Ive done everything instructed on the reply above, thank you once again. Here are the fresh new logs:
Hijack log:Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:19:20 PM, on 1/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\mps\mscifapp.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\oodag.exe
C:\PROGRA~1\MICROS~4\rapimgr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\vtUoMdda.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MPSExe] c:\PROGRA~1\mcafee.com\mps\mscifapp.exe /embedding
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -noicon
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [RAMSaverPro] C:\Program Files\RAM Saver Pro\ramsaverpro.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &D&ownload &with BitComet -
res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet -
res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet -
res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Download by Orbit -
res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit -
res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit -
res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit -
res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~4\INetRepl.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee AntiPhishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} -
http://www.comcast.net/ (file missing)
O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} -
http://www.comcastsupport.com/ (file missing)
O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} -
http://online.comcast.net/help/ (file missing)
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} -
res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {4788DE0A-3552-49EA-AC8C-233DA52523B9} (AxLoaderPassword Class) -
http://www.blackberry.com/YahooDownload/AxLoader.cabO16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) -
http://download.mcafee.com/molbin/share ... insctl.cabO20 - Winlogon Notify: vtUoMdda - C:\WINDOWS\SYSTEM32\vtUoMdda.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: InstallShield Licensing Service - Macrovision - C:\Program Files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 11429 bytes
ComboFix Log:ComboFix 09-01-21.04 - ANDREW 2009-01-23 18:58:54.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.1112 [GMT -8:00]
Running from: c:\documents and settings\ANDREW\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Start Menu\Programs\VirusRemover2008
c:\documents and settings\All Users\Start Menu\Programs\VirusRemover2008\VirusRemover2008.lnk
c:\documents and settings\ANDREW\Desktop\VirusRemover2008.lnk
c:\program files\VirusRemover2008
c:\program files\VirusRemover2008\Viruses.bdt
c:\program files\VirusRemover2008\VRM2008.exe
c:\windows\system32\chert5-998.exe
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekaomykmpqj.sys
c:\windows\system32\hgGwXqqq.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\prunnet.exe
c:\windows\system32\qqqXwGgh.ini
c:\windows\system32\qqqXwGgh.ini2
c:\windows\system32\senekadsmprqre.dat
c:\windows\system32\senekahyxgalxe.dll
c:\windows\system32\senekavqvlaput.dat
c:\windows\system32\senekawkkylhbg.dll
c:\windows\system32\ssqPjiJA.dll
c:\windows\system32\win32hlp.cnf
c:\windows\Tasks\rxljqyjx.job
Infected copy of c:\windows\system32\userinit.exe was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\userinit.exe.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_SENEKA
((((((((((((((((((((((((( Files Created from 2008-12-24 to 2009-01-24 )))))))))))))))))))))))))))))))
.
2009-01-23 19:08 . 2009-01-23 19:08 4 --a------ c:\windows\ypwkvpdr
2009-01-23 18:38 . 2009-01-23 18:38 48,640 --a------ c:\windows\system32\nnnmkJyv.dll
2009-01-23 18:36 . 2009-01-23 18:54 25,088 --a------ c:\windows\system32\drivers\phqghume.sys
2009-01-23 18:35 . 2009-01-23 18:35 25,088 --a------ c:\windows\system32\drivers\rcilguri.sys
2009-01-23 18:35 . 2009-01-23 18:54 2,816 --a------ c:\windows\gkkozbwn
2009-01-23 18:30 . 2009-01-23 18:30 49,664 --a------ c:\windows\system32\vtUoMdda.dll
2009-01-16 12:11 . 2001-08-17 13:28 762,780 --a------ c:\windows\system32\dllcache\3cwmcru.sys
2009-01-16 12:10 . 2004-08-10 02:00 169,984 --a------ c:\windows\system32\dllcache\iisui.dll
2009-01-16 12:10 . 2004-08-10 02:00 94,720 --a------ c:\windows\system32\dllcache\certmap.ocx
2009-01-16 12:10 . 2001-08-17 14:56 66,048 --a------ c:\windows\system32\dllcache\s3legacy.dll
2009-01-16 12:10 . 2004-08-10 02:00 19,968 --a------ c:\windows\system32\dllcache\inetsloc.dll
2009-01-16 12:10 . 2004-08-10 02:00 14,336 --a------ c:\windows\system32\dllcache\iisreset.exe
2009-01-16 12:10 . 2004-08-10 02:00 7,680 --a------ c:\windows\system32\dllcache\inetmgr.exe
2009-01-16 12:10 . 2004-08-10 02:00 7,168 --a------ c:\windows\system32\dllcache\wamregps.dll
2009-01-16 12:10 . 2004-08-10 02:00 6,144 --a------ c:\windows\system32\dllcache\ftpsapi2.dll
2009-01-16 12:10 . 2004-08-10 02:00 5,632 --a------ c:\windows\system32\dllcache\iisrstap.dll
2009-01-14 00:05 . 2009-01-14 00:05 118 --a------ c:\windows\system32\MRT.INI
2009-01-11 09:37 . 2009-01-11 09:37 <DIR> d-------- c:\program files\Trend Micro
2009-01-07 17:43 . 2009-01-07 17:43 <DIR> d-------- c:\program files\FLV Player
2009-01-05 04:38 . 2009-01-12 23:49 31,232 --a------ c:\windows\system32\pcload.exe
2009-01-04 21:16 . 2009-01-04 21:16 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\s_4610_fHx8fHx8fDEyNDM3Njk0MTF8_
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-24 03:11 --------- d-----w c:\program files\PeerGuardian2
2009-01-16 19:22 --------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-01-16 18:53 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-16 03:09 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-01-16 03:09 --------- d-----w c:\program files\Enigma Software Group
2009-01-16 01:51 --------- d-----w c:\program files\Mozilla Firefox 3 Beta 4
2009-01-15 00:11 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-01-15 00:11 15,504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-01-11 17:02 --------- d-----w c:\program files\Modem Helper
2009-01-11 17:02 --------- d-----w c:\program files\Microsoft LifeCam
2009-01-11 17:02 --------- d-----w c:\program files\ManyCam 2.2
2009-01-11 17:02 --------- d-----w c:\program files\DivX
2009-01-11 17:01 --------- d-----w c:\program files\Ultimate troubleshooter
2008-12-31 05:12 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-31 05:04 --------- d--h--r c:\documents and settings\ANDREW\Application Data\yahoo!
2008-12-18 03:56 --------- d-----w c:\documents and settings\ANDREW\Application Data\Malwarebytes
2008-12-18 00:27 --------- d-----w c:\program files\Common Files\Download Manager
2008-12-17 23:10 --------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-17 18:28 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-12-14 08:30 --------- d-----w c:\program files\Serato
2008-12-11 10:57 333,952 ------w c:\windows\system32\drivers\srv.sys
2007-08-13 22:37 53,128 -c-ha-w c:\documents and settings\ANDREW\Application Data\GDIPFONTCACHEV1.DAT
2006-09-19 03:56 5,127,800 -c--a-w c:\program files\Firefox Setup 1.5.0.7.exe
2006-05-19 04:37 953,008 -c--a-w c:\program files\install_flash_player.exe
2006-05-15 06:43 12,754,672 -c--a-w c:\program files\MP10Setup.exe
2006-07-13 15:19 6,718,464 ----a-w c:\program files\mozilla firefox\plugins\libvlc.dll
2007-12-27 17:00 77,824 ----a-w c:\program files\mozilla firefox\plugins\QVPLUG32.DLL
2004-05-07 22:31 348,160 ----a-w c:\program files\mozilla firefox\components\MSVCR71.DLL
2006-11-07 19:58 139,264 ----a-w c:\program files\mozilla firefox\components\SABFF20.DLL
2007-06-10 06:51 56 --sh--r c:\windows\system32\4FB37A1338.sys
2007-06-10 06:51 1,682 -csha-w c:\windows\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((( snapshot@2009-01-19_15.38.14.52 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-16 17:05:05 32,768 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-01-24 02:30:28 32,768 -c--a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-01-16 17:05:05 32,768 -c----w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-01-24 02:30:28 32,768 -c----w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-01-13 07:49:41 111,616 ----a-w c:\windows\system32\dllcache\userinit.exe
+ 2008-04-14 00:12:38 26,112 ----a-w c:\windows\system32\dllcache\userinit.exe
- 2009-01-13 07:49:41 111,616 ----a-w c:\windows\system32\userinit.exe
+ 2008-04-14 00:12:38 26,112 ----a-w c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}]
2009-01-23 18:30 49664 --a------ c:\windows\system32\vtUoMdda.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\wcescomm.exe" [2005-04-22 1196032]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2005-09-18 1421824]
"RAMSaverPro"="c:\program files\RAM Saver Pro\ramsaverpro.exe" [2008-04-16 156192]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 4670704]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 385024]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"MCAgentExe"="c:\progra~1\mcafee.com\agent\mcagent.exe" [2005-09-22 303104]
"MCUpdateExe"="c:\progra~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 212992]
"MSKAGENTEXE"="c:\progra~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 110592]
"MSKDetectorExe"="c:\progra~1\McAfee\SPAMKI~1\MSKDetct.exe" [2006-11-07 1121280]
"MPSExe"="c:\progra~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 296488]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2005-05-31 122941]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2005-12-10 133016]
"VX3000"="c:\windows\vVX3000.exe" [2006-12-05 707360]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-01-12 275800]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-10-01 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
c:\documents and settings\ANDREW\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-09-02 24576]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}"= "c:\windows\system32\vtUoMdda.dll" [2009-01-23 49664]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
2004-09-07 13:08 110592 c:\program files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUoMdda]
2009-01-23 18:30 49664 c:\windows\system32\vtUoMdda.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
"vidc.I263"= i263_32.drv
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\
0OODBS\
0lsdelete
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\BitComet\\BitComet.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\ZakFromAnotherPlanet\\Yazak Chat\\yazak.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"8132:TCP"= 8132:TCP:ppLive
"8113:UDP"= 8113:UDP:ppLive
"18383:TCP"= 18383:TCP:BitComet 18383 TCP
"18383:UDP"= 18383:UDP:BitComet 18383 UDP
"49152:TCP"= 49152:TCP:bitcomit
"8215:TCP"= 8215:TCP:BitComet 8215 TCP
"8215:UDP"= 8215:UDP:BitComet 8215 UDP
"9339:TCP"= 9339:TCP:myspace poker
R3 ManyCam;ManyCam Virtual Webcam, WDM Video Capture Driver;c:\windows\system32\drivers\ManyCam.sys [2008-01-14 21632]
R4 Vcs;Vcs support;c:\windows\system32\drivers\Vcs.sys [2008-07-19 6852]
S0 aylnlfdx;aylnlfdx;c:\windows\system32\drivers\phqghume.sys [2009-01-23 25088]
S0 gkkozbwn;gkkozbwn;c:\windows\system32\drivers\rcilguri.sys [2009-01-23 25088]
S0 ypwkvpdr;ypwkvpdr;c:\windows\system32\drivers\edgnacph.sys []
S1 SABKUTIL;SABKUTIL;\??\c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys --> c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABKUTIL.sys [?]
S3 AngelUsb;Angel USB MPEG Device;c:\windows\system32\drivers\AngelUsb.sys [2007-10-15 375424]
S3 TTM57SLUsb;TTM 57SL USB driver;c:\windows\system32\drivers\TTM57SLUsb.sys [2006-03-09 34944]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" --> c:\program files\Viewpoint\Common\ViewpointService.exe [?]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - PGFILTER
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - wd_windows_tools\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0e96bc20-6f74-11da-82ae-0013ce29d137}]
\Shell\AutoRun\command - E:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{473e216b-27ad-11dd-8e85-a064de9d01fe}]
\Shell\AutoRun\command - h8txw.exe
\Shell\explore\Command - h8txw.exe
\Shell\open\Command - h8txw.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{fb790898-e92d-11db-847b-0013ce29d137}]
\Shell\AutoRun\command - rundll32.exe url.dll,FileProtocolHandler LapNetWizard.exe
.
Contents of the 'Scheduled Tasks' folder
2009-01-20 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
2008-06-24 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job
- D:\setup.exe []
.
- - - - ORPHANS REMOVED - - - -
BHO-{18AE97D8-3DD2-4870-889F-8C9DB97D5589} - c:\windows\system32\hgGwXqqq.dll
HKCU-Run-prunnet - c:\windows\system32\prunnet.exe
HKLM-Run-prunnet - c:\windows\system32\prunnet.exe
HKLM-Run-VirusRemover2008 - c:\program files\VirusRemover2008\VRM2008.exe
.
------- Supplementary Scan -------
.
uStart Page =
http://www.google.commWindow Title = Microsoft Internet Explorer provided by Comcast
uInternet Connection Wizard,ShellNext = iexplore
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
LSP: c:\windows\system32\mclsp.dll
FF - ProfilePath - c:\documents and settings\ANDREW\Application Data\Mozilla\Firefox\Profiles\wub2na56.default\
FF - prefs.js: browser.search.selectedEngine - Answers.com
FF - component: c:\program files\Mozilla Firefox\components\SABFF20.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00032.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00132.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00232.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00332.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00432.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00532.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00632.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00732.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00832.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ00932.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ01032.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ01132.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPQ01232.DLL
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvlc.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nppl3260.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprjplug.dll
FF - plugin: c:\program files\Real\RealOne Player\Netscape6\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-01-23 19:10:31
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
VirusRemover2008 = c:\program files\VirusRemover2008\VRM2008.exe?s\Temp\winsinstall.exe???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????
scanning hidden files ...
c:\windows\system32\drivers\edgnacph.sys 25088 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\S-1-5-21-2082244926-982762690-2944755107-1005\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
[HKEY_USERS\S-1-5-21-2082244926-982762690-2944755107-1005\Software\SecuROM\License information*]
"datasecu"=hex:48,3d,1b,e2,f1,cc,56,09,f4,f1,30,9b,3a,68,a1,25,b9,9e,73,7a,e9,
a2,15,9a,bb,f6,36,e5,f1,20,a1,ab,6e,af,20,90,54,0e,2c,a9,42,01,f0,be,bd,73,\
"rkeysecu"=hex:9f,ca,16,75,83,0a,d6,fd,d2,a5,ab,cb,c1,0d,12,f7
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG10.00.00.01WORKSTATION"="97D45B76197F913FB5A4A5A31EB6E121148F248A8951508F2047C4AB6CDF6A3E3A343954C5B43F6291667DFAE2CA373A846776F4CD7973E71ED417F1C97943169751A1CFE039A2746D396BB88802D0FE0DB4BA96496B6F138393B3507F1E385E49F84CDDACED3D9216575EA5D039B96E493D3B2DDD9E79975D75DB9C328348C270EA170B2C6573AB5D6E6EA1C07F5FDDDBBD688EB143A74EBD6379FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933FEBC9E127BECC74C8EDD5E5BE2F6E6675D575E7D6A3B9808492A65EDEB27A5E4D5A2A4539083523CDFE484E9B8A4942D564D828118F802ED3F3BA1A9BC34E065AB41E04DA40D908D78E07D6FA3FBAAF3DA590963229807C14609CC2622FB87D7985AFC3D9636AE769B3FC3AC8E5A95FBD9468C76AA8E9F29B631AD2BE8370B03E5ABDE12BA2B4E382B0178DAEF7BC39DE5738BD96BC6A2B67995C3E03025D2D274379FA0B51A82B619687396939D9456A9873996F631DF208B5A3DD86F06B9D4B5438D9D02B5D179EDFBBD5E9786DDC662E67E932FC319BE82E77F03ECA0103EB1D929A5EC35B9AB47089618ED7D6834E0BF759ECCF5849103EC23B6C6BE17E28349A73897D12A9ED39BEF8BDFCC72080B036EE9DA45CB3946DA752EEDAC87BE5B2573B978CB87455908F1E685C52B4D59E2EB8A3A318C7C9B657507263C8A727BC02A6FDA642837AFE675B7CEBBB837595927791DBF59C465075846894440BEBBB79C0759E25AB2C21289747E0434182C228A940C7938A01A7B074F831EBC0C87E8D00EE7125D1413297175ABFD2A6B083CB61D646A2342C2C49CEDD5278463DD758079CCC06461B48EA27540869BCBB56CFC3953A308FD7E29EACF15C094F5D044189F1FC11843D06AC7967B03FD7C913CE7705DB849CE01AF7788A9515B958AFE3B3C4F6A140322273F5C70D93AE00FF4AFB1DBC3BCD28EA5F88E50C13C38C3933DED1E16E893F8749C308577AC01B02AC64E7860AB4B019D5C3A1B7F8D7ACC34A8B921A39A06BB4426DC764A280C902CCEFAB330559EC8ECC14B6DFC9A9A09573B064276A09461CF5614D0C76ED1DD179F5162D76BD666AA7F65003023FA6EB7669E40F3E6997511DAE9F6E5BC4758C4464FAB7E13A1F1361C0D5F9158238A52CF322B87CE1519C696562122BC05D4D400560BD2E7CF1430D4AD6E20E3BD7A6ACFD5E9202C2C8075203659FA1148BD2DC1AA4F83F6D88AFC9995DFDB5E99F20574FE362FC426746243C97EF3CD728F7532F61EC6C156A94590F63ECB582ABAEC80091EAB576ECF1A7C35C3957C075C982E486ED3BE85D67712E6E3795486ACB068B40211129505EA00822FE91BAFC7C845100CE8D8498BC4A86282F1C867392255A598DD99CE16E8B29B9B"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(968)
c:\windows\system32\Ati2evxx.dll
c:\program files\Intel\Wireless\Bin\LgNotify.dll
c:\windows\system32\vtUoMdda.dll
- - - - - - - > 'lsass.exe'(1028)
c:\windows\system32\mclsp.dll
c:\windows\system32\SPORDER.dll
c:\windows\system32\mclsphlr\gdlsphlr.dll
c:\windows\system32\McRtl32.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\program files\Intel\Wireless\Bin\ZCfgSvc.exe
c:\progra~1\Intel\Wireless\Bin\1XConfig.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Common Files\InstallShield Shared\Service\InstallShield Licensing Service.exe
c:\program files\McAfee.com\Agent\Mcdetect.exe
c:\progra~1\McAfee.com\Agent\McTskshd.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\windows\system32\oodag.exe
c:\progra~1\MICROS~4\rapimgr.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Apoint\ApntEx.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\windows\ehome\mcrdsvc.exe
c:\windows\system32\dllhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\ehome\ehmsas.exe
.
**************************************************************************
.
Completion time: 2009-01-23 19:18:00 - machine was rebooted
ComboFix-quarantined-files.txt 2009-01-24 03:17:33
ComboFix2.txt 2009-01-19 23:40:06
Pre-Run: 22,858,719,232 bytes free
Post-Run: 22,829,215,744 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
Current=6 Default=6 Failed=5 LastKnownGood=7 Sets=1,2,3,4,5,6,7
338 --- E O F --- 2009-01-14 08:06:42