:\program files\McAfee\VirusScan Enterprise\VsTskMgr.exe
c:\program files\McAfee\Common Framework\naPrdMgr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\McAfee\Common Framework\Mctray.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\PnkBstrB.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-14 18:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-14 23:44
ComboFix2.txt 2009-04-14 16:50
ComboFix3.txt 2009-04-14 00:50
ComboFix4.txt 2009-04-14 00:38
ComboFix5.txt 2009-04-14 23:21

Pre-Run: 176,603,004,928 bytes free
Post-Run: 176,535,314,432 bytes free

Current=2 Default=2 Failed=1 LastKnownGood=4 Sets=1,2,3,4
289 --- E O F --- 2009-03-13 08:01

MBAM:

Malwarebytes' Anti-Malware 1.36
Database version: 1983
Windows 5.1.2600 Service Pack 3

4/14/2009 6:47:49 PM
mbam-log-2009-04-14 (18-47-49).txt

Scan type: Quick Scan
Objects scanned: 79946
Time elapsed: 2 minute(s), 33 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Things seem to be running well, that rootkit doesnt seem to be changing my DNS or anything anymore. Do you see anything else?

**sjb007** · #10 15th Apr 2009, 01:01

Howdy there

Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

Code:

@echo off
if exist "%temp%\log.txt" del "%temp%\log.txt"

for %%g in (

"c:\windows\system32\drivers\czuinylj.sys"

) do (
del /a/f/q %%g >nul 2>&1
if exist %%g echo.%%~g>>"%temp%\log.txt"
)


if exist "%temp%\log.txt" ( start notepad "%temp%\log.txt"
) else echo.Deleted Successfully !!

pause
del %0

Save this as fix.bat Choose to "Save type as - All Files"
It should look like this:

Double click on fix.bat & allow it to run

Post back to tell me what it says.

Apart from that all is looking clear.

Lets tidy up after ourselves

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u

Now that you appear to be free from malware lets help you stay that way!

Update windows on a regular basis - If you do not have automatic updates enabled then

Visit Microsoft's Update Page and update your computer from there
Update your virus checker on a regular basis - It is no use having a virus checker with out of date definitions.
Keep an eye on your firewall. check what it wants to allow, do not simply allow everything, If there is any processes that you are unsure of then dont be afraid to ask for advice. For more information on firewalls read this article here

Make your Internet Explorer more secure - This can be done by following these simple instructions:

Open Internet Explorer, click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.

Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

Safer Browsing
Use software such as Trendprotect or Sitehound to help you stay away from unsuspecting sites that have malicious purposes.
Use Spywareblaster to help prevent the installation of unwanted BHO's (Browser Helper Objects)

Use an alternative browser
Other browsers tend to be more secure than IE as they do not make use of active x objects, active x objects can be used by spyware as an infection point on your computer. Safer non active x browsers include Opera browser and, more recently, Firefox browser.

Computer Maintenance
Malware can breed in temporary locations. Use a program such as ccleaner slim to clear out temporary files your computer on a regular basis.

Scan your computer regularly for malware
Scan on a regular basis to keep your computer clean, free software such as Spybot's Search & Destroy and Adaware 2007 Free by Lavasoft can help you keep clear. These products are scan on demand and do not have active back ground scanning. These two products can be installed together without any complications.

Other alternative software that runs under licience and monitors your computer continuously in the background for malware is Malwarebytes Anti-Malware (MBAM) - Please note that this product can also be run as free without a licience but the background protection will not be active.

Secure your router
Change your routers default username and password, do not leave it at factory preset, doing so makes it easy for unauthorised access.

Encrypt your network. Set your wireless network encryption to a minimum level of WPA-PSK [TKIP]. This will help prevent any unauthorised users "piggybacking" onto your network and stealing your bandwidth which you have rightly paid for.

I have included some security related articles that I advise you read through in your own time. These articles will give you tips and advice on preveting malware, and how to stay safe whilst browsing the internet.

-> So How Did I Get Infected In First Place - By TonyKlein
-> How to prevent Malware - By miekiemoes
-> I'm not pulling your leg, honest - By Sandi Hardmeie

**Kindly respond one more time and let me know if we may consider this thread resolved.

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Problem with Trojan Horse Downloader Generic 9	ogb	Virus, Spyware & Security	7	21st Nov 2009 13:06
Trojan.DNSchanger Wont Delete on Reboot with MBAM or SUPERantispyware nor Combofix	Annapelle	Virus, Spyware & Security	10	20th Jul 2009 18:05
For the Life of Me I Cannot Get Rid of VUNDO, Trojan Downloader -Crew	brunester	Virus, Spyware & Security	5	5th May 2009 09:58
Vundo Trojan Won't Delete	AceNguyen	Virus, Spyware & Security	13	23rd Dec 2008 05:40
Infected With Heur.trojan.generic Please Help	ruffryder2k7	Virus, Spyware & Security	17	6th Nov 2008 10:39