This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Help with possible trojan pandex and winctrl32.dll attack !!

12 min read

This thread's last reply is from September 4, 2008, 7:51 AM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

stoned_again
August 26, 2008, 12:42 PM UTC
Hello,

I use Norton Internet Security 2008 antivirus, and recently, it has regularly started giving me alerts on blocking 'trojan.pandex'. I have run a full system scan (in safe mode as well), but it doesn't seem to identify the problem then. Also, I sometimes get multiple alerts from the Norotn E-mail scanner, saying that 'certain mails were rejected by my ISP'. I havent' even been sending any mails. Anyways, I installed Hijackthis v2.02 and here's the log filr. Would appreciate if someone could help me out here.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:07:34 PM, on 8/26/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\sistray.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Tally\tallylicserver.exe
C:\Tally\Tally9.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC987376-9BBF-450D-8C5E-DE79181C2A2E}: NameServer = 218.248.255.162 218.248.255.139
O20 - Winlogon Notify: WinCtrl32 - C:\WINDOWS\SYSTEM32\WinCtrl32.dll
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Tally License Server (NT) (Tally License Server) - Unknown owner - C:\Tally\tallylicserver.exe

--
End of file - 6004 bytes
Shaba
August 28, 2008, 8:16 AM UTC
Hi stoned_again

We will begin with ComboFix. Please visit this webpage for download links, and instructions for running the tool:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

  1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
    Remember to re-enable them afterwards.

  2. Click Yes to allow ComboFix to continue scanning for malware.


When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New HijackThis log.

A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
stoned_again
August 30, 2008, 7:52 AM UTC last edited August 30, 2008, 8:50 AM UTC (added combofix log into reply)
Thanks Admin. ...

Did as you asked me to. I have attached the Combofix log and the New Hijack this log with this post. Hope to hear from you soon..ComboFix.txt

Here's the Hijack This report

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:19:42 PM, on 8/30/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Tally\tallylicserver.exe
C:\Tally\Tally9.exe
C:\WINDOWS\system32\CNAB4RPK.EXE
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.5\CoIEPlg.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Utility Tray.lnk = C:\WINDOWS\system32\sistray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{AC987376-9BBF-450D-8C5E-DE79181C2A2E}: NameServer = 218.248.255.162 218.248.255.139
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: Tally License Server (NT) (Tally License Server) - Unknown owner - C:\Tally\tallylicserver.exe

--
End of file - 5661 bytes


Thanks

ComboFix 08-08-29.02 - Flor Mill 2008-08-30 13:12:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.184 [GMT 5.5:30]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\0E865262B7.dll
C:\WINDOWS\system32\kr_done1

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-30 )))))))))))))))))))))))))))))))
.

2008-08-28 19:23 . 2004-08-04 06:00 1,032,192 --a--c--- C:\WINDOWS\system32\dllcache\explorer.exe
2008-08-28 19:23 . 2004-08-04 06:00 1,032,192 --a------ C:\WINDOWS\explorer.exe
2008-08-28 18:25 . 2008-04-13 17:12 116,224 --a--c--- C:\WINDOWS\system32\dllcache\xrxwiadr.dll
2008-08-28 18:25 . 2001-08-17 22:37 27,648 --a--c--- C:\WINDOWS\system32\dllcache\xrxftplt.exe
2008-08-28 18:25 . 2001-08-17 22:36 23,040 --a--c--- C:\WINDOWS\system32\dllcache\xrxwbtmp.dll
2008-08-28 18:25 . 2008-04-13 17:12 18,944 --a--c--- C:\WINDOWS\system32\dllcache\xrxscnui.dll
2008-08-28 18:25 . 2001-08-17 22:37 4,608 --a--c--- C:\WINDOWS\system32\dllcache\xrxflnch.exe
2008-08-28 18:23 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-08-28 18:22 . 2001-08-17 14:56 440,576 --a--c--- C:\WINDOWS\system32\dllcache\tridkb.dll
2008-08-28 18:21 . 2001-08-17 22:36 495,616 --a--c--- C:\WINDOWS\system32\dllcache\sblfx.dll
2008-08-28 18:20 . 2001-08-17 13:28 899,146 --a--c--- C:\WINDOWS\system32\dllcache\r2mdkxga.sys
2008-08-28 18:19 . 2008-04-13 11:31 2,065,792 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-08-28 18:18 . 2001-08-17 12:50 320,384 --a--c--- C:\WINDOWS\system32\dllcache\mgaum.sys
2008-08-28 18:17 . 2001-08-17 13:28 802,683 --a--c--- C:\WINDOWS\system32\dllcache\ltsm.sys
2008-08-28 18:16 . 2008-04-13 17:11 702,845 --a--c--- C:\WINDOWS\system32\dllcache\i81xdnt5.dll
2008-08-28 18:15 . 2001-08-17 14:56 1,733,120 --a--c--- C:\WINDOWS\system32\dllcache\g400d.dll
2008-08-28 18:14 . 2001-08-17 13:28 634,134 --a--c--- C:\WINDOWS\system32\dllcache\el656ct5.sys
2008-08-28 18:13 . 2001-08-17 12:14 952,007 --a--c--- C:\WINDOWS\system32\dllcache\diwan.sys
2008-08-28 18:12 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-08-28 18:11 . 2001-08-17 13:28 871,388 --a--c--- C:\WINDOWS\system32\dllcache\bcmdm.sys
2008-08-28 18:10 . 2008-04-13 12:27 2,188,928 --a--c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-08-28 18:10 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-08-28 13:35 . 2008-08-28 13:35 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-28 13:31 . 2008-08-28 13:34 <DIR> d-------- C:\Documents and Settings\Administrator
2008-08-28 12:20 . 2008-08-28 12:20 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-28 12:20 . 2008-08-28 12:44 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 14:45 . 2008-08-26 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Protexis
2008-08-26 14:43 . 1998-04-24 00:00 368,912 --a------ C:\WINDOWS\system32\vbar332.dll
2008-08-26 14:43 . 2001-03-13 14:49 140,288 --a------ C:\WINDOWS\system32\COMDLG32.OCX
2008-08-26 14:15 . 2008-08-26 14:15 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-25 20:20 . 2008-08-25 20:21 2 --a------ C:\2017259342
2008-08-25 19:55 . 2008-08-25 19:55 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-25 19:45 . 2008-08-25 19:45 <DIR> d-------- C:\Program Files\BinaryBiz
2008-08-25 19:42 . 2008-08-25 19:42 <DIR> d-------- C:\Downloads
2008-08-25 19:42 . 2008-08-25 19:43 <DIR> d-------- C:\Documents and Settings\Flor Mill\Application Data\GetRightToGo
2008-08-25 18:30 . 2008-08-25 18:48 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-25 13:51 . 2008-08-25 19:35 <DIR> d-------- C:\Program Files\PowerDataRecovery
2008-08-25 12:53 . 2008-08-25 12:53 <DIR> d-------- C:\Program Files\uTorrent
2008-08-25 12:53 . 2008-08-28 13:35 <DIR> d-------- C:\Documents and Settings\Flor Mill\Application Data\uTorrent
2008-08-23 14:54 . 2008-08-23 15:05 <DIR> d-------- C:\WINDOWS\system32\Adobe
2008-08-23 14:54 . 2008-08-23 14:55 681 --a------ C:\WINDOWS\mozver.dat
2008-08-22 14:31 . 2008-08-22 14:31 <DIR> d-------- C:\Program Files\CCleaner
2008-08-22 13:25 . 2008-08-22 14:30 <DIR> d-------- C:\Documents and Settings\All Users\Symantec Temporary Files
2008-08-22 12:45 . 2008-08-22 12:45 <DIR> d-------- C:\Documents and Settings\Flor Mill\Application Data\Symantec
2008-08-22 12:43 . 2008-08-22 12:43 <DIR> d-------- C:\Program Files\Windows Sidebar
2008-08-22 12:42 . 2008-08-22 12:44 <DIR> d-------- C:\Program Files\Norton Internet Security
2008-08-22 12:42 . 2008-08-22 13:05 123,952 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-08-22 12:42 . 2008-08-22 13:05 60,800 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-08-22 12:42 . 2008-08-22 13:05 10,671 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2008-08-22 12:42 . 2008-08-22 13:05 805 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.INF
2008-08-22 12:41 . 2008-08-22 13:05 <DIR> d-------- C:\Program Files\Symantec
2008-08-22 12:41 . 2008-08-30 13:08 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-08-05 12:08 . 2008-08-05 12:08 <DIR> d-------- C:\WINDOWS\Sun
2008-08-05 12:08 . 2008-06-10 15:02 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-08-05 12:07 . 2008-08-05 12:08 <DIR> d-------- C:\Program Files\Java
2008-08-05 11:56 . 2008-08-05 11:56 <DIR> d-------- C:\Program Files\Common Files\Java
2008-07-28 14:52 . 2008-07-28 14:52 <DIR> d-------- C:\Documents and Settings\Flor Mill\Application Data\Uniblue
2008-07-28 14:33 . 2008-07-28 14:33 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-07-28 14:33 . 2008-07-28 14:33 <DIR> d-------- C:\WINDOWS\system32\en
2008-07-28 14:33 . 2008-07-28 14:33 <DIR> d-------- C:\WINDOWS\system32\bits
2008-07-28 14:33 . 2008-07-28 14:33 <DIR> d-------- C:\WINDOWS\l2schemas
2008-07-28 14:30 . 2008-07-28 14:34 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-07-24 19:07 . 2008-04-14 05:42 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-07-24 19:06 . 2008-04-14 05:42 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-07-24 13:53 . 2008-07-24 13:53 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-07-24 13:06 . 2008-08-18 12:23 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-07-24 12:36 . 2008-07-24 12:36 <DIR> d--hs---- C:\Documents and Settings\Flor Mill\UserData
2008-07-24 00:49 . 2007-04-16 07:18 92,399 --a------ C:\WINDOWS\VGAsetup.ini
2008-07-24 00:48 . 2008-07-24 00:48 <DIR> d-------- C:\WINDOWS\SIS
2008-07-24 00:48 . 2008-07-24 00:57 <DIR> d-------- C:\Program Files\SiS VGA Utilities V3.80
2008-07-24 00:48 . 2007-04-11 15:35 262,144 --a------ C:\WINDOWS\system32\sistray.exe
2008-07-24 00:48 . 2008-07-24 00:57 254,471 --a------ C:\WINDOWS\system32\VGAunistlog.ini
2008-07-24 00:48 . 2006-04-13 16:05 208,896 --a------ C:\WINDOWS\Progress.exe
2008-07-24 00:48 . 2007-04-11 23:34 135,168 --------- C:\WINDOWS\system32\SiSApCom.dll
2008-07-24 00:48 . 2007-04-11 23:36 110,592 --------- C:\WINDOWS\system32\TVMode.dll
2008-07-24 00:48 . 2007-04-11 23:36 65,536 --------- C:\WINDOWS\system32\SiSHook.dll
2008-07-24 00:48 . 2007-04-11 23:36 53,248 --a------ C:\WINDOWS\system32\SiSPower.dll
2008-07-24 00:48 . 2006-04-29 06:26 49,152 --a------ C:\WINDOWS\InstFunc.exe
2008-07-24 00:48 . 2007-04-11 23:35 12,288 --a------ C:\WINDOWS\InstFunc.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-23 08:15 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-23 08:15 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-23 07:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-23 07:18 --------- d-----w C:\Documents and Settings\Flor Mill\Application Data\AdobeUM
2008-08-22 07:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-07-30 12:12 23,888 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-07-30 11:58 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-07-30 11:58 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2008-07-23 19:27 --------- d-----w C:\Program Files\sisagp
2008-07-18 16:40 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 16:40 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 16:40 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 16:40 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 16:39 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 16:39 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 16:39 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 16:39 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-13 09:15 579,464 ----a-w C:\WINDOWS\system32\SymNeti.dll
2008-06-13 09:15 207,240 ----a-w C:\WINDOWS\system32\SymRedir.dll
2008-05-16 06:28 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext.dll
2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll
2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll
2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll
2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe
2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-03-17 03:36 868352]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 16:57 144784]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-26 07:17 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2008-02-07 12:19 718704]
"SiSPower"="SiSPower.dll" [2007-04-11 23:36 53248 C:\WINDOWS\system32\SiSPower.dll]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 05:42 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-05-15 08:36:14 113664]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Utility Tray.lnk - C:\WINDOWS\system32\sistray.exe [2008-07-24 00:48:54 262144]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winim15.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winlp27.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winrv83.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winsw48.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wintx15.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Winxc26.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2007-10-15 22:44 202024 C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-02 04:27 153136 C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"E:\\tally7.2\\tally72.exe"=
"C:\\WINDOWS\\system32\\CNAB4RPK.EXE"=
"C:\\Tally\\tally9.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R2 LiveUpdate Notice;LiveUpdate Notice;C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe [2008-01-26 07:17]
R2 Tally License Server;Tally License Server (NT);C:\Tally\tallylicserver.exe [2006-12-13 04:34]
S0 Winim15;Winim15;C:\WINDOWS\system32\Drivers\Winim15.sys []
S0 Winlp27;Winlp27;C:\WINDOWS\system32\Drivers\Winlp27.sys []
S0 Winrv83;Winrv83;C:\WINDOWS\system32\Drivers\Winrv83.sys []
S0 Winsw48;Winsw48;C:\WINDOWS\system32\Drivers\Winsw48.sys []
S0 Wintx15;Wintx15;C:\WINDOWS\system32\Drivers\Wintx15.sys []
S0 Winxc26;Winxc26;C:\WINDOWS\system32\Drivers\Winxc26.sys []
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-07-30 17:42]

*Newly Created Service* - CATCHME
*Newly Created Service* - COMHOST
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder

2008-08-25 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Flor Mill.job
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exe [2008-02-07 19:35]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-LHotkey - LHotkey.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Flor Mill\Application Data\Mozilla\Firefox\Profiles\unw0qkzz.default\
FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-30 13:13:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-30 13:15:47
ComboFix-quarantined-files.txt 2008-08-30 07:45:25

Pre-Run: 12,931,842,048 bytes free
Post-Run: 13,377,892,352 bytes free

224 --- E O F --- 2008-08-28 13:55:41
Shaba
August 30, 2008, 8:50 AM UTC
To access the Uninstall Manager you would do the following:

1. Start HijackThis
2. Click on the Config button
3. Click on the Misc Tools button
4. Click on the Open Uninstall Manager button.

You will now be presented with a screen similar to the one below:



5. Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Simply copy and paste the contents of that notepad here on your next reply.
Shaba
September 4, 2008, 7:51 AM UTC
Lack of Response