Hi, just surfed this site (and only this thread) since this morning because I have the same Trojan problem. It's really frustrating and, yes, lots of anti-virus and malware removal tools can't detect it (I'm using AVG 8.5). However, I just tried out Combofix, the latest solution provided by member 'crunchie' and it worked! It could detect the \hjgruixxxxxxxxx.dll things and cleaned them. Combofix asked me to turn off AVG anti-virus and anti-spyware but I couldn't find a way to disable them. Well, I proceeded with Combofix nevertheless.
It seems that my computer is back to normal but I don't know whether there will be any system instability due to the active AVG during the Combofix scanning process.
Here's the log:
ComboFix 09-07-05.03 - Teddy 7/2009 Mon 23:34.1 - NTFSx86
Running from: c:\users\Teddy\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
/wow section - STAGE 3
The syntax of the command is incorrect.
PEV Error: DesktopFile
PEV Error: DesktopFolder
PEV Error: FavFile
PEV Error: LocalAppDataFile
PEV Error: LocalAppDataFolder
PEV Error: LocalSettingsFile
PEV Error: MenuFile
PEV Error: MenuFolder
PEV Error: PersonalFile
PEV Error: StartUpFile
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1373282975-3817935305-1639791119-500
c:\$recycle.bin\S-1-5-21-4250835916-1544608186-4155006228-500
C:\resycled
c:\windows\Installer\f584a6e.msi
c:\windows\system32\drivers\hjgruiljqpcxnp.sys
c:\windows\system32\hjgruidwxdenom.dll
c:\windows\system32\hjgruilog.dat
c:\windows\system32\hjgruipipekudb.dat
c:\windows\system32\hjgruirwgbmxbt.dat
c:\windows\system32\hjgruitfiuqour.dll
D:\resycled
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_hjgruinkvcfyxe
-------\Service_Windows Tribute Service
((((((((((((((((((((((((( Files Created from 2009-06-06 to 2009-07-06 )))))))))))))))))))))))))))))))
.
2009-07-06 15:44 . 2009-07-06 15:46 -------- d-----w- c:\users\Teddy\AppData\Local\temp
2009-07-05 15:25 . 2009-07-05 15:26 289343794 ----a-w- c:\users\Teddy\registrybackup.reg
2009-07-04 17:19 . 2009-07-05 00:47 -------- d-----w- c:\users\Teddy\AppData\Roaming\DMCache
2009-07-03 07:50 . 2009-07-03 07:50 390664 ----a-w- c:\users\Teddy\AppData\Roaming\Real\RealPlayer\Update\realplayer11gold.exe
2009-06-27 03:00 . 2009-06-27 03:00 -------- d-----w- c:\users\Teddy\AppData\Local\AVG Security Toolbar
2009-06-27 00:16 . 2009-06-27 00:14 832144 ----a-w- c:\programdata\avg8\update\backup\AVGToolbarInstall.exe
2009-06-27 00:16 . 2009-06-27 00:16 -------- d-----w- c:\programdata\AVG Security Toolbar
2009-06-23 06:20 . 2008-03-17 03:05 101632 ----a-w- c:\windows\system32\drivers\ewusbmdm.sys
2009-06-23 06:19 . 2009-06-26 17:30 -------- d-----w- c:\program files\BroadBand on Mobile
2009-06-14 10:27 . 2009-05-09 05:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-06-14 10:27 . 2009-05-09 05:50 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-14 09:58 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-14 09:58 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-10 12:15 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-10 12:15 . 2009-04-23 12:42 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-10 12:15 . 2009-04-23 12:43 784896 ----a-w- c:\windows\system32\rpcrt4.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-06 15:45 . 2007-07-14 02:06 2484 ----a-w- c:\windows\bthservsdp.dat
2009-07-06 14:42 . 2008-09-02 16:30 -------- d-----w- c:\programdata\avg8
2009-07-05 03:47 . 2008-02-29 09:14 1356 ----a-w- c:\users\Teddy\AppData\Local\d3d9caps.dat
2009-07-03 07:20 . 2007-08-27 13:47 -------- d-----w- c:\program files\iTunes
2009-07-03 07:20 . 2007-08-26 15:03 -------- d-----w- c:\program files\Common Files\Apple
2009-07-03 07:18 . 2007-08-25 17:21 -------- d-----w- c:\program files\QuickTime
2009-06-27 00:15 . 2008-09-02 16:30 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-06-27 00:15 . 2008-09-02 16:30 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-27 00:15 . 2008-09-02 16:30 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-10 19:08 . 2007-06-27 11:36 -------- d-----w- c:\program files\Microsoft Works
2009-05-23 18:59 . 2009-05-23 18:59 -------- d-----w- c:\program files\Common Files\xing shared
2009-05-23 18:59 . 2007-08-22 18:41 -------- d-----w- c:\program files\Common Files\Real
2009-05-13 19:01 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-04-25 12:58 . 2009-04-25 12:57 794624 ----a-w- c:\users\Teddy\fairPLAYLite.exe
2007-08-10 02:43 . 2007-08-10 02:43 22 --sha-w- c:\windows\SMINST\HPCD.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-06-14 08:07 1004800 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"ISUSPM"="c:\programdata\Macrovision\FLEXnet Connect\6\ISUSPM.exe" [2007-03-29 222128]
"VMCL"="c:\program files\vodafone\vmclite\DongleEnumerator.exe" [2007-09-20 131072]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-03-11 159744]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2007-02-12 174872]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-02-13 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"MSConfig"="c:\windows\system32\msconfig.exe" [2008-01-19 227840]
"OpwareSE4"="c:\program files\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 79400]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2006-11-02 215552]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-11 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-11 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-11 133656]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-14 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-05-23 198160]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-27 1948440]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup
[HKLM\~\startupfolder\C:^Users^Teddy^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^MediaRing Talk.lnk]
backup=c:\windows\pss\MediaRing Talk.lnk.Startup
backupExtension=.Startup
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
"QPService"="c:\program files\HP\QuickPlay\QPService.exe"
"SSBkgdUpdate"="c:\program files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UacDisableNotify"=dword:00000001
"InternetSettingsDisableNotify"=dword:00000001
"AutoUpdateDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{1E1A9575-8314-4898-AE26-3C28669DFB1C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{EC60616E-B239-4B2D-9CB6-F3CCB2A1B6EC}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{84B81911-214E-4D82-97DC-4C0A47797021}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{E2F53BC3-060F-4B97-A66F-0419DBA12F4B}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7541F28C-8678-448F-BBE0-E5C58FCB5DD2}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{CB2E8E58-2F7A-43B9-BBB5-763F5D0E8494}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{781F17D9-33AF-4DC7-AB05-E51C3F6B1FBC}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{4A237335-AE1D-4636-B06D-75D785A0B05F}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{C6D24359-B26B-4BA9-AEEB-CA066A35FFB9}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{2D61D60E-E700-4CCC-965A-F6A13943C241}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{0218F6EA-6DF2-4D76-A41F-2D770C6B14E2}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{4553DAEB-4238-416C-89A1-77935FCBDE7C}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{F61F0608-DA68-41A5-89EF-A19DE4C3EDE5}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= UDP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"UDP Query User{49291827-DE44-436B-9B82-3C5AD1DEAF52}c:\\program files\\yahoo!\\messenger\\yahoomessenger.exe"= TCP:c:\program files\yahoo!\messenger\yahoomessenger.exe:Yahoo! Messenger
"TCP Query User{5335C147-2958-4699-96BD-7E58E2E6A1E9}c:\\program files\\wizet\\maplestory\\maplestory.exe"= UDP:c:\program files\wizet\maplestory\maplestory.exe:MapleStory
"UDP Query User{593955A0-9A57-4B0D-9335-BFC0427FFC06}c:\\program files\\wizet\\maplestory\\maplestory.exe"= TCP:c:\program files\wizet\maplestory\maplestory.exe:MapleStory
"TCP Query User{DCB0C1FF-2BBF-48EB-8151-A9FDC5F13DAC}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{3655E783-B70D-4552-BF39-192EDCB73F1A}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"{C581AD42-04A6-4970-AE4F-9165990238FF}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{5C189397-16E9-4FD0-A3C6-61D607ADDC8B}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{2781D9B1-547B-42C8-B495-B86BBC66E60A}c:\\program files\\hp\\hp software update\\hpwucli.exe"= UDP:c:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
"UDP Query User{4F7726E8-CA12-42F2-B80F-CDED188E3DEA}c:\\program files\\hp\\hp software update\\hpwucli.exe"= TCP:c:\program files\hp\hp software update\hpwucli.exe:HP Software Update Client
"TCP Query User{00ADC9B6-E235-4BD2-BB48-035FE467AB93}c:\\program files\\softnyx\\gunboundwc\\gunbound.gme"= UDP:c:\program files\softnyx\gunboundwc\gunbound.gme:GunBound
"UDP Query User{C2BD1CDA-07C7-4764-8B8B-A5FF763E6733}c:\\program files\\softnyx\\gunboundwc\\gunbound.gme"= TCP:c:\program files\softnyx\gunboundwc\gunbound.gme:GunBound
"TCP Query User{EF6408B3-5E12-430C-B950-3511FA713958}c:\\program files\\softnyx\\gunboundwc\\gunbound.gme"= UDP:c:\program files\softnyx\gunboundwc\gunbound.gme:GunBound
"UDP Query User{32A5EC90-CFF9-4086-ACC3-A908BCB58910}c:\\program files\\softnyx\\gunboundwc\\gunbound.gme"= TCP:c:\program files\softnyx\gunboundwc\gunbound.gme:GunBound
"TCP Query User{27131598-B8D2-40B4-99BA-776E66C37013}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{4EB0BFBC-2723-436D-9820-42C9CCDFBAD3}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{4B869771-8E6F-4571-A82B-A040714C8132}c:\\program files\\real\\realplayer\\realplay.exe"= UDP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"UDP Query User{9E439FE5-4A83-4B0F-9825-DD8A8E222C2B}c:\\program files\\real\\realplayer\\realplay.exe"= TCP:c:\program files\real\realplayer\realplay.exe:RealPlayer
"{DA2C4879-54BA-4BEF-809F-08CC19E7302D}"= UDP:c:\program files\DNA\btdna.exe:DNA
"{AFA950A8-0ACC-4D4C-956C-7943AAF7B5D3}"= TCP:c:\program files\DNA\btdna.exe:DNA
"TCP Query User{CC00A38D-CABB-4113-88E0-A79D9ED09908}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{E21F0D21-F4AB-442E-8BA5-8938D00C22E8}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{2694E5E8-5AC1-457D-B480-3A24A6416CF5}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{441002C2-52D7-429C-861A-6411CAE9E75B}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"TCP Query User{6922DF0A-A030-4703-AA95-A0485EAB0FB8}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{10F9BFDD-6BB7-491B-B893-4D5C7AC7B7D3}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{6D0C4FD7-5DD4-4944-B439-420AB4D1BD78}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"TCP Query User{F270D1CE-477D-411C-B2B2-2F0F01D85C99}c:\\program files\\free music zilla\\fmzilla.exe"= UDP:c:\program files\free music zilla\fmzilla.exe:FMZilla Module
"UDP Query User{0DBDAC8F-3E7B-4225-8F57-1EF3603A2B7F}c:\\program files\\free music zilla\\fmzilla.exe"= TCP:c:\program files\free music zilla\fmzilla.exe:FMZilla Module
"TCP Query User{B8256F91-E1C7-4E03-9265-86A26EE1EBF7}c:\\program files\\free music zilla\\fmzilla.exe"= UDP:c:\program files\free music zilla\fmzilla.exe:FMZilla Module
"UDP Query User{EE195CD3-3583-4DAD-AF77-CF0BE550E79E}c:\\program files\\free music zilla\\fmzilla.exe"= TCP:c:\program files\free music zilla\fmzilla.exe:FMZilla Module
"TCP Query User{0FE41BFE-5409-4DEA-B0C9-683A0BFBC2B1}c:\\program files\\guilty gear xx #reload\\ggxx.exe"= UDP:c:\program files\guilty gear xx #reload\ggxx.exe:GUILTYGEAR XX #RELOAD
"UDP Query User{6AFDA57E-88D5-46EC-A836-6BBCDD42BDED}c:\\program files\\guilty gear xx #reload\\ggxx.exe"= TCP:c:\program files\guilty gear xx #reload\ggxx.exe:GUILTYGEAR XX #RELOAD
"{6504F4AB-A88A-4B15-94E6-FDB72C16D0D2}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{9BB40EF3-CE45-47A0-942B-55779D020E55}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B0C5D66E-7D29-40C2-8726-728D290CF70A}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{C9B4F44F-F3EE-4082-BB05-7947C7D353B8}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [3/9/2008 12:30 AM 327688]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [3/9/2008 12:30 AM 298776]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder
2009-07-06 c:\windows\Tasks\User_Feed_Synchronization-{FF3D8B9D-A567-477B-B85E-A156E47C90B1}.job
- c:\windows\system32\msfeedssync.exe [2009-06-14 11:31]
.
.
------- Supplementary Scan -------
.
mStart Page = about:blank
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*[url]http://www.yahoo.com/ext/search/search.html[/url]
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*[url]http://www.yahoo.com[/url]
IE: Download all links using BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: Download link using &BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Teddy\AppData\Roaming\Mozilla\Firefox\Profiles\c4ga0obx.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.live.com/results.aspx?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://go.microsoft.com/fwlink/?LinkId=69157
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [url]http://www.gmer.net[/url]
Rootkit scan 2009-07-06 23:46
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'Explorer.exe'(2320)
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\audiodg.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\windows\System32\conime.exe
c:\windows\System32\igfxsrvc.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\windows\ehome\ehmsas.exe
c:\windows\System32\wbem\unsecapp.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\System32\wbem\WMIADAP.exe
.
**************************************************************************
.
Completion time: 2009-07-06 23:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-06 15:54
Pre-Run: 36,306,673,664 bytes free
Post-Run: 36,196,237,312 bytes free
308 --- E O F --- 2009-07-01 06:18
Thanks a lot for crunchie. Keep up the good work.
