Win32TrojanTDSS removal help

Question

tube 0 Newbie Poster

15 Years Ago

I'm not sure what happen last night but I fell to sleep at the computer and woke up to the system security virus. It looks like I got that under control and was able to run ad-aware to remove a handful of malware but I cannot get rid of the win32trojantdss (says system needs to reboot but it returns after reboot). I searched here and found MBAM can remove it but it will not install and I cannot get into safe mode. I cannot open any other anti virus programs on the computer as well. Short of reinstalling the operating system do I have any options? This is a company computer so I'd like to avoid doing that.

windows-virus

4 Contributors
17 Replies
236 Views
4 Days Discussion Span
Latest Post 15 Years Ago Latest Post by crunchie

gurukid22 0 Junior Poster

15 Years Ago

Hi

First download some antivirus software if you dont have any, i recommend AVG free edition or avira if you don't want to pay.

The download Hijack this:
http://www.filehippo.com/download_hijackthis/

You should be able to see the associated virus file and remove them then install the antivrus software and run a scan before rebooting.

If you cant see the supicous file post the hijack this log back here.

crunchie 990 Most Valuable Poster

15 Years Ago

Open Device Manager and on the VIEW Tab, select the Show hidden devices option.
Go down to non plug and play drivers and see if there is one called TDSSserv and disable it.

==

Reboot and try the following;

Download Malwarebytes' Anti-Malware (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html) to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure to checkmark the Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Download the update from here if you have problems.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.

The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt

Make sure that you restart the computer.

Post new HJT log.

gerbil 216 Industrious Poster

15 Years Ago

In Safe Mode delete these tow files: ckaafkkerqmyugky.dll and cfrdxdijbmienkkc.dll. You might aslo check in system32\drivers for a file commencing with tdss..., a .sys file. Rename it. Say to tdss...sys.bak
Next, rename the MBAM installer, delete the other MBAM files, run the installer, rename the mbam.exe to boom.exe, see if it will run. Rename hijackthis.exe also, try to run it.

crunchie 990 Most Valuable Poster

15 Years Ago

Can you please do the following.

===============

Programs like SUPERAntiSpyware, may interfere with the following fix, so we need to temporarily disable it.

Right-click on the SUPERAntiSpyware icon in the system tray.
Choose View Control Center... "Preferences/options" button/tab.
On the General and Startup...tab, uncheck, "Start SUPERAntiSpyware when Windows starts"
click Close to exit.

Don't forget to enable your SUPERAntiSpyware protection, when your computer is clean.

===============

Scan with HijackThis and then place a check next to all the following, if present:

O4 - HKLM\..\Run: [alcmtr] ALCMTR.EXE

O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

folders...

c:\progra~1\Manson

Search for...

ALCMTR.EXE

...using "Start | Search...".

-

Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear.

Select the first option to run Windows in Safe Mode hit enter.

-

Reboot.

===============

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

gerbil 216 Industrious Poster

15 Years Ago

"All I have to do is start typing the file name in search and everything shuts down." Wow, neat work by the pest. Okay, let's test this:
==This one is a general purpose deleter, Unlocker: http://filehippo.com/download_unlocker/
Dclick the exe to install it, unchecking the updater and assistant boxes. It runs from the rclick context menu, and that is cool.
Good, now NAVIGATE [browse] to that file: c:\program files\Manson\liser.dll, rclick it, and choose Unlocker. "If the file
or folder is locked then a window will appear with a list of processes
locking the file or folder. Select the locks and click Unlock and you
are done." Select delete, and ok.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

tube 0 Newbie Poster · Answer 1 · 2009-06-17T02:17:00+00:00

I already tried downloading another anti virus program and can down load it but it will not install. Just tried Hijack and it is the same story, downloaded but cannot open to install.

tube 0 Newbie Poster · Answer 2 · 2009-06-17T08:19:03+00:00

I do not see TDSSserv as an option. When I rebooted the screen was blue and a boot cleaner came up and initialized ckaafkkerqmyugky.dll and cfrdxdijbmienkkc.dll. These are the two items adaware is finding under the win32trojantdss family.

I still cannot open mbam-setup.exe or hjtinstall.exe

tube 0 Newbie Poster · Answer 3 · 2009-06-17T17:56:08+00:00

gerbil-- I cannot get into safe mode. I did not see any of the files in the system32\drivers folder. Renaming mbam got it to install but I cannot open it now that it is installed. Is there something else I could rename now?

Renaming hijackthis worked! Here is the log file-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:22:15 AM, on 6/17/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Trend Micro\logThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 browser-security.microsoft.com
O1 - Hosts: 94.232.248.66 antivirprotection.com
O1 - Hosts: 94.232.248.66 www.antivirprotection.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [zenrc tray icon] C:\WINDOWS\system32\zentray.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [syntplpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [syntpenh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [sunjavaupdatesched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [rthdcpl] RTHDCPL.EXE
O4 - HKLM\..\Run: [remotecontrol] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [quicktime task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [phime2002async] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [phime2002a] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ntimui] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [lmanager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [launchapp] Alaunch
O4 - HKLM\..\Run: [isuspm] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [imageitencrypt] C:\WINDOWS\system32\ImageItEncrypt.exe
O4 - HKLM\..\Run: [hpwutoolbox] C:\Program Files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe "-i"
O4 - HKLM\..\Run: [erecoveryservice] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [edatasecurity loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ccapp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [azmixersel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [agrsmmsg] AGRSMMSG.exe
O4 - HKLM\..\Run: [ad-watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [superantispyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msmsgs] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

--
End of file - 5408 bytes

tube 0 Newbie Poster · Answer 4 · 2009-06-18T08:18:26+00:00

Can you please do the following.
===============
Programs like SUPERAntiSpyware, may interfere with the following fix, so we need to temporarily disable it.
Right-click on the SUPERAntiSpyware icon in the system tray.

Choose View Control Center... "Preferences/options" button/tab.

On the General and Startup...tab, uncheck, "Start SUPERAntiSpyware when Windows starts"

click Close to exit.

Don't forget to enable your SUPERAntiSpyware protection, when your computer is clean.

===============
Scan with HijackThis and then place a check next to all the following, if present:

O4 - HKLM\..\Run: [alcmtr] ALCMTR.EXE
O20 - AppInit_DLLs: c:\progra~1\Manson\liser.dll

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".
===============

I made it this far. Once I try to search for the file I get the blue physical memory dump screen and it restarts. All I have to do is start typing the file name in search and everything shuts down. When I try to get into safe mode I get a list on the screen and it never boots.

tube 0 Newbie Poster · Answer 5 · 2009-06-19T09:50:58+00:00

"All I have to do is start typing the file name in search and everything shuts down." Wow, neat work by the pest. Okay, let's test this:
==This one is a general purpose deleter, Unlocker: http://filehippo.com/download_unlocker/
Dclick the exe to install it, unchecking the updater and assistant boxes. It runs from the rclick context menu, and that is cool.
Good, now NAVIGATE [browse] to that file: c:\program files\Manson\liser.dll, rclick it, and choose Unlocker. "If the file
or folder is locked then a window will appear with a list of processes
locking the file or folder. Select the locks and click Unlock and you
are done." Select delete, and ok.

That file is gone. I am still having problems and cannot find the exe file. Now what should I try?

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 6 · 2009-06-19T10:15:56+00:00

Now what should I try?

I already posted to run combofix. Up to you though.

tube 0 Newbie Poster · Answer 7 · 2009-06-19T18:13:36+00:00

I already posted to run combofix. Up to you though.

I wasn't sure if it was OK to skip a head since I could not complete some steps.

Here is the CF report-

ComboFix 09-05-11.01 - eclark 06/19/2009  7:33.1 - [color=red][b]FAT32[/b][/color]x86
Microsoft Windows XP Professional  5.1.2600.2.1252.1.1033.18.1.#QNAN.292 [GMT -4:00]
Running from: c:\documents and settings\eclark\Desktop\cf.exe
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated)
.
- REDUCED FUNCTIONALITY MODE -
.
    /wow section not completed

(((((((((((((((((((((((((   Files Created from 2009-05-19 to 2009-06-19  )))))))))))))))))))))))))))))))
.

2009-06-19 03:48 . 2009-06-19 03:48 --------    d-----w c:\documents and settings\eclark\Application Data\Desktopicon
2009-06-19 03:48 . 2009-06-19 03:48 --------    d-----w c:\program files\Unlocker
2009-06-18 00:52 . 2009-06-18 00:53 15000   ----a-w c:\windows\system32\gsf83iujid.dll
2009-06-17 11:40 . 2009-05-26 17:20 40160   ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:40 . 2009-05-26 17:19 19096   ----a-w c:\windows\system32\drivers\mbam.sys
2009-06-17 11:40 . 2009-06-17 11:40 --------    d-----w c:\program files\Malwarebytes' Anti-Malware
2009-06-17 11:22 . 2009-06-17 11:22 --------    d-----w c:\program files\Trend Micro
2009-06-17 11:17 . 2009-06-17 11:17 --------    d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-16 03:26 . 2009-06-13 21:32 110 ----a-w C:\tj.vbs
2009-06-11 12:12 . 2009-06-11 12:12 --------    d-sh--w C:\FOUND.004
2009-06-09 01:54 . 1998-10-07 21:15 122832  ----a-w c:\windows\uninstal.exe
2009-06-09 01:54 . 2009-06-09 01:54 --------    d-----w C:\MDS
2009-06-08 10:20 . 2009-06-08 10:20 --------    d-----w c:\documents and settings\eclark\IGC
2009-06-08 02:41 . 2003-05-28 16:19 245408  ------r c:\windows\system32\unicows.dll
2009-06-08 02:41 . 2009-06-08 02:41 --------    d-----w c:\program files\IGC
2009-05-24 21:31 . 2009-06-18 01:03 97216   ----a-w c:\windows\system32\drivers\771b71c2.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-18 23:52 . 2009-06-18 23:52 14336   ----a-w C:\wyhgm.exe
2009-06-18 23:52 . 2009-06-18 23:52 30720   ----a-w C:\blnqxlg.exe
2009-06-18 23:52 . 2009-06-18 00:53 28672   ----a-w C:\giyghshu.exe
2009-06-18 23:52 . 2009-06-18 00:53 204100  ----a-w C:\mupwjiav.exe
2009-06-18 23:52 . 2009-06-18 02:51 9216    ----a-w C:\chfyosn.exe
2009-06-18 23:52 . 2009-06-18 23:52 23552   ----a-w C:\oxyyxwn.exe
2009-06-18 23:51 . 2009-06-18 00:54 28672   ---h--w c:\windows\ld10.exe
2009-06-18 03:15 . 2009-06-18 03:15 580 ---ha-w C:\aaw7boot.cmd
2009-06-18 01:05 . 2006-08-22 02:30 90112   ----a-w c:\windows\DUMP689d.tmp
2009-06-18 00:57 . 2009-06-18 00:57 0   ----a-w c:\windows\system32\drivers\4511078.sys
2009-06-18 00:57 . 2009-06-18 00:57 0   ----a-w c:\windows\system32\drivers\338988a8.sys
2009-06-18 00:55 . 2009-06-18 00:55 2   ----a-w c:\windows\[u]0[/u]10112010146118114.dat
2009-06-18 00:55 . 2009-06-18 00:55 --------    d-----w c:\program files\driver
2009-06-18 00:53 . 2009-06-18 00:53 2   ---h--w c:\windows\zaponce52689.dat
2009-06-17 02:07 . 2006-08-22 02:30 90112   ----a-w c:\windows\DUMP10d8.tmp
2009-06-16 12:18 . 2006-08-22 02:30 90112   ----a-w c:\windows\DUMP106b.tmp
2009-06-16 03:58 . 2006-08-22 02:30 90112   ----a-w c:\windows\DUMP4b60.tmp
2009-06-01 02:58 . 2009-05-11 12:17 15688   ----a-w c:\windows\system32\lsdelete.exe
2009-05-28 19:47 . 2009-05-09 21:32 145 --s-a-w c:\windows\system32\2009931927.dat
2009-05-18 00:22 . 2009-05-18 00:22 --------    d-----w c:\program files\Enigma Software Group
2009-05-12 17:52 . 2009-05-12 17:52 --------    d-----w c:\program files\Edgenet
2009-05-12 03:02 . 2009-05-11 02:56 64160   ----a-w c:\windows\system32\drivers\Lbd.sys
2009-05-12 00:37 . 2009-05-12 00:37 --------    d-----w c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-12 00:36 . 2009-05-12 00:36 --------    d-----w c:\program files\SUPERAntiSpyware
2009-05-12 00:36 . 2009-05-12 00:36 --------    d-----w c:\documents and settings\eclark\Application Data\SUPERAntiSpyware.com
2009-05-12 00:35 . 2009-05-12 00:35 --------    d-----w c:\program files\Common Files\Wise Installation Wizard
2009-05-11 23:10 . 2009-05-11 23:10 1341005 ----a-w C:\MGtools.exe
2009-05-11 22:29 . 2009-05-11 22:29 --------    d-----w c:\program files\CCleaner
2009-05-11 02:55 . 2009-05-11 02:55 --------    d-----w c:\program files\Lavasoft
2009-05-10 19:04 . 2009-05-10 19:04 --------    d-----w c:\program files\Xvid

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2C7B2A1-00F3-42BD-F434-00AABA2C8952}]
2009-06-18 00:53    15000   ----a-w c:\windows\system32\gsf83iujid.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"superantispyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-04-28 1830128]
"msmsgs"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"launchapp"="Alaunch" [X]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]
"zenrc tray icon"="c:\windows\system32\zentray.exe" [2003-03-18 40960]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"syntplpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 102491]
"syntpenh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 692315]
"sunjavaupdatesched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600]
"remotecontrol"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"quicktime task"="c:\program files\QuickTime\qttask.exe" [2008-12-19 77824]
"phime2002async"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"phime2002a"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ntimui"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"lmanager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2006-03-30 471040]
"isuspm"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-12-12 208896]
"imageitencrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
"hpwutoolbox"="c:\program files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe" [2005-07-23 352256]
"erecoveryservice"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
"ccapp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"azmixersel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 53248]
"ad-watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-01 518488]
"NWTRAY"="NWTRAY.EXE" - c:\windows\system32\nwtray.exe [2002-03-12 28672]
"rthdcpl"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-02-27 16005120]
"agrsmmsg"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2006-03-16 88204]

c:\documents and settings\eclark\Start Menu\Programs\Startup\
fmnupd32.exe [2004-8-4 30720]
zqosys32.exe [2004-8-4 30208]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"EnableProfileQuota"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFolderOptions"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{B2C7B2A1-00F3-42BD-F434-00AABA2C8952}"= "c:\windows\system32\gsf83iujid.dll" [2009-06-18 15000]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\system32\userinit.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05    356352  ----a-w c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders   msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digiwet.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Novell\\GroupWise\\grpwise.exe"=
"c:\\Novell\\GroupWise\\notify.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/10/2009 10:56 PM 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [3/18/2003 6:26 PM 4768]
R2 Kblock;Kblock;c:\windows\system32\drivers\kblock.sys [3/18/2003 3:16 PM 4043]
R2 M2o Online Services Agent;M2o Online Services Agent;c:\program files\Edgenet\Reeb\M2oAgent.exe [10/22/2008 1:21 PM 9216]
R2 Mouslock;Mouslock;c:\windows\system32\drivers\mouslock.sys [3/18/2003 3:16 PM 4080]
R2 Prometheus Wake-On-LAN Status Agent;Novell ZfD Wake on LAN Status Agent;c:\program files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe [3/18/2003 2:40 PM 49152]
R2 Remote Management Agent;Novell ZfD Remote Management;c:\program files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe [3/18/2003 2:39 PM 131072]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [3/18/2003 3:14 PM 2773]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/9/2009 9:59 AM 101936]
R3 nscmnt;Novell Local Security Context Manager;c:\windows\system32\drivers\Novell\nscmnt.sys [7/12/2002 11:36 AM 17984]
R3 xauthnt;Novell XTier Authentication Service;c:\windows\system32\drivers\Novell\xauthnt.sys [6/17/2002 4:32 PM 7728]
S1 771b71c2;771b71c2;c:\windows\system32\drivers\771b71c2.sys [5/24/2009 5:31 PM 97216]
S1 84c06b7d;84c06b7d;c:\windows\system32\drivers\84c06b7d.sys --> c:\windows\system32\drivers\84c06b7d.sys [?]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1005904]
S2 SamSsShellHWDetection;Security Accounts Manager SamSsShellHWDetection;c:\windows\system32\CatRootz.exe srv --> c:\windows\system32\CatRootz.exe srv [?]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ    Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-06-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:57]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-edatasecurity loader - c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe


.
------- Supplementary Scan -------
.
uStart Page = google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\eclark\Application Data\Mozilla\Firefox\Profiles\yze0u919.default\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url]http://www.gmer.net[/url]
Rootkit scan 2009-06-19 07:34
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...  

scanning hidden autostart entries ... 

scanning hidden files ...  


c:\windows\system32\drivers\UACetjlabaomktiydv.sys 65536 bytes
c:\windows\system32\drivers\SKYNETfwrtnbxd.sys 98304 bytes
c:\windows\system32\uacinit.dll 32768 bytes
c:\windows\system32\uactmp.db 3997696 bytes
c:\windows\system32\UAChmtnmhlhohfnxql.dll 32768 bytes
c:\windows\system32\UACdpvfvppjduckxej.dat 32768 bytes
c:\windows\system32\UACtyvkalcctsufndv.dll 32768 bytes
c:\windows\system32\UACrkmnujnmsoynocn.dll 32768 bytes
c:\windows\system32\UACwsgvarqgapvgoer.dll 32768 bytes
c:\windows\system32\UACgxnweyyebrpavkr.db 1114112 bytes
c:\windows\system32\UACkaafkkerqmyugky.dll 32768 bytes
c:\windows\system32\UACfrdxdijbmienkkc.dll 98304 bytes
c:\windows\system32\UACclxiadafsuramlc.log 65536 bytes
c:\windows\system32\SKYNETuwvxqenj.dll 65536 bytes
c:\windows\system32\SKYNETigvfhrlw.dat 98304 bytes
c:\windows\system32\SKYNETdcjtddco.dll 32768 bytes
c:\windows\system32\UACkayjswbtkenbnjj.dat 32768 bytes
c:\windows\system32\UACtqoaqvfhixngumr.log 32768 bytes
c:\docume~1\eclark\LOCALS~1\Temp\UAC8e2e.tmp 360448 bytes
c:\docume~1\eclark\LOCALS~1\Temp\UACd28c.tmp 360448 bytes
c:\docume~1\eclark\LOCALS~1\Temp\UAC9f42.tmp 131072 bytes

scan completed successfully
hidden files: 21

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\skynetbnailwku]
"imagepath"="\systemroot\system32\drivers\SKYNETfwrtnbxd.sys"
--

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\uacd.sys]
"imagepath"="\systemroot\system32\drivers\UACetjlabaomktiydv.sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\skynetbnailwku]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"group"="file system"
"imagepath"=expand:"\\systemroot\\system32\\drivers\\SKYNETfwrtnbxd.sys"

[HKEY_LOCAL_MACHINE\System\ControlSet003\Services\uacd.sys]
@DACL=(02 0000)
"start"=dword:00000001
"type"=dword:00000001
"imagepath"=expand:"\\systemroot\\system32\\drivers\\UACetjlabaomktiydv.sys"
"group"="file system"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(464)
c:\windows\system32\NETWIN32.DLL
c:\program files\Novell\ZENworks\ZENPOL32.DLL
c:\program files\Novell\ZENworks\ZenLite.dll
c:\windows\system32\xmlparse.dll
c:\program files\Novell\ZENworks\ZENNW32.DLL
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'Explorer.exe'(3620)
c:\windows\system32\gsf83iujid.dll
c:\windows\system32\RPAWINET.DLL
c:\windows\system32\Novell\ncplw32.dll
c:\windows\system32\novell\nls\english\NetIdent.dll
c:\windows\system32\Novell\xauthw32.dll
c:\windows\system32\Novell\nioctl.dll
c:\windows\system32\Novell\nlscmnt.dll
.
Completion time: 2009-06-19  8:08
ComboFix-quarantined-files.txt  2009-06-19 12:08

Pre-Run: 30,780,620,800 bytes free
Post-Run: 30,766,202,880 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

246 --- E O F ---   2009-04-15 07:04


Fresh HJ report-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:10:58 AM, on 6/19/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Edgenet\Reeb\M2oAgent.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\WINDOWS\AGRSMMSG.exe
C:\windows\ld10.exe
C:\WINDOWS\TEMP\wq4r8o.exe
C:\WINDOWS\TEMP\wq4r8o.exe
C:\WINDOWS\system32\igfxext.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\svchost.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\notepad.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\services.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\winamp.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\smss.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\csrss.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\winlogon.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\taskmgr.exe
C:\DOCUME~1\eclark\LOCALS~1\Temp\spoolsv.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\logThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://go.microsoft.com/fwlink/?LinkId=69157[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [url]http://go.microsoft.com/fwlink/?LinkId=54896[/url]
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: C:\WINDOWS\system32\gsf83iujid.dll - {B2C7B2A1-00F3-42BD-F434-00AABA2C8952} - C:\WINDOWS\system32\gsf83iujid.dll
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [zenrc tray icon] C:\WINDOWS\system32\zentray.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [syntplpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [syntpenh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [sunjavaupdatesched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [rthdcpl] RTHDCPL.EXE
O4 - HKLM\..\Run: [remotecontrol] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [quicktime task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [phime2002async] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [phime2002a] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ntimui] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [lmanager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [launchapp] Alaunch
O4 - HKLM\..\Run: [isuspm] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [imageitencrypt] C:\WINDOWS\system32\ImageItEncrypt.exe
O4 - HKLM\..\Run: [hpwutoolbox] C:\Program Files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe "-i"
O4 - HKLM\..\Run: [erecoveryservice] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [edatasecurity loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ccapp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [azmixersel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [agrsmmsg] AGRSMMSG.exe
O4 - HKLM\..\Run: [ad-watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [superantispyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msmsgs] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [hsf7husjnfg98gi498aejhiugjkdg4] C:\WINDOWS\TEMP\wq4r8o.exe
O4 - HKCU\..\Run: [Windows System Recover!] C:\DOCUME~1\eclark\LOCALS~1\Temp\taskmgr.exe
O4 - Startup: fmnupd32.exe
O4 - Startup: zqosys32.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - [url]http://go.microsoft.com/fwlink/?linkid=58813[/url]
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O22 - SharedTaskScheduler: hs837hiudjgfo9s8gjio4gfd - {B2C7B2A1-00F3-42BD-F434-00AABA2C8952} - C:\WINDOWS\system32\gsf83iujid.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: M2o Online Services Agent - Edgenet Inc. - C:\Program Files\Edgenet\Reeb\M2oAgent.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent (Prometheus Wake-On-LAN Status Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Security Accounts Manager SamSsShellHWDetection (SamSsShellHWDetection) - Unknown owner - C:\WINDOWS\system32\CatRootz.exe (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\
O23 - Service: Workstation Manager (ZFDWM) - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

--
End of file - 9957 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 8 · 2009-06-19T18:39:37+00:00

Don't expect miracles here because your pc is severely infested.

==

Please go to Jotti's or to virustotal and have these files scanned. Post the results back here.

c:\windows\system32\gsf83iujid.dll
C:\wyhgm.exe
C:\blnqxlg.exe
C:\giyghshu.exe
C:\mupwjiav.exe
C:\chfyosn.exe
C:\oxyyxwn.exe
c:\windows\ld10.exe
c:\windows\system32\drivers\4511078.sys
c:\windows\system32\drivers\338988a8.sys
c:\windows\system32\uacinit.dll 32768 bytes
c:\windows\system32\uactmp.db

These two are in your startup folder
fmnupd32.exe
zqosys32.exe

tube 0 Newbie Poster · Answer 9 · 2009-06-19T19:51:17+00:00

File gsf83iujid.dll received on 2009.06.19 13:23:58 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan.Win32.Ertfor!IK
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 Downloader.Generic8.AVFE
BitDefender 7.2 2009.06.19 -
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 Suspicious File
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 PossibleThreat
GData 19 2009.06.19 -
Ikarus T3.1.1.59.0 2009.06.19 Trojan.Win32.Ertfor
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 Artemis!14DF70066726
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Crypt.ZPACK.Gen
Microsoft 1.4701 2009.06.19 Trojan:Win32/Ertfor.A
NOD32 4171 2009.06.19 Win32/TrojanDownloader.Small.OQE
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 Medium Risk Malware
Rising 21.34.44.00 2009.06.19 Trojan.DL.Win32.Undef.emn
Sophos 4.42.0 2009.06.19 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.18 Trojan.FakeAlert
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File wyhgm.exe received on 2009.06.19 13:38:43 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Worm.Win32.Koobface!IK
AhnLab-V3 5.0.0.2 2009.06.19 Win-Trojan/Koobface.14336
AntiVir 7.9.0.191 2009.06.19 TR/Downloader.Gen
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 Win32:Koobface-L
AVG 8.5.0.339 2009.06.19 SHeur2.ALYT
BitDefender 7.2 2009.06.19 Win32.Worm.Koobface.MT
CAT-QuickHeal 10.00 2009.06.19 Win32.Backdoor.Phdet.gen!A.3
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 Win32.HLLW.Facebook.113
eSafe 7.0.17.0 2009.06.18 Win32.WormKoobface
eTrust-Vet 31.6.6569 2009.06.19 Win32/Koobface.BC
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 PossibleThreat
GData 19 2009.06.19 Win32.Worm.Koobface.MT
Ikarus T3.1.1.59.0 2009.06.19 Worm.Win32.Koobface
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 Trojan.Win32.Agent.cmrk
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 Artemis!6060AAD45FAD
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Downloader.Gen
Microsoft 1.4701 2009.06.19 Worm:Win32/Koobface.gen!D
NOD32 4171 2009.06.19 Win32/Koobface.NBQ
Norman 6.01.09 2009.06.19 W32/Koobface.FS
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 High Risk Cloaked Malware
Rising 21.34.44.00 2009.06.19 Worm.Win32.Koobface.aw
Sophos 4.42.0 2009.06.19 W32/Koobfa-Gen
Sunbelt 3.2.1858.2 2009.06.18 Trojan.Win32.Unidentified.VS
Symantec 1.4.4.12 2009.06.19 W32.Koobface.A
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 PAK_Generic.001
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File blnqxlg.exe received on 2009.06.19 13:36:54 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan-Downloader.Win32.Bredolab!IK
AhnLab-V3 5.0.0.2 2009.06.19 Win-Trojan/Waledoc.30720
AntiVir 7.9.0.191 2009.06.19 TR/Dldr.Bredolab.AA
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 SHeur2.ALMH
BitDefender 7.2 2009.06.19 Trojan.Generic.CJ.BAT
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.06.19 Trojan.Botnetlog.11
eSafe 7.0.17.0 2009.06.18 -
eTrust-Vet 31.6.6569 2009.06.19 Win32/Bredolab.IX
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 W32/PackWaledac.B
GData 19 2009.06.19 Trojan.Generic.CJ.BAT
Ikarus T3.1.1.59.0 2009.06.19 Trojan-Downloader.Win32.Bredolab
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 Generic Downloader.x!fi
McAfee+Artemis 5650 2009.06.18 Generic Downloader.x!fi
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Dldr.Bredolab.AA
Microsoft 1.4701 2009.06.19 TrojanDownloader:Win32/Bredolab.G
NOD32 4171 2009.06.19 Win32/TrojanDownloader.Bredolab.AA
Norman 6.01.09 2009.06.19 W32/DLoader.dam
nProtect 2009.1.8.0 2009.06.19 Trojan/W32.Agent.30720.EX
Panda 10.0.0.16 2009.06.19 Suspicious file
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 High Risk Cloaked Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.18 Trojan.Win32.Unidentified.VS
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 TROJ_BREDOLAB.CH
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 Trojan.Win32.Obfuscator.30720
VirusBuster 4.6.5.0 2009.06.18 -

File giyghshu.exe received on 2009.06.19 13:34:39 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 -
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 TR/Dldr.VB.WDW
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 Downloader.Agent2.EQR
BitDefender 7.2 2009.06.19 Trojan.Downloader.VB.WDW
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 Win32.TrojanDownload
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 -
GData 19 2009.06.19 Trojan.Downloader.VB.WDW
Ikarus T3.1.1.59.0 2009.06.19 -
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 Artemis!F72716A2CDED
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Dldr.VB.WDW
Microsoft 1.4701 2009.06.19 -
NOD32 4171 2009.06.19 Win32/TrojanDownloader.VB.NYZ
Norman 6.01.09 2009.06.19 W32/DLoader.PKHP
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 High Risk Cloaked Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Troj/VB-EEK
Sunbelt 3.2.1858.2 2009.06.18 -
Symantec 1.4.4.12 2009.06.19 Downloader
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File mupwjiav.exe received on 2009.06.19 13:32:39 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 -
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 DR/Agent.204100
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 Rootkit-Agent.DX
BitDefender 7.2 2009.06.19 -
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 -
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 -
GData 19 2009.06.19 -
Ikarus T3.1.1.59.0 2009.06.19 Trojan-Downloader.Win32.Boltolog
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 Backdoor.Win32.NewRest.al
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 -
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Dropper.Agent.204100
Microsoft 1.4701 2009.06.19 -
NOD32 4171 2009.06.19 a variant of Win32/Rustock.NJB
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 Medium Risk Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Troj/Agent-KFU
Sunbelt 3.2.1858.2 2009.06.18 -
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File chfyosn.exe received on 2009.06.19 13:09:38 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan.Crypt!IK
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 TR/Crypt.ZPACK.Gen
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 Win32:Crypt-EKF
AVG 8.5.0.339 2009.06.19 -
BitDefender 7.2 2009.06.19 Trojan.Generic.CJ.AXE
CAT-QuickHeal 10.00 2009.06.19 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 Win32.TRCrypt.ZPACK
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 -
GData 19 2009.06.19 Trojan.Generic.CJ.AXE
Ikarus T3.1.1.59.0 2009.06.19 Trojan.Crypt
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 Generic.dx!kq
McAfee+Artemis 5650 2009.06.18 Generic.dx!kq
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Crypt.ZPACK.Gen
Microsoft 1.4701 2009.06.19 TrojanDownloader:Win32/Agent
NOD32 4171 2009.06.19 -
Norman 6.01.09 2009.06.19 W32/Smalltroj.OMBC
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 -
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.18 VirTool-Win32/Obfuscator.FM
Symantec 1.4.4.12 2009.06.19 Trojan Horse
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File oxyyxwn.exe received on 2009.06.19 13:14:06 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan.Win32.Ertfor!IK
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 TR/Drop.Agent.xka
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 SHeur2.AMBI
BitDefender 7.2 2009.06.19 -
CAT-QuickHeal 10.00 2009.06.19 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 Win32.TrojanErtfor.A
eTrust-Vet 31.6.6569 2009.06.19 Win32/Ertfor.AH
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 PossibleThreat
GData 19 2009.06.19 -
Ikarus T3.1.1.59.0 2009.06.19 Trojan.Win32.Ertfor
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 Artemis!2D4ED6A285C8
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Drop.Agent.xka
Microsoft 1.4701 2009.06.19 Trojan:Win32/Ertfor.A
NOD32 4171 2009.06.19 Win32/TrojanDownloader.Small.NTQ
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 High Risk Cloaked Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 -
Sunbelt 3.2.1858.2 2009.06.18 Trojan.Win32.Unidentified.VS
Symantec 1.4.4.12 2009.06.19 Packed.Generic.233
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File ld10.exe received on 2009.06.19 13:16:30 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 -
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 -
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 -
BitDefender 7.2 2009.06.19 -
CAT-QuickHeal 10.00 2009.06.19 (Suspicious) - DNAScan
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 -
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 -
GData 19 2009.06.19 -
Ikarus T3.1.1.59.0 2009.06.19 -
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 -
McAfee-GW-Edition 6.7.6 2009.06.19 -
Microsoft 1.4701 2009.06.19 -
NOD32 4171 2009.06.19 -
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 -
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 -
Sunbelt 3.2.1858.2 2009.06.18 -
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

c:\windows\system32\drivers\4511078.sys - file empty
c:\windows\system32\drivers\338988a8.sys - file empty

c:\windows\system32\uacinit.dll - nothing found

File uactmp.db received on 2009.06.19 13:27:06 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Virus.JS.ScriptSH!IK
AhnLab-V3 5.0.0.2 2009.06.19 -
AntiVir 7.9.0.191 2009.06.19 HEUR/HTML.Malware
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 JS:ScriptSH-inf
AVG 8.5.0.339 2009.06.19 -
BitDefender 7.2 2009.06.19 Trojan.Script.74909
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 -
DrWeb 5.0.0.12182 2009.06.19 -
eSafe 7.0.17.0 2009.06.18 -
eTrust-Vet 31.6.6569 2009.06.19 -
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 -
GData 19 2009.06.19 Trojan.Script.74909
Ikarus T3.1.1.59.0 2009.06.19 Virus.JS.ScriptSH
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 -
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 -
McAfee-GW-Edition 6.7.6 2009.06.19 Heuristic.HTML.Malware
Microsoft 1.4701 2009.06.19 -
NOD32 4171 2009.06.19 -
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 -
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 -
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 -
Sunbelt 3.2.1858.2 2009.06.18 -
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 -
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

File fmnupd32.exe received on 2009.06.19 13:46:59 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan-Downloader.Win32.Bredolab!IK
AhnLab-V3 5.0.0.2 2009.06.19 Win-Trojan/Waledoc.30720
AntiVir 7.9.0.191 2009.06.19 TR/Dldr.Bredolab.AA
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 SHeur2.ALMH
BitDefender 7.2 2009.06.19 Trojan.Generic.CJ.BAT
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.06.19 Trojan.Botnetlog.11
eSafe 7.0.17.0 2009.06.18 -
eTrust-Vet 31.6.6569 2009.06.19 Win32/Bredolab.IX
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 W32/PackWaledac.B
GData 19 2009.06.19 Trojan.Generic.CJ.BAT
Ikarus T3.1.1.59.0 2009.06.19 Trojan-Downloader.Win32.Bredolab
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 Generic Downloader.x!fi
McAfee+Artemis 5650 2009.06.18 Generic Downloader.x!fi
McAfee-GW-Edition 6.7.6 2009.06.19 Trojan.Dldr.Bredolab.AA
Microsoft 1.4701 2009.06.19 TrojanDownloader:Win32/Bredolab.G
NOD32 4171 2009.06.19 Win32/TrojanDownloader.Bredolab.AA
Norman 6.01.09 2009.06.19 W32/DLoader.dam
nProtect 2009.1.8.0 2009.06.19 Trojan/W32.Agent.30720.EX
Panda 10.0.0.16 2009.06.19 Suspicious file
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 High Risk Cloaked Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.18 Trojan.Win32.Unidentified.VS
Symantec 1.4.4.12 2009.06.19 -
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 TROJ_BREDOLAB.CH
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 Trojan.Win32.Obfuscator.30720
VirusBuster 4.6.5.0 2009.06.18 -

File zqosys32.exe received on 2009.06.19 13:48:34 (UTC)
Antivirus Version Last Update Result
a-squared 4.5.0.18 2009.06.19 Trojan.Generic.CJ!IK
AhnLab-V3 5.0.0.2 2009.06.19 Win-Trojan/Waledoc.30208.B
AntiVir 7.9.0.191 2009.06.19 -
Antiy-AVL 2.0.3.1 2009.06.19 -
Authentium 5.1.2.4 2009.06.19 -
Avast 4.8.1335.0 2009.06.18 -
AVG 8.5.0.339 2009.06.19 SHeur2.ALPB
BitDefender 7.2 2009.06.19 Trojan.Generic.CJ.AYG
CAT-QuickHeal 10.00 2009.06.19 -
ClamAV 0.94.1 2009.06.19 -
Comodo 1371 2009.06.19 TrojWare.Win32.Trojan.Agent.Gen
DrWeb 5.0.0.12182 2009.06.19 Trojan.Botnetlog.11
eSafe 7.0.17.0 2009.06.18 Win32.TrojanDownload
eTrust-Vet 31.6.6569 2009.06.19 Win32/Bredolab.JA
F-Prot 4.4.4.56 2009.06.19 -
F-Secure 8.0.14470.0 2009.06.18 -
Fortinet 3.117.0.0 2009.06.19 W32/PackWaledac.B
GData 19 2009.06.19 Trojan.Generic.CJ.AYG
Ikarus T3.1.1.59.0 2009.06.19 Trojan.Generic.CJ
Jiangmin 11.0.706 2009.06.19 -
K7AntiVirus 7.10.768 2009.06.19 Trojan.Win32.Malware.1
Kaspersky 7.0.0.125 2009.06.19 -
McAfee 5650 2009.06.18 -
McAfee+Artemis 5650 2009.06.18 Artemis!E56EACDE6210
McAfee-GW-Edition 6.7.6 2009.06.19 Win32.LooksLike.NewMalware
Microsoft 1.4701 2009.06.19 VirTool:Win32/Obfuscator.ES
NOD32 4171 2009.06.19 Win32/TrojanDownloader.Bredolab.AA
Norman 6.01.09 2009.06.19 -
nProtect 2009.1.8.0 2009.06.19 -
Panda 10.0.0.16 2009.06.19 Trj/Agent.MJI
PCTools 4.4.2.0 2009.06.19 -
Prevx 3.0 2009.06.19 Medium Risk Malware
Rising 21.34.44.00 2009.06.19 -
Sophos 4.42.0 2009.06.19 Mal/Generic-A
Sunbelt 3.2.1858.2 2009.06.18 -
Symantec 1.4.4.12 2009.06.19 Trojan.Bredolab
TheHacker 6.3.4.3.348 2009.06.19 -
TrendMicro 8.950.0.1094 2009.06.19 TROJ_DLOADR.AQC
VBA32 3.12.10.7 2009.06.19 -
ViRobot 2009.6.19.1796 2009.06.19 -
VirusBuster 4.6.5.0 2009.06.18 -

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 10 · 2009-06-20T07:18:30+00:00

Please do not change settings (like msconfig) whilst we are in the process of cleaning.

==

1. Please open Notepad Click Start , then Run
Type notepad.exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::



File::

c:\documents and settings\eclark\Start Menu\Programs\Startup\zqosys32.exe

c:\documents and settings\eclark\Start Menu\Programs\Startup\fmnupd32.exe

c:\windows\system32\gsf83iujid.dll

C:\wyhgm.exe

C:\blnqxlg.exe

C:\giyghshu.exe

C:\mupwjiav.exe

C:\chfyosn.exe

C:\oxyyxwn.exe

c:\windows\ld10.exe

c:\windows\system32\drivers\4511078.sys

c:\windows\system32\drivers\338988a8.sys

c:\windows\system32\uactmp.db

c:\windows\system32\drivers\UACetjlabaomktiydv.sys

c:\windows\system32\drivers\SKYNETfwrtnbxd.sys

c:\windows\system32\uacinit.dll

c:\windows\system32\uactmp.db

c:\windows\system32\UAChmtnmhlhohfnxql.dll

c:\windows\system32\UACdpvfvppjduckxej.dat

c:\windows\system32\UACtyvkalcctsufndv.dll

c:\windows\system32\UACrkmnujnmsoynocn.dll

c:\windows\system32\UACwsgvarqgapvgoer.dll

c:\windows\system32\UACgxnweyyebrpavkr.db

c:\windows\system32\UACkaafkkerqmyugky.dll

c:\windows\system32\UACfrdxdijbmienkkc.dll

c:\windows\system32\UACclxiadafsuramlc.log

c:\windows\system32\SKYNETuwvxqenj.dll

c:\windows\system32\SKYNETigvfhrlw.dat

c:\windows\system32\SKYNETdcjtddco.dll

c:\windows\system32\UACkayjswbtkenbnjj.dat

c:\windows\system32\UACtqoaqvfhixngumr.log

c:\docume~1\eclark\LOCALS~1\Temp\UAC8e2e.tmp

c:\docume~1\eclark\LOCALS~1\Temp\UACd28c.tmp

c:\docume~1\eclark\LOCALS~1\Temp\UAC9f42.tmp

Driver::

338988a8.sys

4511078.sys



Registry::

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]

"{B2C7B2A1-00F3-42BD-F434-00AABA2C8952}"=-



[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B2C7B2A1-00F3-42BD-F434-00AABA2C8952}]

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter youre-enable all the programs that were disabled during the running of ComboFix:Combofix.txt
A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

tube 0 Newbie Poster · Answer 11 · 2009-06-20T23:42:44+00:00

ComboFix 09-06-19.01 - eclark 06/20/2009 10:08.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.502.119 [GMT -4:00]
Running from: c:\documents and settings\eclark\Desktop\cf.exe
Command switches used :: c:\documents and settings\eclark\Desktop\cfscript.txt
AV: Symantec AntiVirus Corporate Edition *On-access scanning disabled* (Outdated) {FB06448E-52B8-493A-90F3-E43226D3305C}

FILE ::
"C:\blnqxlg.exe"
"C:\chfyosn.exe"
"c:\docume~1\eclark\LOCALS~1\Temp\UAC8e2e.tmp"
"c:\docume~1\eclark\LOCALS~1\Temp\UAC9f42.tmp"
"c:\docume~1\eclark\LOCALS~1\Temp\UACd28c.tmp"
"c:\documents and settings\eclark\Start Menu\Programs\Startup\fmnupd32.exe"
"c:\documents and settings\eclark\Start Menu\Programs\Startup\zqosys32.exe"
"C:\giyghshu.exe"
"C:\mupwjiav.exe"
"C:\oxyyxwn.exe"
"c:\windows\ld10.exe"
"c:\windows\system32\drivers\338988a8.sys"
"c:\windows\system32\drivers\4511078.sys"
"c:\windows\system32\drivers\SKYNETfwrtnbxd.sys"
"c:\windows\system32\drivers\UACetjlabaomktiydv.sys"
"c:\windows\system32\gsf83iujid.dll"
"c:\windows\system32\SKYNETdcjtddco.dll"
"c:\windows\system32\SKYNETigvfhrlw.dat"
"c:\windows\system32\SKYNETuwvxqenj.dll"
"c:\windows\system32\UACclxiadafsuramlc.log"
"c:\windows\system32\UACdpvfvppjduckxej.dat"
"c:\windows\system32\UACfrdxdijbmienkkc.dll"
"c:\windows\system32\UACgxnweyyebrpavkr.db"
"c:\windows\system32\UAChmtnmhlhohfnxql.dll"
"c:\windows\system32\uacinit.dll"
"c:\windows\system32\UACkaafkkerqmyugky.dll"
"c:\windows\system32\UACkayjswbtkenbnjj.dat"
"c:\windows\system32\UACrkmnujnmsoynocn.dll"
"c:\windows\system32\uactmp.db"
"c:\windows\system32\UACtqoaqvfhixngumr.log"
"c:\windows\system32\UACtyvkalcctsufndv.dll"
"c:\windows\system32\UACwsgvarqgapvgoer.dll"
"C:\wyhgm.exe"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\driver
c:\program files\WinPCap
c:\program files\WinPCap\daemon_mgm.exe
c:\program files\WinPCap\npf_mgm.exe
c:\program files\WinPCap\rpcapd.exe
c:\windows\system32\drivers\npf.sys
c:\windows\system32\drivers\SKYNETfwrtnbxd.sys
c:\windows\system32\drivers\UACetjlabaomktiydv.sys
c:\windows\system32\Packet.dll
c:\windows\system32\pthreadVC.dll
c:\windows\system32\UACclxiadafsuramlc.log
c:\windows\system32\UACdpvfvppjduckxej.dat
c:\windows\system32\UACfrdxdijbmienkkc.dll
c:\windows\system32\UACgxnweyyebrpavkr.db
c:\windows\system32\UAChmtnmhlhohfnxql.dll
c:\windows\system32\UACkaafkkerqmyugky.dll
c:\windows\system32\UACrkmnujnmsoynocn.dll
c:\windows\system32\UACtyvkalcctsufndv.dll
c:\windows\system32\UACuyxjsoflxlbyttu.log
c:\windows\system32\UACvrvltqnakqynrbg.log
c:\windows\system32\UACwsgvarqgapvgoer.dll
c:\windows\system32\WanPacket.dll
c:\windows\system32\wpcap.dll
c:\windows\TEMP\SKYNETeloidbiyor.tmp
c:\windows\TEMP\SKYNETrfmnpikoss.tmp
c:\windows\TEMP\SKYNETtrpowpqqxt.tmp
C:\blnqxlg.exe
C:\chfyosn.exe
c:\docume~1\eclark\LOCALS~1\Temp\UAC8e2e.tmp
c:\docume~1\eclark\LOCALS~1\Temp\UAC9f42.tmp
c:\docume~1\eclark\LOCALS~1\Temp\UACd28c.tmp
c:\documents and settings\eclark\Application Data\wiaserva.log
c:\documents and settings\eclark\Application Data\wiaservg.log
c:\documents and settings\eclark\Start Menu\Programs\Startup\fmnupd32.exe
c:\documents and settings\eclark\Start Menu\Programs\Startup\zqosys32.exe
C:\giyghshu.exe
C:\mupwjiav.exe
C:\oxyyxwn.exe
c:\program files\driver\driver.dll
c:\program files\driver\driver.sys
c:\program files\Novell\ZENworks\ZENNW32.DLL
C:\tj.vbs
c:\windows\ld10.exe
c:\windows\system32\drivers\338988a8.sys
c:\windows\system32\drivers\4511078.sys
c:\windows\system32\drivers\771b71c2.sys
c:\windows\system32\drivers\SKYNETfwrtnbxd.sys
c:\windows\system32\drivers\UACetjlabaomktiydv.sys
c:\windows\system32\gsf83iujid.dll
c:\windows\system32\setup.ini
c:\windows\system32\SKYNETdcjtddco.dll
c:\windows\system32\SKYNETigvfhrlw.dat
c:\windows\system32\SKYNETuwvxqenj.dll
c:\windows\system32\UACclxiadafsuramlc.log
c:\windows\system32\UACdpvfvppjduckxej.dat
c:\windows\system32\UACfrdxdijbmienkkc.dll
c:\windows\system32\UACgxnweyyebrpavkr.db
c:\windows\system32\UAChmtnmhlhohfnxql.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACkaafkkerqmyugky.dll
c:\windows\system32\UACkayjswbtkenbnjj.dat
c:\windows\system32\UACrkmnujnmsoynocn.dll
c:\windows\system32\uactmp.db
c:\windows\system32\UACtqoaqvfhixngumr.log
c:\windows\system32\UACtyvkalcctsufndv.dll
c:\windows\system32\UACuyxjsoflxlbyttu.log
c:\windows\system32\UACvrvltqnakqynrbg.log
c:\windows\system32\UACwsgvarqgapvgoer.dll
c:\windows\system32\wbem\proquota.exe
c:\windows\Temp\111919343.exe
c:\windows\Temp\1151178089.exe
c:\windows\Temp\1226218085.exe
c:\windows\Temp\1282191847.exe
c:\windows\Temp\1954684621.exe
c:\windows\Temp\1963856083.exe
c:\windows\Temp\3213340111.exe
c:\windows\Temp\3838976071.exe
c:\windows\Temp\3938547317.exe
c:\windows\Temp\4113223857.exe
c:\windows\Temp\417707819.exe
c:\windows\Temp\451109057.exe
c:\windows\Temp\528805303.exe
c:\windows\Temp\841363375.exe
c:\windows\TEMP\csrss.exe
c:\windows\TEMP\lsass.exe
c:\windows\TEMP\services.exe
c:\windows\TEMP\svchost.exe
c:\windows\TEMP\taskmgr.exe
c:\windows\TEMP\winlogon.exe
c:\windows\zaponce52689.dat
C:\wyhgm.exe

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys
-------\Legacy_ATI64SI
-------\Legacy_NPF
-------\Legacy_SAMSSSHELLHWDETECTION
-------\Service_SamSsShellHWDetection
-------\Service_771b71c2

((((((((((((((((((((((((( Files Created from 2009-05-20 to 2009-06-20 )))))))))))))))))))))))))))))))
.

2009-06-20 14:20 . 2009-06-20 14:20 -------- d-----w- c:\windows\LastGood
2009-06-20 14:15 . 2009-06-20 14:15 -------- d-sh--w- C:\FOUND.005
2009-06-19 03:48 . 2009-06-19 03:48 -------- d-----w- c:\documents and settings\eclark\Application Data\Desktopicon
2009-06-19 03:48 . 2009-06-19 03:48 -------- d-----w- c:\program files\Unlocker
2009-06-18 03:15 . 2009-06-18 03:15 65536 ---ha-w- C:\aaw7boot.cmd
2009-06-18 00:55 . 2009-06-18 00:55 2 ----a-w- c:\windows\010112010146118114.dat
2009-06-17 11:40 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:40 . 2009-06-17 11:40 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-17 11:40 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-17 11:22 . 2009-06-17 11:22 -------- d-----w- c:\program files\Trend Micro
2009-06-17 11:17 . 2009-06-17 11:17 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-11 12:12 . 2009-06-11 12:12 -------- d-sh--w- C:\FOUND.004
2009-06-09 01:54 . 1998-10-07 21:15 122832 ----a-w- c:\windows\uninstal.exe
2009-06-09 01:54 . 2009-06-09 01:54 -------- d-----w- C:\MDS
2009-06-08 10:20 . 2009-06-08 10:20 -------- d-----w- c:\documents and settings\eclark\IGC
2009-06-08 02:41 . 2003-05-28 16:19 245408 ------r- c:\windows\system32\unicows.dll
2009-06-08 02:41 . 2009-06-08 02:41 -------- d-----w- c:\program files\IGC
2009-06-01 02:58 . 2009-06-01 02:58 314200 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\threatwork.exe
2009-06-01 02:58 . 2009-06-01 02:58 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\savapibridge.dll
2009-06-01 02:58 . 2009-06-01 02:58 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavamessage.dll
2009-06-01 02:58 . 2009-06-01 02:58 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lsdelete.exe
2009-06-01 02:58 . 2009-06-01 02:58 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\lavalicense.dll
2009-06-01 02:58 . 2009-06-01 02:58 294240 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\UpdateManager.dll
2009-06-01 02:58 . 2009-06-01 02:58 83808 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\ShellExt.dll
2009-06-01 02:58 . 2009-06-01 02:58 1630048 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Resources.dll
2009-06-01 02:57 . 2009-06-01 02:57 212848 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\RPAPI.dll
2009-06-01 02:57 . 2009-06-01 02:57 640360 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\CEAPI.dll
2009-06-01 02:57 . 2009-06-01 02:57 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\PrivacyClean.dll
2009-06-01 02:57 . 2009-06-01 02:57 540536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareCommand.exe
2009-06-01 02:57 . 2009-06-01 02:57 559464 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-AwareAdmin.exe
2009-06-01 02:57 . 2009-06-01 02:57 2352456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Ad-Aware.exe
2009-06-01 02:57 . 2009-06-01 02:57 627536 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWWSC.exe
2009-06-01 02:57 . 2009-06-01 02:57 518488 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWTray.exe
2009-06-01 02:57 . 2009-06-01 02:57 1005904 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\AAWService.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-20 14:28 . 2009-05-12 00:39 117760 ----a-w- c:\documents and settings\eclark\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-06-18 01:05 . 2006-08-22 02:30 90112 ----a-w- c:\windows\DUMP689d.tmp
2009-06-17 02:07 . 2006-08-22 02:30 90112 ----a-w- c:\windows\DUMP10d8.tmp
2009-06-16 12:18 . 2006-08-22 02:30 90112 ----a-w- c:\windows\DUMP106b.tmp
2009-06-16 03:58 . 2006-08-22 02:30 90112 ----a-w- c:\windows\DUMP4b60.tmp
2009-06-01 02:58 . 2009-05-11 12:17 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-05-28 19:47 . 2009-05-09 21:32 145 --s-a-w- c:\windows\system32\2009931927.dat
2009-05-18 00:22 . 2009-05-18 00:22 -------- d-----w- c:\program files\Enigma Software Group
2009-05-12 18:00 . 2009-05-12 18:00 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-05-12 17:52 . 2009-05-12 17:52 -------- d-----w- c:\program files\Edgenet
2009-05-12 03:02 . 2009-05-12 03:02 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\Update\Drivers\32\lbd.sys
2009-05-12 03:02 . 2009-05-11 02:56 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-05-12 00:37 . 2009-05-12 00:37 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-05-12 00:36 . 2009-05-12 00:36 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-05-12 00:36 . 2009-05-12 00:36 -------- d-----w- c:\documents and settings\eclark\Application Data\SUPERAntiSpyware.com
2009-05-12 00:35 . 2009-05-12 00:35 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-05-11 23:10 . 2009-05-11 23:10 1341005 ----a-w- C:\MGtools.exe
2009-05-11 22:29 . 2009-05-11 22:29 -------- d-----w- c:\program files\CCleaner
2009-05-11 02:55 . 2009-05-11 02:55 -------- d--h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-11 02:55 . 2009-05-11 02:55 -------- d-----w- c:\program files\Lavasoft
2009-05-11 02:55 . 2009-05-11 02:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-05-10 19:04 . 2009-05-10 19:04 -------- d-----w- c:\program files\Xvid
2009-04-13 08:00 . 2009-04-19 17:31 259368 ----a-w- c:\documents and settings\All Users\Application Data\Symantec\Symantec AntiVirus Corporate Edition\7.5\I2_LDVP.VDB\vd2d1a03.vdb\ECMSVR32.DLL
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"superantispyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-04-28 1830128]
"msmsgs"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"launchapp"="Alaunch" [X]
"MSConfig"="c:\windows\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 158208]
"zenrc tray icon"="c:\windows\system32\zentray.exe" [2003-03-18 40960]
"vptray"="c:\progra~1\SYMANT~1\VPTray.exe" [2006-09-28 125168]
"syntplpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2005-01-08 102491]
"syntpenh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-01-08 692315]
"sunjavaupdatesched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-20 136600]
"remotecontrol"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-03 32768]
"quicktime task"="c:\program files\QuickTime\qttask.exe" [2008-12-19 77824]
"phime2002async"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"phime2002a"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"ntimui"="c:\program files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe" [2005-05-11 45056]
"lmanager"="c:\progra~1\LAUNCH~1\QtZgAcer.EXE" [2006-03-30 471040]
"isuspm"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-12-12 208896]
"imageitencrypt"="c:\windows\system32\ImageItEncrypt.exe" [2005-12-30 40960]
"hpwutoolbox"="c:\program files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe" [2005-07-23 352256]
"erecoveryservice"="c:\acer\Empowering Technology\eRecovery\eRAgent.exe" [2006-04-28 401408]
"edatasecurity loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [BU]
"ccapp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-07-19 52896]
"azmixersel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2005-08-25 53248]
"ad-watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-01 518488]
"NWTRAY"="NWTRAY.EXE" - c:\windows\system32\nwtray.exe [2002-03-12 28672]
"rthdcpl"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-02-27 16005120]
"agrsmmsg"="AGRSMMSG.exe" - c:\windows\AGRSMMSG.exe [2006-03-16 88204]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Novell\\GroupWise\\grpwise.exe"=
"c:\\Novell\\GroupWise\\notify.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/10/2009 10:56 PM 64160]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [4/28/2009 11:33 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [4/28/2009 11:33 AM 72944]
R2 BlankScr;HBDevice;c:\windows\system32\drivers\blankscr.sys [3/18/2003 6:26 PM 4768]
R2 Kblock;Kblock;c:\windows\system32\drivers\kblock.sys [3/18/2003 3:16 PM 4043]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1005904]
R2 M2o Online Services Agent;M2o Online Services Agent;c:\program files\Edgenet\Reeb\M2oAgent.exe [10/22/2008 1:21 PM 9216]
R2 Mouslock;Mouslock;c:\windows\system32\drivers\mouslock.sys [3/18/2003 3:16 PM 4080]
R2 Prometheus Wake-On-LAN Status Agent;Novell ZfD Wake on LAN Status Agent;c:\program files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe [3/18/2003 2:40 PM 49152]
R2 Remote Management Agent;Novell ZfD Remote Management;c:\program files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe [3/18/2003 2:39 PM 131072]
R2 SavRoam;SAVRoam;c:\program files\Symantec AntiVirus\SavRoam.exe [9/27/2006 8:33 PM 116464]
R3 Darpan;Darpan;c:\windows\system32\drivers\Darpan.sys [3/18/2003 3:14 PM 2773]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [3/9/2009 9:59 AM 101936]
R3 nscmnt;Novell Local Security Context Manager;c:\windows\system32\drivers\Novell\nscmnt.sys [7/12/2002 11:36 AM 17984]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [4/28/2009 11:33 AM 7408]
R3 xauthnt;Novell XTier Authentication Service;c:\windows\system32\drivers\Novell\xauthnt.sys [6/17/2002 4:32 PM 7728]
S1 84c06b7d;84c06b7d;c:\windows\system32\drivers\84c06b7d.sys --> c:\windows\system32\drivers\84c06b7d.sys [?]
S2 eLock2BurnerLockDriver;eLock2BurnerLockDriver;\??\c:\windows\system32\eLock2BurnerLockDriver.sys --> c:\windows\system32\eLock2BurnerLockDriver.sys [?]
S2 eLock2FSCTLDriver;eLock2FSCTLDriver;\??\c:\windows\system32\eLock2FSCTLDriver.sys --> c:\windows\system32\eLock2FSCTLDriver.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-06-16 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:57]
.
.
------- Supplementary Scan -------
.
uStart Page = google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-20 10:27
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(472)
c:\windows\system32\NETWIN32.DLL
c:\program files\Novell\ZENworks\ZENPOL32.DLL
c:\program files\Novell\ZENworks\ZenLite.dll
c:\windows\system32\xmlparse.dll
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Symantec Shared\ccSetMgr.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Symantec AntiVirus\DefWatch.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Novell\ZENworks\nalntsrv.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Novell\ZENworks\wm.exe
c:\program files\Common Files\Symantec Shared\ccEvtMgr.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Symantec AntiVirus\DoScan.exe
c:\windows\system32\igfxext.exe
c:\windows\system32\igfxsrvc.exe
.
**************************************************************************
.
Completion time: 2009-06-20 10:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-20 14:32
ComboFix2.txt 2009-06-19 12:08

Pre-Run: 32,543,604,736 bytes free
Post-Run: 32,375,242,752 bytes free

339 --- E O F --- 2009-04-15 07:04

___________________________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:40:17 PM, on 6/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Edgenet\Reeb\M2oAgent.exe
C:\Program Files\Novell\ZENworks\nalntsrv.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Novell\ZENworks\wm.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\QuickTime\qttask.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe
C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\system32\igfxext.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\logThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [zenrc tray icon] C:\WINDOWS\system32\zentray.exe
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [syntplpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [syntpenh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [sunjavaupdatesched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [rthdcpl] RTHDCPL.EXE
O4 - HKLM\..\Run: [remotecontrol] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [quicktime task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [phime2002async] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [phime2002a] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [ntimui] C:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [lmanager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [launchapp] Alaunch
O4 - HKLM\..\Run: [isuspm] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKLM\..\Run: [imageitencrypt] C:\WINDOWS\system32\ImageItEncrypt.exe
O4 - HKLM\..\Run: [hpwutoolbox] C:\Program Files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe "-i"
O4 - HKLM\..\Run: [erecoveryservice] C:\Acer\Empowering Technology\eRecovery\eRAgent.exe
O4 - HKLM\..\Run: [edatasecurity loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe 0
O4 - HKLM\..\Run: [ccapp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [azmixersel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [agrsmmsg] AGRSMMSG.exe
O4 - HKLM\..\Run: [ad-watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [superantispyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [msmsgs] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: M2o Online Services Agent - Edgenet Inc. - C:\Program Files\Edgenet\Reeb\M2oAgent.exe
O23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exe
O23 - Service: Novell ZfD Wake on LAN Status Agent (Prometheus Wake-On-LAN Status Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\WolSerNT.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Novell ZfD Remote Management (Remote Management Agent) - Novell Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Workstation Manager (ZFDWM) - Novell, INC. - C:\Program Files\Novell\ZENworks\wm.exe

--
End of file - 8861 bytes

__________________________________________________

THANKS FOR THE HELP

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 12 · 2009-06-21T06:58:12+00:00

Fair bit more deleted that time.

Please Run the ESET Online Scanner and post the ScanLog with your post for assistance.

You will need to use Internet Explorer to complete this scan.
You will need to temporarily Disable your current Anti-virus program.
Be sure the option to Remove found threats is Un-checked at this time (we may have it clean what it finds at a later time), and the option to Scan unwanted applications is Checked.
When you have completed that scan, a scanlog ought to have been created and located at C:\Program Files\EsetOnlineScanner\log.txt. Please post that log for us as directed below.

NOTE: If you are unable to complete the ESET scan, please try another from the list below:

• Kaspersky Online Scanner • Panda Active Scan • Trend Micro HouseCall • F-Secure Online Virus Scanner