unsure what is wrong please help thanx

Question

truguate 0 Light Poster

16 Years Ago

Logfile of HijackThis v1.99.1
Scan saved at 10:28:44 PM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\PerfMon\perfmon32.exe
C:\WINDOWS\mgrs.exe
C:\WINDOWS\lsass.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\avp.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
D:\Program Files\ORL\VNC\WinVNC.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\shell.exe
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {38E86343-7C8A-40F7-9B2E-740CB67C3722} - C:\Program Files\Outlook Express\hokewokes4444.dll
O2 - BHO: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC} - C:\Program Files\Outlook Express\hokewokes83122.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [CheckWinPerf] "C:\Program Files\PerfMon\perfmon32.exe"
O4 - HKLM\..\Run: [smgr] mgrs.exe
O4 - HKLM\..\Run: [lsass] C:\WINDOWS\lsass.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [f419baca] rundll32.exe "C:\WINDOWS\system32\__c006A691.dat",b
O4 - HKLM\..\Run: [Printer] C:\WINDOWS\system32\printer.exe
O4 - HKLM\..\Run: [LanzarT2006] "C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\T2006tmp\Install.exe" /SETUP:"/l0x0009"
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Spoolsv] C:\WINDOWS\system32\spoolvs.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: findfast.exe
O4 - Startup: Run WinVNC (App Mode).lnk = D:\Program Files\ORL\VNC\WinVNC.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: autorun.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: hadjeijh - C:\WINDOWS\system32\hadjeijh.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: VESWinlogon - C:\WINDOWS\SYSTEM32\VESWinlogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O20 - Winlogon Notify: __c005877C - C:\WINDOWS\system32\__c005877C.dat
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Unknown owner - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe (file missing)
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

windows-virus

3 Contributors
33 Replies
511 Views
2 Weeks Discussion Span
Latest Post 16 Years Ago Latest Post by crunchie

All 33 Replies

crunchie 990 Most Valuable Poster

16 Years Ago

Download
SDFix
and save it to your desktop.

Please then reboot your computer in Safe Mode by doing the
following :

Restart your computer
After hearing your computer beep once during startup, but before the
Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

In Safe Mode, right click the SDFix.zip folder and choose Extract
All,
Open the extracted folder and double click RunThis.bat to
start the script.
Type Y to begin the script.
It will remove the Trojan Services then make some repairs to the
registry and prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
Your system will take longer that normal to restart as the fixtool
will be running and removing files.
When the desktop loads the Fixtool will complete the removal and
display Finished, then press any key to end the script and load
your desktop icons.
Finally open the SDFix folder on your desktop and copy and paste the
contents of the results file Report.txt back onto the forum with
a new HijackThis log

crunchie 990 Most Valuable Poster

16 Years Ago

.... with
a new HijackThis log
[/list]

Hijackthis needs updating to the latest version too.

==

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

crunchie 990 Most Valuable Poster

16 Years Ago

Hijackthis needs updating to the latest version too.

Still waiting.

==

You must download it to and run it from your Desktop

You must follow my instructions or I cannot help you.
C:\Documents and Settings\MERCEDEZ\Local Settings\Temporary Internet Files\Content.IE5\ODUFW5A3\ComboFix[1].exe

==

You also ran Combofix 3 times when my instructions were to run it once only. You may carry on alone if you wish, but I cannot continue if I have to second guess what you may do.

crunchie 990 Most Valuable Poster

16 Years Ago

The problem now is that the info necessary from Combofix's first run is no longer there :(.

Click START then RUN
Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
- [IMG]http://i5.photobucket.com/albums/y153/crunchie1/CF_Cleanup.png[/IMG]
When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
- ComboFix and its associated files and folders.
- VundoFix backups, if present
- The C:\Deckard folder, if present
- The C:_OtMoveIt folder, if present
Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

==

Now, download it again and try once more please.

crunchie 990 Most Valuable Poster

16 Years Ago

No worries, but you still have not updated hijackthis :).

==

Go to Add/Remove programs and uninstall the following, if present:

Viewpoint Manager

The above could appear anywhere within the entry. Be careful not to remove any personal or system software.

===============

A. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
O2 - BHO: 0 - {6E4865D3-306C-40CC-8FBA-2669CCE858FB} - C:\Program Files\ComPlus Applications\lavuq.dll (file missing)
O2 - BHO: (no name) - {B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC} - C:\Program Files\Outlook Express\hokewokes83122.dll
O4 - HKCU\..\Run: [Pvo] "C:\Documents and Settings\MERCEDEZ\Application Data\?ystem32\u?erinit.exe"
O4 - Startup: Run WinVNC (App Mode).lnk = D:\Program Files\ORL\VNC\WinVNC.exe
O11 - Options group: [INTERNATIONAL] International*
O20 - Winlogon Notify: hadjeijh - C:\WINDOWS\system32\hadjeijh.dll (file missing)
O20 - Winlogon Notify: __c005877C - C:\WINDOWS\system32\__c005877C.dat (file missing)
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::
File::
C:\WINDOWS\fccyxy.dll
C:\WINDOWS\awtuss.dll
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak2
RENV::
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), please re-enable all the programs that were disabled during the running of ComboFix then post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

overwhelmed commented: you basically gave up on him when he obviously has poor english +0

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

you basically gave up on him when he obviously has poor english

truguate 0 Light Poster · Answer 1 · 2008-01-27T11:56:49+00:00

SDFix: Version 1.131

Run by MERCEDEZ on Sat 01/26/2008 at 11:49 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\MERCEDEZ\Desktop\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File
Resetting SecurityProviders Value
Resetting AppInit_DLLs value

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\PROGRA~1\COMPLU~1\PROFSY~1.HTM - Deleted
C:\Documents and Settings\MERCEDEZ\Application Data\Ultimate Cleaner\settings.dat - Deleted
C:\Documents and Settings\MERCEDEZ\Desktop\Find Spyware Remover.lnk - Deleted
C:\Documents and Settings\MERCEDEZ\Desktop\Free Online Dating.lnk - Deleted
C:\Documents and Settings\MERCEDEZ\Desktop\Go to Casino.lnk - Deleted
C:\WINDOWS\PerfInfo\tmp19248.exe - Deleted
C:\Program Files\Helper\Helper9.dll - Deleted
C:\Program Files\lsass.exe - Deleted
C:\Program Files\spoolsv.exe - Deleted
C:\Program Files\ucleaner_setup.exe - Deleted
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\16syn.exe - Deleted
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\monmon.exe - Deleted
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\sys32.exe - Deleted
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\winpower.exe - Deleted
C:\WINDOWS\avp.exe - Deleted
C:\WINDOWS\Casino.ico - Deleted
C:\WINDOWS\Free Online Dating.ico - Deleted
C:\WINDOWS\lsass.exe - Deleted
C:\WINDOWS\mgrs.exe - Deleted
C:\WINDOWS\Spyware Remover.ico - Deleted
C:\WINDOWS\system32\suspend.exe - Deleted
C:\WINDOWS\system32\users32.dat - Deleted
C:\WINDOWS\TTC-4444.exe - Deleted
C:\WINDOWS\system32\wowfx.dll - Deleted

Folder C:\Documents and Settings\MERCEDEZ\Application Data\Ultimate Cleaner - Removed
Folder C:\Program Files\Helper - Removed
Folder C:\Program Files\Ultimate Cleaner - Removed
Folder C:\WINDOWS\PerfInfo - Removed

The below files have been patched by Trojan.Agent.zb to load users32.dat and should be replaced:

C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
C:\Program Files\PerfMon\perfmon32.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\explorer.exe
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 00:00:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Disabled:AIM"
"D:\\Program Files\\ORL\\VNC\\WinVNC.exe"="D:\\Program Files\\ORL\\VNC\\WinVNC.exe:*:Disabled:VNC server for Win32"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:*:Enabled:ActiveSync RAPI Manager"
"D:\\Program Files\\limewire\\LimeWire.exe"="D:\\Program Files\\limewire\\LimeWire.exe:*:Enabled:LimeWire"
"D:\\Downloads\\limewire\\LimeWire.exe"="D:\\Downloads\\limewire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\mcrupdate.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\mcrupdate.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\trant.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\trant.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\printer.exe"="C:\\WINDOWS\\system32\\printer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\sysfixer.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\sysfixer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\spyguard.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\spyguard.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\winav.exe"="%windir%\\system32\\winav.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\mcrupdate.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\mcrupdate.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\trant.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\trant.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\printer.exe"="C:\\WINDOWS\\system32\\printer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\sysfixer.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\sysfixer.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Documents and Settings\\MERCEDEZ\\Application Data\\spyguard.exe"="C:\\Documents and Settings\\MERCEDEZ\\Application Data\\spyguard.exe:*:Enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\MERCEDEZ\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 13 Jan 2008 1,058,455 ..SH. --- "C:\WINDOWS\system32\196A600c__.tmp"
Thu 23 Aug 2007 1,622,067 A.SH. --- "C:\WINDOWS\system32\qtstv.bak1"
Sun 26 Aug 2007 1,613,597 A.SH. --- "C:\WINDOWS\system32\qtstv.bak2"
Sat 21 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 29 Nov 2007 25,088 ...H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\~WRL2579.tmp"
Tue 20 Nov 2007 41,984 ...H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\~WRL3673.tmp"
Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Tue 4 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 6 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7be05330969a5a501b6e6caeca8ba779\BITBC.tmp"
Wed 14 Nov 2007 0 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\New doo\IMAGE_070.jpg~RF1ea6d70.TMP"
Wed 23 Jan 2008 7,318 A..H. --- "C:\Documents and Settings\MERCEDEZ\Application Data\Microsoft\Office\Shortcut Bar\Off61.tmp"
Sat 21 Oct 2006 4,348 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv1key.bak"
Mon 6 Nov 2006 20 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv1lic.bak"
Sat 21 Oct 2006 400 A.SH. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv2key.bak"

Finished!

truguate 0 Light Poster · Answer 2 · 2008-01-27T15:18:00+00:00

ComboFix 08-01-23.1C - MERCEDEZ 2008-01-27  3:13:53.3 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.488 [GMT -5:00]
Running from: C:\Documents and Settings\MERCEDEZ\Local Settings\Temporary Internet Files\Content.IE5\ODUFW5A3\ComboFix[1].exe
* Created a new restore point


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.


C:\.protected
C:\Documents and Settings\MERCEDEZ\Application Data\trant.exe
C:\Program Files\Outlook Express\hokewokes4444.dll
C:\Program Files\winperformance
C:\Program Files\winperformance\WinPerformance.exe.arc
C:\WINDOWS\.protected
C:\WINDOWS\cookies.ini
C:\WINDOWS\PerfInfo
C:\WINDOWS\system32\__c005877C.dat
C:\WINDOWS\system32\__c006A691.dat
C:\WINDOWS\system32\__c00870F3.dat
C:\WINDOWS\system32\__c00AB3D9.dat
C:\WINDOWS\system32\__c00E9AB4.dat
C:\WINDOWS\system32\drivers\etc\.protected
C:\xcrashdump.dat


.
(((((((((((((((((((((((((   Files Created from 2007-12-27 to 2008-01-27  )))))))))))))))))))))))))))))))
.


2008-01-26 23:45 . 2008-01-26 23:45 <DIR>    d--------   C:\WINDOWS\ERUNT
2008-01-26 23:19 . 2007-10-10 18:55 6,065,664   -----c---   C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-26 23:19 . 2007-06-30 22:31 2,455,488   -----c---   C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-26 23:19 . 2007-06-30 22:36 991,232 -----c---   C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-26 23:19 . 2007-10-10 18:55 459,264 -----c---   C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-26 23:19 . 2007-10-10 18:55 383,488 -----c---   C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-26 23:19 . 2007-10-10 18:55 267,776 -----c---   C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-26 23:19 . 2007-10-10 18:55 63,488  -----c---   C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-26 23:19 . 2007-10-10 18:55 52,224  -----c---   C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-26 23:19 . 2007-10-10 05:59 13,824  -----c---   C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-26 23:09 . 2007-08-13 18:54 33,792  --a--c---   C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-26 21:26 . 2008-01-26 21:26 0   --a------   C:\WINDOWS\7F.tmp
2008-01-26 20:19 . 2008-01-26 22:42 <DIR>    d--------   C:\Program Files\Common Files\Panda Software
2008-01-23 03:02 . 2008-01-23 03:02 <DIR>    d--------   C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-22 16:10 . 2007-07-30 19:19 271,224 --a------   C:\WINDOWS\system32\mucltui.dll
2008-01-22 16:10 . 2007-07-30 19:19 207,736 --a------   C:\WINDOWS\system32\muweb.dll
2008-01-22 16:10 . 2007-07-30 19:19 30,072  --a------   C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 02:25 . 2008-01-22 02:32 <DIR>    d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:24 . 2008-01-22 02:34 <DIR>    d--------   C:\Program Files\Windows Live
2008-01-17 22:58 . 2008-01-26 19:00 16,384  --a------   C:\WINDOWS\system32\nod32se.exe
2008-01-17 22:58 . 2008-01-26 19:00 80  --a------   C:\WINDOWS\system32\suspend.bin
2008-01-14 01:55 . 2008-01-22 02:08 54,156  --ah-----   C:\WINDOWS\QTFont.qfn
2008-01-14 01:55 . 2008-01-14 01:55 1,409   --a------   C:\WINDOWS\QTFont.for
2008-01-13 00:24 . 2008-01-27 03:11 1,058,561   ---hs----   C:\WINDOWS\system32\196A600c__.ini2
2008-01-13 00:24 . 2008-01-13 00:24 1,058,455   ---hs----   C:\WINDOWS\system32\196A600c__.tmp
2008-01-08 23:05 . 2008-01-12 23:15 1,058,455   ---hs----   C:\WINDOWS\system32\196A600c__.ini
2008-01-08 22:14 . 2008-01-08 22:14 1,461,797   ---hs----   C:\WINDOWS\system32\3F07800c__.ini


.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 02:43    ---------   d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 01:06    ---------   d-----w C:\Program Files\Java
2008-01-09 16:00    4,224   ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-01-07 03:38    ---------   d-----w C:\Program Files\PerfMon
2008-01-06 20:41    ---------   d-----w C:\Program Files\Apoint
2008-01-03 02:18    ---------   d-----w C:\Program Files\Microsoft ActiveSync
2008-01-03 01:35    ---------   d-----w C:\Program Files\SystemDefender
2007-12-04 23:30    ---------   d-----w C:\Program Files\Zune
2007-12-03 06:24    ---------   d-----w C:\Program Files\SDMon
2007-11-20 04:09    65,536  ----a-w C:\WINDOWS\fccyxy.dll
2007-10-29 19:35    80,896  ----a-w C:\WINDOWS\awtuss.dll
2007-08-23 06:32    1,622,067   --sha-w C:\WINDOWS\system32\qtstv.bak1
2007-08-26 19:03    1,613,597   --sha-w C:\WINDOWS\system32\qtstv.bak2
.
Files Infected -  Win32.Agent.zb
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
.


(((((((((((((((((((((((((((((   snapshot_2007-11-12_12.22.56.78   )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-10-29 22:35:13   1,287,680   ----a-w C:\WINDOWS\$hf_mig$\KB941568\SP2QFE\quartz.dll
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB941568\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB941568\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB941568\update\updspapi.dll
+ 2007-10-30 16:53:32   360,832 ----a-w C:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB941644\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB941644\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB941644\update\updspapi.dll
+ 2007-11-13 11:02:46   60,416  ----a-w C:\WINDOWS\$hf_mig$\KB942763\SP2QFE\tzchange.exe
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB942763\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB942763\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB942763\update\updspapi.dll
+ 2007-11-14 07:18:03   450,560 ----a-w C:\WINDOWS\$hf_mig$\KB942840\SP2QFE\jscript.dll
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB942840\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB942840\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB942840\update\updspapi.dll
+ 2007-11-07 09:50:47   727,040 ----a-w C:\WINDOWS\$hf_mig$\KB943485\SP2QFE\lsasrv.dll
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB943485\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB943485\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB943485\update\updspapi.dll
+ 2007-11-13 08:47:45   20,480  ----a-w C:\WINDOWS\$hf_mig$\KB944653\SP2QFE\secdrv.sys
+ 2007-03-06 01:22:36   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB944653\spmsg.dll
+ 2007-03-06 01:22:41   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB944653\spuninst.exe
+ 2007-03-06 01:22:34   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\spcustom.dll
+ 2007-03-06 01:22:59   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\update.exe
+ 2007-03-06 01:23:51   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB944653\update\updspapi.dll
+ 2007-03-06 01:22:33   14,048  ----a-w C:\WINDOWS\$hf_mig$\KB946627\spmsg.dll
+ 2007-03-06 01:22:39   213,216 ----a-w C:\WINDOWS\$hf_mig$\KB946627\spuninst.exe
+ 2007-03-06 01:22:31   22,752  ----a-w C:\WINDOWS\$hf_mig$\KB946627\update\spcustom.dll
+ 2007-03-06 01:22:56   716,000 ----a-w C:\WINDOWS\$hf_mig$\KB946627\update\update.exe
+ 2007-03-06 01:23:47   371,424 ----a-w C:\WINDOWS\$hf_mig$\KB946627\update\updspapi.dll
+ 2005-08-30 03:54:26   1,287,168   -c----w C:\WINDOWS\$NtUninstallKB941568$\quartz.dll
+ 2007-03-06 01:22:41   213,216 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51   371,424 -c----w C:\WINDOWS\$NtUninstallKB941568$\spuninst\updspapi.dll
+ 2007-10-27 21:39:36   213,216 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe
+ 2007-10-27 21:39:46   371,424 -c----w C:\WINDOWS\$NtUninstallKB941569$\spuninst\updspapi.dll
+ 2006-10-19 03:47:18   222,208 -c----w C:\WINDOWS\$NtUninstallKB941569$\wmasf.dll
+ 2007-08-22 12:55:28   1,022,976   -c----w C:\WINDOWS\$NtUninstallKB942615$\browseui.dll
+ 2007-08-22 12:55:29   151,040 -c----w C:\WINDOWS\$NtUninstallKB942615$\cdfview.dll
+ 2007-08-22 12:55:30   1,054,208   -c----w C:\WINDOWS\$NtUninstallKB942615$\danim.dll
+ 2007-08-22 12:55:30   357,888 -c----w C:\WINDOWS\$NtUninstallKB942615$\dxtmsft.dll
+ 2007-08-22 12:55:31   205,824 -c----w C:\WINDOWS\$NtUninstallKB942615$\dxtrans.dll
+ 2007-08-22 12:55:31   55,808  -c----w C:\WINDOWS\$NtUninstallKB942615$\extmgr.dll
+ 2007-08-21 10:19:39   18,432  -c----w C:\WINDOWS\$NtUninstallKB942615$\iedw.exe
+ 2007-08-22 12:55:32   251,904 -c----w C:\WINDOWS\$NtUninstallKB942615$\iepeers.dll
+ 2007-08-22 12:55:32   96,256  -c----w C:\WINDOWS\$NtUninstallKB942615$\inseng.dll
+ 2007-08-22 12:55:32   16,384  -c----w C:\WINDOWS\$NtUninstallKB942615$\jsproxy.dll
+ 2007-08-22 12:55:36   3,064,832   -c----w C:\WINDOWS\$NtUninstallKB942615$\mshtml.dll
+ 2007-08-22 12:55:37   449,024 -c----w C:\WINDOWS\$NtUninstallKB942615$\mshtmled.dll
+ 2007-08-22 12:55:37   146,432 -c----w C:\WINDOWS\$NtUninstallKB942615$\msrating.dll
+ 2007-08-22 12:55:38   532,480 -c----w C:\WINDOWS\$NtUninstallKB942615$\mstime.dll
+ 2007-08-22 12:55:38   39,424  -c----w C:\WINDOWS\$NtUninstallKB942615$\pngfilt.dll
+ 2007-08-22 12:55:40   1,498,112   -c----w C:\WINDOWS\$NtUninstallKB942615$\shdocvw.dll
+ 2007-08-22 12:55:41   474,112 -c----w C:\WINDOWS\$NtUninstallKB942615$\shlwapi.dll
+ 2007-03-06 01:22:41   213,216 -c----w C:\WINDOWS\$NtUninstallKB942615$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51   371,424 -c----w C:\WINDOWS\$NtUninstallKB942615$\spuninst\updspapi.dll
+ 2007-08-22 12:55:43   617,984 -c----w C:\WINDOWS\$NtUninstallKB942615$\urlmon.dll
+ 2007-08-22 12:55:44   665,600 -c----w C:\WINDOWS\$NtUninstallKB942615$\wininet.dll
+ 2007-03-06 01:22:41   213,216 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51   371,424 -c----w C:\WINDOWS\$NtUninstallKB942763$\spuninst\updspapi.dll
+ 2007-07-18 12:42:22   60,416  -c----w C:\WINDOWS\$NtUninstallKB942763$\tzchange.exe
+ 2006-05-18 05:24:25   450,560 -c----w C:\WINDOWS\$NtUninstallKB942840$\jscript.dll
+ 2007-03-06 01:22:41   213,216 -c----w C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51   371,424 -c----w C:\WINDOWS\$NtUninstallKB942840$\spuninst\updspapi.dll
+ 2006-12-19 21:52:18   8,453,632   -c----w C:\WINDOWS\$NtUninstallKB943460$\shell32.dll
+ 2007-03-06 01:22:39   213,216 -c----w C:\WINDOWS\$NtUninstallKB943460$\spuninst\spuninst.exe
+ 2007-03-06 01:23:47   371,424 -c----w C:\WINDOWS\$NtUninstallKB943460$\spuninst\updspapi.dll
+ 2007-08-21 10:13:33   350,720 -c----w C:\WINDOWS\$NtUninstallKB943460$\xpsp3res.dll
+ 2004-08-04 12:00:00   27,440  -c----w C:\WINDOWS\$NtUninstallKB944653$\secdrv.sys
+ 2007-03-06 01:22:41   213,216 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\spuninst.exe
+ 2007-03-06 01:23:51   371,424 -c----w C:\WINDOWS\$NtUninstallKB944653$\spuninst\updspapi.dll
+ 2007-03-06 01:22:39   213,216 -c----w C:\WINDOWS\$NtUninstallKB946627$\spuninst\spuninst.exe
+ 2007-03-06 01:23:47   371,424 -c----w C:\WINDOWS\$NtUninstallKB946627$\spuninst\updspapi.dll
+ 2000-08-31 13:00:00   163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-27 08:13:14   241,664 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-27 08:13:14   8,192   ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-27 08:13:25   7,659,520   ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-27 08:13:27   151,552 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-27 08:13:28   237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-27 08:13:28   8,192   ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-24 14:01:34   163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-01-27 04:46:24   7,151,616   ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-01-27 04:46:24   151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-01-24 14:01:34   163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-01-27 04:45:56   7,151,616   ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-01-27 04:45:56   151,552 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2004-08-04 12:00:00   61,440  -c--a-w C:\WINDOWS\ie7\admparse.dll
+ 2004-08-04 12:00:00   99,840  -c--a-w C:\WINDOWS\ie7\advpack.dll
+ 2004-08-04 12:00:00   35,328  -c--a-w C:\WINDOWS\ie7\corpol.dll
+ 2006-06-03 11:40:49   33,792  -c--a-w C:\WINDOWS\ie7\custsat.dll
+ 2007-10-11 05:57:30   357,888 -c--a-w C:\WINDOWS\ie7\dxtmsft.dll
+ 2007-10-11 05:57:30   205,824 -c--a-w C:\WINDOWS\ie7\dxtrans.dll
+ 2007-10-11 05:57:30   55,808  -c--a-w C:\WINDOWS\ie7\extmgr.dll
+ 2004-08-04 12:00:00   38,912  -c--a-w C:\WINDOWS\ie7\hmmapi.dll
+ 2004-08-04 12:00:00   34,304  -c--a-w C:\WINDOWS\ie7\ie4uinit.exe
+ 2004-08-04 12:00:00   139,264 -c--a-w C:\WINDOWS\ie7\ieakeng.dll
+ 2004-08-04 12:00:00   216,576 -c--a-w C:\WINDOWS\ie7\ieaksie.dll
+ 2004-08-04 12:00:00   221,184 -c--a-w C:\WINDOWS\ie7\ieakui.dll
+ 2004-08-04 12:00:00   323,584 -c--a-w C:\WINDOWS\ie7\iedkcs32.dll
+ 2007-10-10 10:48:23   18,432  -c--a-w C:\WINDOWS\ie7\iedw.exe
+ 2004-08-04 12:00:00   81,920  -c--a-w C:\WINDOWS\ie7\ieencode.dll
+ 2007-10-11 05:57:31   251,904 -c--a-w C:\WINDOWS\ie7\iepeers.dll
+ 2004-08-04 12:00:00   48,640  -c--a-w C:\WINDOWS\ie7\iernonce.dll
+ 2004-08-04 12:00:00   62,976  -c--a-w C:\WINDOWS\ie7\iesetup.dll
+ 2004-08-04 12:00:00   93,184  -c--a-w C:\WINDOWS\ie7\iexplore.exe
+ 2004-08-04 12:00:00   35,840  -c--a-w C:\WINDOWS\ie7\imgutil.dll
+ 2007-10-11 05:57:31   96,256  -c--a-w C:\WINDOWS\ie7\inseng.dll
+ 2007-11-14 07:26:56   450,560 -c--a-w C:\WINDOWS\ie7\jscript.dll
+ 2007-10-11 05:57:31   16,384  -c--a-w C:\WINDOWS\ie7\jsproxy.dll
+ 2004-08-04 12:00:00   22,016  -c--a-w C:\WINDOWS\ie7\licmgr10.dll
+ 2004-08-04 12:00:00   29,184  -c--a-w C:\WINDOWS\ie7\mshta.exe
+ 2007-10-30 09:55:21   3,065,856   -c--a-w C:\WINDOWS\ie7\mshtml.dll
+ 2007-10-11 05:57:36   449,024 -c--a-w C:\WINDOWS\ie7\mshtmled.dll
+ 2004-08-04 12:00:00   56,832  -c--a-w C:\WINDOWS\ie7\mshtmler.dll
+ 2004-08-04 12:00:00   146,432 -c--a-w C:\WINDOWS\ie7\msls31.dll
+ 2007-10-11 05:57:36   146,432 -c--a-w C:\WINDOWS\ie7\msrating.dll
+ 2007-10-11 05:57:37   532,480 -c--a-w C:\WINDOWS\ie7\mstime.dll
+ 2004-08-04 12:00:00   96,256  -c--a-w C:\WINDOWS\ie7\occache.dll
+ 2007-10-11 05:57:37   39,424  -c--a-w C:\WINDOWS\ie7\pngfilt.dll
+ 2007-08-13 23:54:42   32,960  -c--a-w C:\WINDOWS\ie7\spuninst\iecustom.dll
+ 2007-08-13 23:52:06   66,048  -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
+ 2006-09-06 22:43:16   213,216 -c--a-w C:\WINDOWS\ie7\spuninst\spuninst.exe
+ 2006-09-06 22:43:18   371,424 -c--a-w C:\WINDOWS\ie7\spuninst\updspapi.dll
+ 2004-08-04 12:00:00   37,888  -c--a-w C:\WINDOWS\ie7\url.dll
+ 2007-10-11 05:57:40   617,984 -c--a-w C:\WINDOWS\ie7\urlmon.dll
+ 2004-08-04 12:00:00   417,792 -c--a-w C:\WINDOWS\ie7\vbscript.dll
+ 2007-06-26 15:13:22   851,968 -c--a-w C:\WINDOWS\ie7\vgx.dll
+ 2004-08-04 12:00:00   276,480 -c--a-w C:\WINDOWS\ie7\webcheck.dll
+ 2007-10-11 05:57:41   666,112 -c--a-w C:\WINDOWS\ie7\wininet.dll
+ 2007-08-13 23:39:00   123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll
+ 2007-08-13 23:39:00   123,904 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\advpack.dll.000
+ 2007-08-13 23:35:38   214,528 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\dxtrans.dll
+ 2007-08-13 23:54:10   131,584 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\extmgr.dll
+ 2007-08-13 23:36:26   61,952  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\icardie.dll
+ 2007-08-13 23:39:06   54,784  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe
+ 2007-08-13 23:39:06   54,784  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ie4uinit.exe.000
+ 2007-08-13 23:39:26   152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll
+ 2007-08-13 23:39:26   152,064 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakeng.dll.000
+ 2007-08-13 23:39:54   229,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieaksie.dll
+ 2007-08-13 22:56:54   161,792 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieakui.dll
+ 2007-02-12 21:10:12   2,451,312   -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dat
+ 2007-07-11 17:27:48   383,488 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieapfltr.dll
+ 2007-08-13 23:39:50   382,976 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iedkcs32.dll
+ 2007-08-13 23:54:10   6,049,280   -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieframe.dll
+ 2007-08-13 23:39:10   43,008  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iernonce.dll
+ 2007-08-13 23:34:04   266,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iertutil.dll
+ 2007-08-13 23:39:10   13,312  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\ieudinit.exe
+ 2007-08-13 23:43:56   622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe
+ 2007-08-13 23:43:56   622,080 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\iexplore.exe.000
+ 2007-08-13 23:54:10   27,136  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\jsproxy.dll
+ 2007-08-13 23:54:10   458,752 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeeds.dll
+ 2007-08-13 23:54:10   50,688  -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msfeedsbs.dll
+ 2007-08-13 23:54:12   3,578,368   -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtml.dll
+ 2007-08-13 23:54:10   475,648 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mshtmled.dll
+ 2007-08-13 23:44:26   192,000 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\msrating.dll
+ 2007-08-13 23:54:10   670,720 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\mstime.dll
+ 2007-08-13 23:44:06   101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll
+ 2007-08-13 23:44:06   101,376 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\occache.dll.000
+ 2007-03-06 01:22:39   213,216 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\spuninst.exe
+ 2007-06-30 20:22:56   371,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\spuninst\updspapi.dll
+ 2007-08-13 23:44:30   105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll
+ 2007-08-13 23:44:30   105,984 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\url.dll.000
+ 2007-08-13 23:54:10   1,162,240   -c----w C:\WINDOWS\ie7updates\KB942615-IE7\urlmon.dll
+ 2007-08-13 23:54:10   231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll
+ 2007-08-13 23:54:10   231,424 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\webcheck.dll.000
+ 2007-08-13 23:54:10   818,688 -c----w C:\WINDOWS\ie7updates\KB942615-IE7\wininet.dll
+ 2008-01-22 07:32:46   29,926  ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
+ 2006-06-03 11:40:49   33,792  ------w C:\WINDOWS\network diagnostic\custsat.dll
+ 2006-10-10 12:44:50   557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
- 2007-06-17 05:11:58   51,200  ----a-w C:\WINDOWS\NirCmd.exe
+ 2000-08-31 13:00:00   51,200  ----a-w C:\WINDOWS\NirCmd.exe
- 2004-08-04 12:00:00   61,440  -c--a-w C:\WINDOWS\system32\admparse.dll
+ 2007-08-13 23:39:20   71,680  ----a-w C:\WINDOWS\system32\admparse.dll
- 2004-08-04 12:00:00   99,840  ----a-w C:\WINDOWS\system32\advpack.dll
+ 2007-10-10 23:55:51   124,928 ----a-w C:\WINDOWS\system32\advpack.dll
- 2007-08-22 12:55:28   1,022,976   ----a-w C:\WINDOWS\system32\browseui.dll
+ 2007-10-11 05:57:29   1,024,000   ----a-w C:\WINDOWS\system32\browseui.dll
- 2007-08-22 12:55:29   151,040 ----a-w C:\WINDOWS\system32\cdfview.dll
+ 2007-10-11 05:57:29   151,040 ----a-w C:\WINDOWS\system32\cdfview.dll
- 2006-09-09 11:39:17   16,384  -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-27 03:25:12   49,152  -c--a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-01-27 02:18:59   16,384  ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Internet Explorer\MSIMGSIZ.DAT
- 2006-09-09 11:39:17   32,768  -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-27 03:24:08   32,768  -c--a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-01-27 03:24:11   32,768  ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008012620080127\index.dat
- 2007-08-22 12:55:30   1,054,208   ----a-w C:\WINDOWS\system32\danim.dll
+ 2007-10-11 05:57:30   1,054,208   ----a-w C:\WINDOWS\system32\danim.dll
- 2004-08-04 12:00:00   61,440  -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll
+ 2007-08-13 23:39:20   71,680  -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll
+ 2007-10-10 23:55:51   124,928 -c----w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2008-01-09 16:00:48   4,224   -c--a-w C:\WINDOWS\system32\dllcache\beep.sys
- 2007-08-22 12:55:28   1,022,976   -c----w C:\WINDOWS\system32\dllcache\browseui.dll
+ 2007-10-11 05:57:29   1,024,000   -c----w C:\WINDOWS\system32\dllcache\browseui.dll
- 2007-08-22 12:55:29   151,040 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
+ 2007-10-11 05:57:29   151,040 -c----w C:\WINDOWS\system32\dllcache\cdfview.dll
- 2007-08-22 12:55:30   1,054,208   -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
+ 2007-10-11 05:57:30   1,054,208   -c--a-w C:\WINDOWS\system32\dllcache\danim.dll
- 2007-08-22 12:55:30   357,888 -c----w C:\WINDOWS\system32\dllcache\dxtmsft.dll
+ 2007-08-13 23:35:46   346,624 -c--a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
- 2007-08-22 12:55:31   205,824 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
+ 2007-10-10 23:55:51   214,528 -c----w C:\WINDOWS\system32\dllcache\dxtrans.dll
- 2007-08-22 12:55:31   55,808  -c--a-w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2007-10-10 23:55:51   132,608 -c----w C:\WINDOWS\system32\dllcache\extmgr.dll
+ 2007-08-13 23:18:02   60,416  -c----w C:\WINDOWS\system32\dllcache\hmmapi.dll
+ 2007-10-10 10:59:40   70,656  -c----w C:\WINDOWS\system32\dllcache\ie4uinit.exe
+ 2007-10-10 23:55:51   153,088 -c----w C:\WINDOWS\system32\dllcache\ieakeng.dll
- 2004-08-04 12:00:00   216,576 -c--a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
+ 2007-10-10 23:55:51   230,400 -c----w C:\WINDOWS\system32\dllcache\ieaksie.dll
- 2004-08-04 12:00:00   221,184 -c--a-w C:\WINDOWS\system32\dllcache\ieakui.dll
+ 2007-10-10 05:46:55   161,792 -c----w C:\WINDOWS\system32\dllcache\ieakui.dll
- 2004-08-04 12:00:00   323,584 -c--a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
+ 2007-10-10 23:55:52   384,512 -c----w C:\WINDOWS\system32\dllcache\iedkcs32.dll
- 2007-08-21 10:19:39   18,432  -c----w C:\WINDOWS\system32\dllcache\iedw.exe
+ 2007-08-13 23:44:02   69,120  -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe
- 2004-08-04 12:00:00   81,920  -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll
+ 2007-08-13 23:45:18   78,336  -c--a-w C:\WINDOWS\system32\dllcache\ieencode.dll
- 2007-08-22 12:55:32   251,904 -c----w C:\WINDOWS\system32\dllcache\iepeers.dll
+ 2007-08-13 23:54:10   191,488 -c--a-w C:\WINDOWS\system32\dllcache\iepeers.dll
- 2004-08-04 12:00:00   48,640  -c--a-w C:\WINDOWS\system32\dllcache\iernonce.dll
+ 2007-10-10 23:55:55   44,544  -c----w C:\WINDOWS\system32\dllcache\iernonce.dll
- 2004-08-04 12:00:00   62,976  -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll
+ 2007-08-13 23:39:12   55,296  -c--a-w C:\WINDOWS\system32\dllcache\iesetup.dll
+ 2007-10-10 10:59:52   625,152 -c----w C:\WINDOWS\system32\dllcache\iexplore.exe
+ 2007-08-13 23:36:06   36,352  -c----w C:\WINDOWS\system32\dllcache\imgutil.dll
- 2007-08-22 12:55:32   96,256  -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
+ 2007-08-13 23:39:02   92,672  -c--a-w C:\WINDOWS\system32\dllcache\inseng.dll
- 2006-05-18 05:24:25   450,560 -c----w C:\WINDOWS\system32\dllcache\jscript.dll
+ 2007-08-13 23:38:04   491,520 -c--a-w C:\WINDOWS\system32\dllcache\jscript.dll
- 2007-08-22 12:55:32   16,384  -c--a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
+ 2007-10-10 23:55:56   27,648  -c----w C:\WINDOWS\system32\dllcache\jsproxy.dll
- 2004-08-04 12:00:00   22,016  -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
+ 2007-08-13 23:44:18   40,960  -c--a-w C:\WINDOWS\system32\dllcache\licmgr10.dll
- 2006-08-17 12:28:27   721,920 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2007-11-07 09:26:56   721,920 -c----w C:\WINDOWS\system32\dllcache\lsasrv.dll
+ 2007-08-13 23:32:30   45,568  -c----w C:\WINDOWS\system32\dllcache\mshta.exe
- 2007-08-22 12:55:36   3,064,832   -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
+ 2007-10-31 10:12:30   3,590,656   -c----w C:\WINDOWS\system32\dllcache\mshtml.dll
- 2007-08-22 12:55:37   449,024 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
+ 2007-10-10 23:55:58   478,208 -c----w C:\WINDOWS\system32\dllcache\mshtmled.dll
- 2004-08-04 12:00:00   56,832  -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
+ 2007-08-13 23:01:12   48,128  -c--a-w C:\WINDOWS\system32\dllcache\mshtmler.dll
+ 2007-08-13 23:54:10   156,160 -c----w C:\WINDOWS\system32\dllcache\msls31.dll
- 2007-08-22 12:55:37   146,432 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
+ 2007-10-10 23:55:58   193,024 -c----w C:\WINDOWS\system32\dllcache\msrating.dll
- 2007-08-22 12:55:38   532,480 -c--a-w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2007-10-10 23:55:59   671,232 -c----w C:\WINDOWS\system32\dllcache\mstime.dll
+ 2007-10-10 23:55:59   102,400 -c----w C:\WINDOWS\system32\dllcache\occache.dll
- 2007-08-22 12:55:38   39,424  -c----w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2007-08-13 23:36:12   44,544  -c--a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
+ 2007-10-29 22:43:03   1,287,680   -c----w C:\WINDOWS\system32\dllcache\quartz.dll
- 2007-08-22 12:55:40   1,498,112   -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
+ 2007-10-11 05:57:39   1,498,112   -c----w C:\WINDOWS\system32\dllcache\shdocvw.dll
- 2006-12-19 21:52:18   8,453,632   -c----w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-26 03:34:01   8,460,288   -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-08-22 12:55:41   474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
+ 2007-10-11 05:57:40   474,112 -c----w C:\WINDOWS\system32\dllcache\shlwapi.dll
- 2006-04-20 11:51:50   359,808 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2007-10-30 17:20:55   360,064 -c----w C:\WINDOWS\system32\dllcache\tcpip.sys
+ 2007-10-10 23:55:59   105,984 -c----w C:\WINDOWS\system32\dllcache\url.dll
- 2007-08-22 12:55:43   617,984 -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-10-10 23:56:00   1,159,680   -c----w C:\WINDOWS\system32\dllcache\urlmon.dll
+ 2007-08-13 23:54:10   413,696 -c----w C:\WINDOWS\system32\dllcache\vbscript.dll
- 2007-06-26 15:13:22   851,968 -c----w C:\WINDOWS\system32\dllcache\vgx.dll
+ 2007-08-13 23:54:10   765,952 -c--a-w C:\WINDOWS\system32\dllcache\VGX.dll
+ 2007-10-10 23:56:00   232,960 -c----w C:\WINDOWS\system32\dllcache\webcheck.dll
- 2007-08-22 12:55:44   665,600 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-10-10 23:56:00   824,832 -c----w C:\WINDOWS\system32\dllcache\wininet.dll
+ 2007-10-27 22:40:30   222,720 -c----w C:\WINDOWS\system32\dllcache\wmasf.dll
- 2004-08-04 12:00:00   27,440  -c--a-w C:\WINDOWS\system32\drivers\secdrv.sys
+ 2007-11-13 10:25:53   20,480  ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
- 2006-04-20 11:51:50   359,808 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
+ 2007-10-30 17:20:55   360,064 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
- 2007-08-22 12:55:30   357,888 ----a-w C:\WINDOWS\system32\dxtmsft.dll
+ 2007-08-13 23:35:46   346,624 ----a-w C:\WINDOWS\system32\dxtmsft.dll
- 2007-08-22 12:55:31   205,824 ----a-w C:\WINDOWS\system32\dxtrans.dll
+ 2007-10-10 23:55:51   214,528 ----a-w C:\WINDOWS\system32\dxtrans.dll
- 2007-08-22 12:55:31   55,808  ----a-w C:\WINDOWS\system32\extmgr.dll
+ 2007-10-10 23:55:51   132,608 ------w C:\WINDOWS\system32\extmgr.dll
+ 2007-10-10 23:55:51   63,488  ----a-w C:\WINDOWS\system32\icardie.dll
+ 2006-06-29 13:05:44   26,112  ------w C:\WINDOWS\system32\idndl.dll
- 2004-08-04 12:00:00   34,304  ----a-w C:\WINDOWS\system32\ie4uinit.exe
+ 2007-10-10 10:59:40   70,656  ------w C:\WINDOWS\system32\ie4uinit.exe
- 2004-08-04 12:00:00   139,264 ----a-w C:\WINDOWS\system32\ieakeng.dll
+ 2007-10-10 23:55:51   153,088 ------w C:\WINDOWS\system32\ieakeng.dll
- 2004-08-04 12:00:00   216,576 -c--a-w C:\WINDOWS\system32\ieaksie.dll
+ 2007-10-10 23:55:51   230,400 ------w C:\WINDOWS\system32\ieaksie.dll
- 2004-08-04 12:00:00   221,184 -c--a-w C:\WINDOWS\system32\ieakui.dll
+ 2007-10-10 05:46:55   161,792 ------w C:\WINDOWS\system32\ieakui.dll
+ 2007-07-01 03:31:33   2,455,488   ----a-w C:\WINDOWS\system32\ieapfltr.dat
+ 2007-10-10 23:55:52   383,488 ----a-w C:\WINDOWS\system32\ieapfltr.dll
- 2004-08-04 12:00:00   323,584 -c--a-w C:\WINDOWS\system32\iedkcs32.dll
+ 2007-10-10 23:55:52   384,512 ------w C:\WINDOWS\system32\iedkcs32.dll
- 2004-08-04 12:00:00   81,920  -c--a-w C:\WINDOWS\system32\ieencode.dll
+ 2007-08-13 23:45:18   78,336  ----a-w C:\WINDOWS\system32\ieencode.dll
+ 2007-10-10 23:55:54   6,065,664   ----a-w C:\WINDOWS\system32\ieframe.dll
- 2007-08-22 12:55:32   251,904 ----a-w C:\WINDOWS\system32\iepeers.dll
+ 2007-08-13 23:54:10   191,488 ----a-w C:\WINDOWS\system32\iepeers.dll
- 2004-08-04 12:00:00   48,640  -c--a-w C:\WINDOWS\system32\iernonce.dll
+ 2007-10-10 23:55:55   44,544  ------w C:\WINDOWS\system32\iernonce.dll
+ 2007-10-10 23:55:55   267,776 ----a-w C:\WINDOWS\system32\iertutil.dll
- 2004-08-04 12:00:00   62,976  -c--a-w C:\WINDOWS\system32\iesetup.dll
+ 2007-08-13 23:39:12   55,296  ----a-w C:\WINDOWS\system32\iesetup.dll
+ 2007-10-10 10:59:40   13,824  ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-13 23:54:10   180,736 ------w C:\WINDOWS\system32\ieui.dll
- 2004-08-04 12:00:00   35,840  ----a-w C:\WINDOWS\system32\imgutil.dll
+ 2007-08-13 23:36:06   36,352  ----a-w C:\WINDOWS\system32\imgutil.dll
- 2007-08-22 12:55:32   96,256  ----a-w C:\WINDOWS\system32\inseng.dll
+ 2007-08-13 23:39:02   92,672  ----a-w C:\WINDOWS\system32\inseng.dll
- 2007-03-14 04:31:24   135,168 ----a-w C:\WINDOWS\system32\java.exe
+ 2007-09-25 03:30:28   135,168 ----a-w C:\WINDOWS\system32\java.exe
- 2007-03-14 04:31:28   135,168 ----a-w C:\WINDOWS\system32\javaw.exe
+ 2007-09-25 03:30:30   135,168 ----a-w C:\WINDOWS\system32\javaw.exe
- 2007-03-14 06:04:46   139,264 ----a-w C:\WINDOWS\system32\javaws.exe
+ 2007-09-25 04:31:42   139,264 ----a-w C:\WINDOWS\system32\javaws.exe
- 2006-05-18 05:24:25   450,560 ----a-w C:\WINDOWS\system32\jscript.dll
+ 2007-08-13 23:38:04   491,520 ----a-w C:\WINDOWS\system32\jscript.dll
- 2007-08-22 12:55:32   16,384  ----a-w C:\WINDOWS\system32\jsproxy.dll
+ 2007-10-10 23:55:56   27,648  ------w C:\WINDOWS\system32\jsproxy.dll
- 2004-08-04 12:00:00   22,016  -c--a-w C:\WINDOWS\system32\licmgr10.dll
+ 2007-08-13 23:44:18   40,960  ----a-w C:\WINDOWS\system32\licmgr10.dll
- 2006-08-17 12:28:27   721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
+ 2007-11-07 09:26:56   721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
- 2007-09-28 05:19:39   18,089,592  ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-01-02 18:21:36   17,642,616  ----a-w C:\WINDOWS\system32\MRT.exe
+ 2007-10-10 23:55:56   459,264 ----a-w C:\WINDOWS\system32\msfeeds.dll
+ 2007-10-10 23:55:56   52,224  ----a-w C:\WINDOWS\system32\msfeedsbs.dll
+ 2007-08-13 23:36:40   12,288  ------w C:\WINDOWS\system32\msfeedssync.exe
- 2004-08-04 12:00:00   29,184  ----a-w C:\WINDOWS\system32\mshta.exe
+ 2007-08-13 23:32:30   45,568  ----a-w C:\WINDOWS\system32\mshta.exe
- 2007-08-22 12:55:36   3,064,832   ----a-w C:\WINDOWS\system32\mshtml.dll
+ 2007-10-31 10:12:30   3,590,656   ----a-w C:\WINDOWS\system32\mshtml.dll
- 2007-08-22 12:55:37   449,024 ----a-w C:\WINDOWS\system32\mshtmled.dll
+ 2007-10-10 23:55:58   478,208 ----a-w C:\WINDOWS\system32\mshtmled.dll
- 2004-08-04 12:00:00   56,832  -c--a-w C:\WINDOWS\system32\mshtmler.dll
+ 2007-08-13 23:01:12   48,128  ----a-w C:\WINDOWS\system32\mshtmler.dll
- 2004-08-04 12:00:00   146,432 ----a-w C:\WINDOWS\system32\msls31.dll
+ 2007-08-13 23:54:10   156,160 ----a-w C:\WINDOWS\system32\msls31.dll
- 2007-08-22 12:55:37   146,432 ----a-w C:\WINDOWS\system32\msrating.dll
+ 2007-10-10 23:55:58   193,024 ------w C:\WINDOWS\system32\msrating.dll
- 2007-08-22 12:55:38   532,480 ----a-w C:\WINDOWS\system32\mstime.dll
+ 2007-10-10 23:55:59   671,232 ------w C:\WINDOWS\system32\mstime.dll
+ 2006-06-28 22:59:26   24,576  ------w C:\WINDOWS\system32\nlsdl.dll
+ 2006-06-29 13:05:44   23,552  ------w C:\WINDOWS\system32\normaliz.dll
- 2004-08-04 12:00:00   96,256  ----a-w C:\WINDOWS\system32\occache.dll
+ 2007-10-10 23:55:59   102,400 ------w C:\WINDOWS\system32\occache.dll
- 2007-08-22 12:55:38   39,424  ----a-w C:\WINDOWS\system32\pngfilt.dll
+ 2007-08-13 23:36:12   44,544  ----a-w C:\WINDOWS\system32\pngfilt.dll
- 2005-08-30 03:54:26   1,287,168   ----a-w C:\WINDOWS\system32\quartz.dll
+ 2007-10-29 22:43:03   1,287,680   ----a-w C:\WINDOWS\system32\quartz.dll
- 2007-08-22 12:55:40   1,498,112   ----a-w C:\WINDOWS\system32\shdocvw.dll
+ 2007-10-11 05:57:39   1,498,112   ----a-w C:\WINDOWS\system32\shdocvw.dll
- 2006-12-19 21:52:18   8,453,632   ----a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:34:01   8,460,288   ----a-w C:\WINDOWS\system32\shell32.dll
- 2007-08-22 12:55:41   474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
+ 2007-10-11 05:57:40   474,112 ----a-w C:\WINDOWS\system32\shlwapi.dll
- 2007-01-19 17:53:04   51,056  ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-10-18 16:31:46   51,224  ----a-w C:\WINDOWS\system32\sirenacm.dll
- 2006-09-25 21:58:48   14,640  ------w C:\WINDOWS\system32\spmsg.dll
+ 2007-03-06 01:22:33   14,048  ------w C:\WINDOWS\system32\spmsg.dll
- 2006-09-25 21:58:48   23,856  ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-09-25 22:58:48   23,856  ----a-w C:\WINDOWS\system32\spupdsvc.exe
- 2007-07-22 23:39:27   279,552 ----a-w C:\WINDOWS\system32\swreg.exe
+ 2000-08-31 13:00:00   156,160 ----a-w C:\WINDOWS\system32\swreg.exe
- 2006-01-09 14:36:06   40,960  ----a-w C:\WINDOWS\system32\swsc.exe
+ 2000-08-31 13:00:00   136,704 ----a-w C:\WINDOWS\system32\swsc.exe
- 2006-12-01 10:20:34   79,360  ----a-w C:\WINDOWS\system32\swxcacls.exe
+ 2000-08-31 13:00:00   212,480 ----a-w C:\WINDOWS\system32\swxcacls.exe
- 2007-07-18 12:42:22   60,416  ----a-w C:\WINDOWS\system32\tzchange.exe
+ 2007-11-13 11:31:11   60,416  ----a-w C:\WINDOWS\system32\tzchange.exe
- 2004-08-04 12:00:00   37,888  ----a-w C:\WINDOWS\system32\url.dll
+ 2007-10-10 23:55:59   105,984 ----a-w C:\WINDOWS\system32\url.dll
- 2007-08-22 12:55:43   617,984 ----a-w C:\WINDOWS\system32\urlmon.dll
+ 2007-10-10 23:56:00   1,159,680   ----a-w C:\WINDOWS\system32\urlmon.dll
- 2004-08-04 12:00:00   417,792 ----a-w C:\WINDOWS\system32\vbscript.dll
+ 2007-08-13 23:54:10   413,696 ----a-w C:\WINDOWS\system32\vbscript.dll
- 2004-08-04 12:00:00   49,152  ----a-w C:\WINDOWS\system32\wdigest.dll
+ 2006-03-24 04:37:50   49,152  ----a-w C:\WINDOWS\system32\wdigest.dll
- 2004-08-04 12:00:00   276,480 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2007-10-10 23:56:00   232,960 ----a-w C:\WINDOWS\system32\webcheck.dll
+ 2007-08-13 23:45:16   206,336 ------w C:\WINDOWS\system32\WinFXDocObj.exe
- 2007-08-22 12:55:44   665,600 ----a-w C:\WINDOWS\system32\wininet.dll
+ 2007-10-10 23:56:00   824,832 ----a-w C:\WINDOWS\system32\wininet.dll
- 2006-10-19 03:47:18   222,208 ----a-w C:\WINDOWS\system32\wmasf.dll
+ 2007-10-27 22:40:30   222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
- 2006-10-19 01:47:22   38,400  ----a-w C:\WINDOWS\system32\wpdshextres.dll
+ 2006-10-19 03:47:22   38,400  ----a-w C:\WINDOWS\system32\wpdshextres.dll
+ 2006-07-14 15:51:51   121,856 ------w C:\WINDOWS\system32\xmllite.dll
- 2007-08-21 10:13:33   350,720 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:04:03   350,720 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-01-27 08:20:03   16,384  ----atw C:\WINDOWS\Temp\Perflib_Perfdata_534.dat
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC}]
2007-06-18 13:59    163840  --a------   C:\Program Files\Outlook Express\hokewokes83122.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@={E4000AC4-5E5F-4956-807A-C5854405D64F}


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="D:\Program Files\yahoo\Messenger\YahooMessenger.exe" [2008-01-06 07:51 4662776]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 03:28 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2008-01-06 04:31 114688]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 15:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2008-01-06 03:35 45056]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2008-01-06 03:35 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2008-01-06 03:35 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 00:36 151552]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2008-01-06 15:58 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2008-01-06 15:58 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2008-01-23 03:26 114688]
"PartSeal"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"QuickTime Task"="D:\Downloads\quicktime\qttask.exe" [2008-01-06 15:58 286720]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe" [ ]


C:\Documents and Settings\MERCEDEZ\Start Menu\Programs\Startup\
Run WinVNC (App Mode).lnk - D:\Program Files\ORL\VNC\WinVNC.exe [2006-09-09 16:23:39 208896]


C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04 83360]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-09-09 15:44:36 106560]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hadjeijh]
C:\WINDOWS\system32\hadjeijh.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 20:42 73728 C:\WINDOWS\system32\VESWinlogon.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c005877C]
C:\WINDOWS\system32\__c005877C.dat


[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^MERCEDEZ^Start Menu^Programs^Startup^.protected]
path=C:\Documents and Settings\MERCEDEZ\Start Menu\Programs\Startup\.protected
backup=C:\WINDOWS\pss\.protectedStartup


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A00F6194B39.exe]
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\_A00F6194B39.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A00FB43F3F.exe]
C:\DOCUME~1\MERCEDEZ\LOCALS~1\Temp\_A00FB43F3F.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\avp.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OPSE reminder]
D:\Program Files\EregEng\Ereg.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OpwareSE2]
--a------ 2008-01-06 15:58 49152 D:\Program Files\canon picture\OpwareSE2.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Pvo]
C:\Documents and Settings\MERCEDEZ\Application Data\?ystem32\u?erinit.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemDefender]
C:\Program Files\SystemDefender\SystemDefender.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Cleaner]
C:\Program Files\Ultimate Cleaner\UltimateCleaner.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Defender]
C:\Program Files\Ultimate Defender\UltimateDefender.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 19:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zune Launcher]
--a------ 2006-10-31 14:34 20752 C:\Program Files\Zune\ZuneLauncher.exe


R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 21:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]


.
**************************************************************************


catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 03:21:21
Windows 5.1.2600 Service Pack 2 NTFS


scanning hidden processes ...


scanning hidden autostart entries ...


scanning hidden files ...


scan completed successfully
hidden files: 0


**************************************************************************
.
Completion time: 2008-01-27  3:27:30 - machine was rebooted
ComboFix-quarantined-files.txt  2008-01-27 08:27:24
ComboFix2.txt  2007-11-12 17:24:13
ComboFix3.txt  2007-10-29 19:55:04
.
2008-01-27 04:22:32 --- E O F ---

truguate 0 Light Poster · Answer 3 · 2008-01-27T15:19:27+00:00

new hijack file

Logfile of HijackThis v1.99.1
Scan saved at 3:57:41 AM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
D:\Program Files\ORL\VNC\WinVNC.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC} - C:\Program Files\Outlook Express\hokewokes83122.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Run WinVNC (App Mode).lnk = D:\Program Files\ORL\VNC\WinVNC.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: hadjeijh - C:\WINDOWS\system32\hadjeijh.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: VESWinlogon - C:\WINDOWS\SYSTEM32\VESWinlogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O20 - Winlogon Notify: __c005877C - C:\WINDOWS\system32\__c005877C.dat (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

truguate 0 Light Poster · Answer 4 · 2008-01-27T16:26:25+00:00

truguate 0 Light Poster

16 Years Ago

ok am redoing it from beginning

truguate 0 Light Poster · Answer 5 · 2008-01-27T16:33:47+00:00

This is the new report

SDFix: Version 1.131

Run by MERCEDEZ on Sun 01/27/2008 at 04:52 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\MERCEDEZ\Desktop\SDFix

Safe Mode:
Checking Services:

Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...

Normal Mode:
Checking Files:

Trojan Files Found:

C:\PROGRA~1\COMPLU~1\LAVUQ.DLL - Deleted
C:\PROGRA~1\COMPLU~1\PROFSY~1.HTM - Deleted
C:\PROGRA~1\COMPLU~1\LAVUQ - Deleted
C:\WINDOWS\tk58.exe - Deleted
C:\WINDOWS\TTC-4444.exe - Deleted

The below files have been patched by Trojan.Agent.zb to load users32.dat and should be replaced:

C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\explorer.exe
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.

Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 05:02:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
"TracesProcessed"=dword:00000041
"TracesSuccessful"=dword:00000011

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

Remaining Services:
------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"D:\\Program Files\\ORL\\VNC\\WinVNC.exe"="D:\\Program Files\\ORL\\VNC\\WinVNC.exe:*:Disabled:VNC server for Win32"
"C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe"="C:\\Program Files\\Microsoft ActiveSync\\rapimgr.exe:*:Disabled:ActiveSync RAPI Manager"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files:
---------------

File Backups: - C:\DOCUME~1\MERCEDEZ\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes:

Sun 13 Jan 2008 1,058,455 ..SH. --- "C:\WINDOWS\system32\196A600c__.tmp"
Thu 23 Aug 2007 1,622,067 A.SH. --- "C:\WINDOWS\system32\qtstv.bak1"
Sun 26 Aug 2007 1,613,597 A.SH. --- "C:\WINDOWS\system32\qtstv.bak2"
Sat 21 Oct 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Thu 29 Nov 2007 25,088 ...H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\~WRL2579.tmp"
Tue 20 Nov 2007 41,984 ...H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\~WRL3673.tmp"
Mon 14 Mar 2005 299,008 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe"
Mon 28 Feb 2005 61,440 A..H. --- "C:\Program Files\Canon\MP Navigator 2.0\uinstrsc.dll"
Tue 4 Dec 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Thu 6 Dec 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7be05330969a5a501b6e6caeca8ba779\BITBC.tmp"
Wed 14 Nov 2007 0 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\New doo\IMAGE_070.jpg~RF1ea6d70.TMP"
Wed 23 Jan 2008 7,318 A..H. --- "C:\Documents and Settings\MERCEDEZ\Application Data\Microsoft\Office\Shortcut Bar\Off61.tmp"
Sat 21 Oct 2006 4,348 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv1key.bak"
Mon 6 Nov 2006 20 A..H. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv1lic.bak"
Sat 21 Oct 2006 400 A.SH. --- "C:\Documents and Settings\MERCEDEZ\My Documents\My Pictures\My Music\License Backup\drmv2key.bak"

Finished!

truguate 0 Light Poster · Answer 6 · 2008-01-27T16:58:33+00:00

received no disclaimer to type in 2 when i typed in ComboFix /u

just said combofix succesfully uninstalled is this the same

truguate 0 Light Poster · Answer 7 · 2008-01-27T17:11:47+00:00

this is the combo fix file i hope it is the right one

ComboFix 08-01-23.1C - MERCEDEZ 2008-01-27  6:03:43.5 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.571 [GMT -5:00]
Running from: C:\Documents and Settings\MERCEDEZ\Desktop\ComboFix.exe


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.


(((((((((((((((((((((((((   Files Created from 2007-12-27 to 2008-01-27  )))))))))))))))))))))))))))))))
.


2008-01-27 06:03 . 2000-08-31 08:00 51,200  --a------   C:\WINDOWS\Nircmd.exe
2008-01-26 23:45 . 2008-01-26 23:45 <DIR>    d--------   C:\WINDOWS\ERUNT
2008-01-26 23:19 . 2007-10-10 18:55 6,065,664   -----c---   C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-26 23:19 . 2007-06-30 22:31 2,455,488   -----c---   C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-26 23:19 . 2007-06-30 22:36 991,232 -----c---   C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-26 23:19 . 2007-10-10 18:55 459,264 -----c---   C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-26 23:19 . 2007-10-10 18:55 383,488 -----c---   C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-26 23:19 . 2007-10-10 18:55 267,776 -----c---   C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-26 23:19 . 2007-10-10 18:55 63,488  -----c---   C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-26 23:19 . 2007-10-10 18:55 52,224  -----c---   C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-26 23:19 . 2007-10-10 05:59 13,824  -----c---   C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-26 23:09 . 2007-08-13 18:54 33,792  --a--c---   C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-26 21:26 . 2008-01-26 21:26 0   --a------   C:\WINDOWS\7F.tmp
2008-01-26 20:19 . 2008-01-26 22:42 <DIR>    d--------   C:\Program Files\Common Files\Panda Software
2008-01-23 03:02 . 2008-01-23 03:02 <DIR>    d--------   C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-22 16:10 . 2007-07-30 19:19 271,224 --a------   C:\WINDOWS\system32\mucltui.dll
2008-01-22 16:10 . 2007-07-30 19:19 207,736 --a------   C:\WINDOWS\system32\muweb.dll
2008-01-22 16:10 . 2007-07-30 19:19 30,072  --a------   C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 02:25 . 2008-01-22 02:32 <DIR>    d--hsc---   C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:24 . 2008-01-22 02:34 <DIR>    d--------   C:\Program Files\Windows Live
2008-01-17 22:58 . 2008-01-26 19:00 16,384  --a------   C:\WINDOWS\system32\nod32se.exe
2008-01-17 22:58 . 2008-01-26 19:00 80  --a------   C:\WINDOWS\system32\suspend.bin
2008-01-14 01:55 . 2008-01-22 02:08 54,156  --ah-----   C:\WINDOWS\QTFont.qfn
2008-01-14 01:55 . 2008-01-14 01:55 1,409   --a------   C:\WINDOWS\QTFont.for
2008-01-13 00:24 . 2008-01-27 03:11 1,058,561   ---hs----   C:\WINDOWS\system32\196A600c__.ini2
2008-01-13 00:24 . 2008-01-13 00:24 1,058,455   ---hs----   C:\WINDOWS\system32\196A600c__.tmp
2008-01-08 23:05 . 2008-01-12 23:15 1,058,455   ---hs----   C:\WINDOWS\system32\196A600c__.ini
2008-01-08 22:14 . 2008-01-08 22:14 1,461,797   ---hs----   C:\WINDOWS\system32\3F07800c__.ini


.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 02:43    ---------   d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 01:06    ---------   d-----w C:\Program Files\Java
2008-01-09 16:00    4,224   ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-01-07 03:38    ---------   d-----w C:\Program Files\PerfMon
2008-01-06 20:41    ---------   d-----w C:\Program Files\Apoint
2008-01-03 02:18    ---------   d-----w C:\Program Files\Microsoft ActiveSync
2008-01-03 01:35    ---------   d-----w C:\Program Files\SystemDefender
2007-12-04 23:30    ---------   d-----w C:\Program Files\Zune
2007-12-03 06:24    ---------   d-----w C:\Program Files\SDMon
2007-11-20 04:09    65,536  ----a-w C:\WINDOWS\fccyxy.dll
2007-10-29 19:35    80,896  ----a-w C:\WINDOWS\awtuss.dll
2007-08-23 06:32    1,622,067   --sha-w C:\WINDOWS\system32\qtstv.bak1
2007-08-26 19:03    1,613,597   --sha-w C:\WINDOWS\system32\qtstv.bak2
.
Files Infected -  Win32.Agent.zb
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
.


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6E4865D3-306C-40CC-8FBA-2669CCE858FB}]
C:\Program Files\ComPlus Applications\lavuq.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC}]
2007-06-18 13:59    163840  --a------   C:\Program Files\Outlook Express\hokewokes83122.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@={E4000AC4-5E5F-4956-807A-C5854405D64F}


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="D:\Program Files\yahoo\Messenger\YahooMessenger.exe" [2008-01-06 07:51 4662776]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 03:28 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"Pvo"="C:\Documents and Settings\MERCEDEZ\Application Data\?ystem32\u?erinit.exe" [ ]
"Aim6"="" []


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2008-01-06 04:31 114688]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 15:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2008-01-06 03:35 45056]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2008-01-06 03:35 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2008-01-06 03:35 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 00:36 151552]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2008-01-06 15:58 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2008-01-06 15:58 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2008-01-23 03:26 114688]
"PartSeal"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"QuickTime Task"="D:\Downloads\quicktime\qttask.exe" [2008-01-06 15:58 286720]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-10-31 14:34 20752]
"SystemDefender"="C:\Program Files\SystemDefender\SystemDefender.exe" [ ]
"OpwareSE2"="D:\Program Files\canon picture\OpwareSE2.exe" [2008-01-06 15:58 49152]
"OPSE reminder"="D:\Program Files\EregEng\Ereg.exe" [ ]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe" [ ]


C:\Documents and Settings\MERCEDEZ\Start Menu\Programs\Startup\
Run WinVNC (App Mode).lnk - D:\Program Files\ORL\VNC\WinVNC.exe [2006-09-09 16:23:39 208896]


C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04 83360]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-09-09 15:44:36 106560]


[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\ComPlus Applications\profsyfs.html
FriendlyName=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hadjeijh]
C:\WINDOWS\system32\hadjeijh.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 20:42 73728 C:\WINDOWS\system32\VESWinlogon.dll


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c005877C]
C:\WINDOWS\system32\__c005877C.dat


R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 21:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]


.
**************************************************************************


catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 06:04:49
Windows 5.1.2600 Service Pack 2 NTFS


scanning hidden processes ...


scanning hidden autostart entries ...


scanning hidden files ...


scan completed successfully
hidden files: 0


**************************************************************************
.
Completion time: 2008-01-27  6:06:05
ComboFix-quarantined-files.txt  2008-01-27 11:05:38
ComboFix2.txt  2008-01-27 10:42:26
.
2008-01-27 04:22:32 --- E O F ---

truguate 0 Light Poster · Answer 8 · 2008-01-27T17:15:23+00:00

this is the hijack file

Logfile of HijackThis v1.99.1
Scan saved at 6:13:25 AM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Zune\ZuneLauncher.exe
D:\Program Files\canon picture\OpwareSE2.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
D:\Program Files\ORL\VNC\WinVNC.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll (file missing)
O2 - BHO: 0 - {6E4865D3-306C-40CC-8FBA-2669CCE858FB} - C:\Program Files\ComPlus Applications\lavuq.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B3789DFB-1EB5-4A41-A5FA-F09C034FA9DC} - C:\Program Files\Outlook Express\hokewokes83122.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [SystemDefender] "C:\Program Files\SystemDefender\SystemDefender.exe" hide
O4 - HKLM\..\Run: [OpwareSE2] "D:\Program Files\canon picture\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "D:\Program Files\EregEng\Ereg.exe" -r "D:\Program Files\EregEng\ereg.ini"
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Pvo] "C:\Documents and Settings\MERCEDEZ\Application Data\?ystem32\u?erinit.exe"
O4 - Startup: Run WinVNC (App Mode).lnk = D:\Program Files\ORL\VNC\WinVNC.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL
O20 - Winlogon Notify: hadjeijh - C:\WINDOWS\system32\hadjeijh.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: VESWinlogon - C:\WINDOWS\SYSTEM32\VESWinlogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O20 - Winlogon Notify: __c005877C - C:\WINDOWS\system32\__c005877C.dat (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe" /Service=VAIOMediaPlatform-IntegratedServer-HTTP /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="Applications\IntegratedServer\HTTP (file missing)
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Unknown owner - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe" /Service=VAIOMediaPlatform-Mobile-Gateway /RegRoot="SOFTWARE\Sony Corporation\VAIO Media Platform\2.0" /RegExt="\Addons\Packages\Mobile\Gateway" /DisplayName="VAIO Media Gateway Server (file missing)
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

Thank you crunchie for all your time and effort

truguate 0 Light Poster · Answer 9 · 2008-01-27T17:33:51+00:00

truguate 0 Light Poster

16 Years Ago

were these the right files

truguate 0 Light Poster · Answer 10 · 2008-01-28T00:43:43+00:00

new combo fix log

ComboFix 08-01-23.1C - MERCEDEZ 2008-01-27 13:23:23.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.615 [GMT -5:00]
Running from: C:\Documents and Settings\MERCEDEZ\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\MERCEDEZ\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WINDOWS\awtuss.dll
C:\WINDOWS\fccyxy.dll
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak2
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\awtuss.dll
C:\WINDOWS\fccyxy.dll
C:\WINDOWS\system32\qtstv.bak1
C:\WINDOWS\system32\qtstv.bak2

.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-27 06:03 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-26 23:45 . 2008-01-26 23:45 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-26 23:19 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-26 23:19 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-26 23:19 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-26 23:19 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-26 23:19 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-26 23:19 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-26 23:19 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-26 23:19 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-26 23:19 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-26 23:09 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-26 21:26 . 2008-01-26 21:26 0 --a------ C:\WINDOWS\7F.tmp
2008-01-26 20:19 . 2008-01-26 22:42 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-01-23 03:02 . 2008-01-23 03:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-22 16:10 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-22 16:10 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-22 16:10 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 02:25 . 2008-01-22 02:32 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:24 . 2008-01-22 02:34 <DIR> d-------- C:\Program Files\Windows Live
2008-01-17 22:58 . 2008-01-26 19:00 16,384 --a------ C:\WINDOWS\system32\nod32se.exe
2008-01-17 22:58 . 2008-01-26 19:00 80 --a------ C:\WINDOWS\system32\suspend.bin
2008-01-14 01:55 . 2008-01-22 02:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-14 01:55 . 2008-01-14 01:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-13 00:24 . 2008-01-27 03:11 1,058,561 ---hs---- C:\WINDOWS\system32\196A600c__.ini2
2008-01-13 00:24 . 2008-01-13 00:24 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.tmp
2008-01-08 23:05 . 2008-01-12 23:15 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.ini
2008-01-08 22:14 . 2008-01-08 22:14 1,461,797 ---hs---- C:\WINDOWS\system32\3F07800c__.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-27 17:57 --------- d-----w C:\Program Files\Viewpoint
2008-01-27 02:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 01:06 --------- d-----w C:\Program Files\Java
2008-01-09 16:00 4,224 ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-01-07 03:38 --------- d-----w C:\Program Files\PerfMon
2008-01-06 20:41 --------- d-----w C:\Program Files\Apoint
2008-01-03 02:18 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-03 01:35 --------- d-----w C:\Program Files\SystemDefender
2007-12-04 23:30 --------- d-----w C:\Program Files\Zune
2007-12-03 06:24 --------- d-----w C:\Program Files\SDMon
.
Files Infected - Win32.Agent.zb
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
.

((((((((((((((((((((((((((((( snapshot@2008-01-27_ 6.05.06.65 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 13:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
+ 2008-01-27 18:23:08 241,664 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-27 18:23:08 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-27 18:23:13 7,684,096 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-27 18:23:14 151,552 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-27 18:23:14 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-27 18:23:14 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-27 18:28:44 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4f4.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@={E4000AC4-5E5F-4956-807A-C5854405D64F}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="D:\Program Files\yahoo\Messenger\YahooMessenger.exe" [2008-01-06 07:51 4662776]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 03:28 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2008-01-06 04:31 114688]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 15:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [2008-01-06 03:35 45056]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [2008-01-06 03:35 184320]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2008-01-06 03:35 32768]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 00:36 151552]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2008-01-06 15:58 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2008-01-06 15:58 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2008-01-23 03:26 114688]
"PartSeal"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"QuickTime Task"="D:\Downloads\quicktime\qttask.exe" [2008-01-06 15:58 286720]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-10-31 14:34 20752]
"SystemDefender"="C:\Program Files\SystemDefender\SystemDefender.exe" [ ]
"OpwareSE2"="D:\Program Files\canon picture\OpwareSE2.exe" [2008-01-06 15:58 49152]
"OPSE reminder"="D:\Program Files\EregEng\Ereg.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04 83360]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-09-09 15:44:36 106560]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\ComPlus Applications\profsyfs.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 20:42 73728 C:\WINDOWS\system32\VESWinlogon.dll

R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 21:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 13:30:18
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-27 13:36:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-27 18:36:35
ComboFix2.txt 2008-01-27 11:06:06
ComboFix3.txt 2008-01-27 10:42:26
.
2008-01-27 04:22:32 --- E O F ---

truguate 0 Light Poster · Answer 11 · 2008-01-28T00:46:08+00:00

Update version of hijack this log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:44:46 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Zune\ZuneLauncher.exe
D:\Program Files\canon picture\OpwareSE2.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MERCEDEZ\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [SystemDefender] "C:\Program Files\SystemDefender\SystemDefender.exe" hide
O4 - HKLM\..\Run: [OpwareSE2] "D:\Program Files\canon picture\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "D:\Program Files\EregEng\Ereg.exe" -r "D:\Program Files\EregEng\ereg.ini"
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\ComPlus Applications\profsyfs.html

--
End of file - 10745 bytes

truguate 0 Light Poster · Answer 12 · 2008-01-28T06:25:11+00:00

truguate 0 Light Poster

16 Years Ago

how does it look crunchie

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 13 · 2008-01-28T06:54:21+00:00

You are going to have to reinstall all of the following:

C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

===================

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::
File::
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]http://i5.photobucket.com/albums/y153/crunchie1/CFScript.gif[/IMG]

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:

Combofix.txt
A new HijackThis log.

Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Let me know how the pc is after.

truguate 0 Light Poster · Answer 14 · 2008-01-28T07:01:32+00:00

is this code i drag going to reinstall the files you said i had to or will i have to manually re-install files

truguate 0 Light Poster · Answer 15 · 2008-01-28T07:46:22+00:00

combo file

ComboFix 08-01-23.1C - MERCEDEZ 2008-01-27 20:13:52.7 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.496 [GMT -5:00]
Running from: C:\Documents and Settings\MERCEDEZ\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\MERCEDEZ\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.ex
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\igfxtray.exe
D:\Downloads\quicktime\qttask.exe
D:\Program Files\canon picture\OpwareSE2.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.

2008-01-27 20:23 . 2008-01-27 20:23 92,544 --a------ C:\WINDOWS\system32\drivers\av5flt.sys
2008-01-27 19:04 . 2008-01-27 19:04 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2008-01-27 18:57 . 2008-01-27 18:57 24 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
2008-01-27 18:25 . 2008-01-27 18:55 13,880 --a------ C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-01-27 18:24 . 2008-01-27 18:55 221,060 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
2008-01-27 18:24 . 2008-01-27 20:11 1,224 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
2008-01-27 18:15 . 2008-01-27 18:55 221,060 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-01-27 18:15 . 2007-06-06 10:43 83,640 --a------ C:\WINDOWS\system32\drivers\pavdrv51.sys
2008-01-27 18:15 . 2008-01-27 20:11 1,224 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-01-27 18:15 . 2008-01-27 18:15 281 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-01-27 18:14 . 2008-01-27 18:29 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-01-27 18:14 . 2007-07-11 11:39 191,672 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 132,920 --a------ C:\WINDOWS\system32\drivers\NETFLTDI.SYS
2008-01-27 18:14 . 2007-05-11 09:33 71,736 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
2008-01-27 18:14 . 2007-05-11 09:33 51,256 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 37,304 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 30,648 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 22,072 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
2008-01-27 18:11 . 2007-03-15 19:38 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
2008-01-27 18:10 . 2008-01-27 18:10 <DIR> d-------- C:\Program Files\Panda Security
2008-01-27 18:10 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-01-27 18:10 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-01-27 18:10 . 2007-04-24 15:43 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
2008-01-27 18:10 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-01-27 18:10 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-01-27 18:10 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-01-27 18:10 . 2007-06-08 08:44 24,760 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
2008-01-27 18:10 . 2007-04-24 16:43 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-01-27 18:04 . 2007-07-12 13:49 178,872 --a------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-01-27 18:04 . 2007-05-23 15:40 38,968 --a------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-01-26 23:45 . 2008-01-26 23:45 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-26 23:19 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-26 23:19 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-26 23:19 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-26 23:19 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-26 23:19 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-26 23:19 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-26 23:19 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-26 23:19 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-26 23:19 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-26 23:09 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-26 21:26 . 2008-01-26 21:26 0 --a------ C:\WINDOWS\7F.tmp
2008-01-26 20:19 . 2008-01-27 18:04 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-01-23 03:02 . 2008-01-23 03:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-22 16:10 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-22 16:10 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-22 16:10 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 02:25 . 2008-01-22 02:32 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:24 . 2008-01-22 02:34 <DIR> d-------- C:\Program Files\Windows Live
2008-01-17 22:58 . 2008-01-26 19:00 16,384 --a------ C:\WINDOWS\system32\nod32se.exe
2008-01-17 22:58 . 2008-01-26 19:00 80 --a------ C:\WINDOWS\system32\suspend.bin
2008-01-14 01:55 . 2008-01-22 02:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-14 01:55 . 2008-01-14 01:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-13 00:24 . 2008-01-27 03:11 1,058,561 ---hs---- C:\WINDOWS\system32\196A600c__.ini2
2008-01-13 00:24 . 2008-01-13 00:24 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.tmp
2008-01-08 23:05 . 2008-01-12 23:15 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.ini
2008-01-08 22:14 . 2008-01-08 22:14 1,461,797 ---hs---- C:\WINDOWS\system32\3F07800c__.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 01:18 --------- d-----w C:\Program Files\Apoint
2008-01-27 17:57 --------- d-----w C:\Program Files\Viewpoint
2008-01-27 02:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 01:06 --------- d-----w C:\Program Files\Java
2008-01-09 16:00 4,224 ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-01-07 03:38 --------- d-----w C:\Program Files\PerfMon
2008-01-03 02:18 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-03 01:35 --------- d-----w C:\Program Files\SystemDefender
2007-12-04 23:30 --------- d-----w C:\Program Files\Zune
2007-12-03 06:24 --------- d-----w C:\Program Files\SDMon
.
Files Infected - Win32.Agent.zb
C:\WINDOWS\system32\igfxpers.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@={E4000AC4-5E5F-4956-807A-C5854405D64F}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="D:\Program Files\yahoo\Messenger\YahooMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 03:28 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 15:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [ ]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [ ]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [ ]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 00:36 151552]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [ ]
"PartSeal"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"QuickTime Task"="D:\Downloads\quicktime\qttask.exe" [ ]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-10-31 14:34 20752]
"SystemDefender"="C:\Program Files\SystemDefender\SystemDefender.exe" [ ]
"OpwareSE2"="D:\Program Files\canon picture\OpwareSE2.exe" [ ]
"OPSE reminder"="D:\Program Files\EregEng\Ereg.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04 83360]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-09-09 15:44:36 106560]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\ComPlus Applications\profsyfs.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 20:42 73728 C:\WINDOWS\system32\VESWinlogon.dll

R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 09:33]
R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 09:33]
R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 09:33]
R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 11:39]
R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 09:33]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 15:40]
R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 09:33]
R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 09:33]
R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 08:44]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 13:49]
R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
R3 ComFiltr;Panda Anti-Dialer;C:\WINDOWS\system32\DRIVERS\COMFiltr.sys [2008-01-27 20:28]
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 15:43]
R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 21:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]

*Newly Created Service* - COMFILTR
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-27 20:24:52
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwEnumerateKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
ComboFix-quarantined-files.txt 2008-01-28 01:34:58
ComboFix2.txt 2008-01-27 18:36:42
ComboFix3.txt 2008-01-27 11:06:06
ComboFix4.txt 2008-01-27 10:42:26
.
2008-01-28 00:18:18 --- E O F ---

truguate 0 Light Poster · Answer 16 · 2008-01-28T07:49:28+00:00

hijack file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:48:19 PM, on 1/27/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
c:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\ApvxdWin.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\avciman.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MERCEDEZ\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [SystemDefender] "C:\Program Files\SystemDefender\SystemDefender.exe" hide
O4 - HKLM\..\Run: [OpwareSE2] "D:\Program Files\canon picture\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "D:\Program Files\EregEng\Ereg.exe" -r "D:\Program Files\EregEng\ereg.ini"
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\ComPlus Applications\profsyfs.html

--
End of file - 12265 bytes

truguate 0 Light Poster · Answer 17 · 2008-01-28T08:16:55+00:00

crunchie what is it you look the log for when you look at log file

truguate 0 Light Poster · Answer 18 · 2008-01-28T08:18:54+00:00

crunchie what is it you look for when you look through the log files for my own personal reference

truguate 0 Light Poster · Answer 19 · 2008-01-28T08:50:42+00:00

truguate 0 Light Poster

16 Years Ago

it is running a lot better how do the logs look

truguate 0 Light Poster · Answer 20 · 2008-01-29T07:13:24+00:00

truguate 0 Light Poster

16 Years Ago

crunchie do the logs look ok

overwhelmed 1 Posting Whiz in Training · Answer 21 · 2008-01-29T12:16:07+00:00

hey trugat i will help you out since crunchie seems to have their hands full....

do you have CCleaner ? if not than click this link
http://www.ccleaner.com/download/builds/

run a scan with this and a registry scan with it and then post the new HiJackThis log

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 22 · 2008-01-29T13:15:05+00:00

is this code i drag going to reinstall the files you said i had to or will i have to manually re-install files

The code will delete the infected files. You will have to re-install all those programs again.

1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

KillAll::
File::
C:\WINDOWS\system32\igfxpers.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

7. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:

Combofix.txt
A new HijackThis log.

Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

truguate 0 Light Poster · Answer 23 · 2008-01-31T07:16:47+00:00

combo fix log

ComboFix 08-01-23.1C - MERCEDEZ 2008-01-30 19:51:03.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.501 [GMT -5:00]
Running from: C:\Documents and Settings\MERCEDEZ\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\MERCEDEZ\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
C:\WINDOWS\system32\igfxpers.exe
D:\Program Files\yahoo\Messenger\YahooMessenger.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-31 )))))))))))))))))))))))))))))))
.

2008-01-30 20:00 . 2008-01-30 20:00 92,544 --a------ C:\WINDOWS\system32\drivers\av5flt.sys
2008-01-27 18:57 . 2008-01-29 15:33 96 --a------ C:\WINDOWS\system32\drivers\wnmsav.dat
2008-01-27 18:25 . 2008-01-30 15:34 13,880 --a------ C:\WINDOWS\system32\drivers\COMFiltr.sys
2008-01-27 18:24 . 2008-01-30 15:34 228,168 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT.bck
2008-01-27 18:24 . 2008-01-30 19:47 1,224 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG.bck
2008-01-27 18:15 . 2008-01-30 15:34 228,168 --a------ C:\WINDOWS\system32\drivers\APPFCONT.DAT
2008-01-27 18:15 . 2007-06-06 10:43 83,640 --a------ C:\WINDOWS\system32\drivers\pavdrv51.sys
2008-01-27 18:15 . 2008-01-30 19:47 1,224 --a------ C:\WINDOWS\system32\drivers\APPFLTR.CFG
2008-01-27 18:15 . 2008-01-27 18:15 281 --a------ C:\WINDOWS\system32\PavCPL.dat
2008-01-27 18:14 . 2008-01-27 18:29 <DIR> d-------- C:\WINDOWS\system32\PAV
2008-01-27 18:14 . 2007-07-11 11:39 191,672 --a------ C:\WINDOWS\system32\drivers\idsflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 132,920 --a------ C:\WINDOWS\system32\drivers\NETFLTDI.SYS
2008-01-27 18:14 . 2007-05-11 09:33 71,736 --a------ C:\WINDOWS\system32\drivers\APPFLT.SYS
2008-01-27 18:14 . 2007-05-11 09:33 51,256 --a------ C:\WINDOWS\system32\drivers\dsaflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 37,304 --a------ C:\WINDOWS\system32\drivers\smsflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 30,648 --a------ C:\WINDOWS\system32\drivers\wnmflt.sys
2008-01-27 18:14 . 2007-05-11 09:33 22,072 --a------ C:\WINDOWS\system32\drivers\fnetmon.sys
2008-01-27 18:11 . 2007-03-15 19:38 54,832 --a------ C:\WINDOWS\system32\pavcpl.cpl
2008-01-27 18:10 . 2008-01-27 18:10 <DIR> d-------- C:\Program Files\Panda Security
2008-01-27 18:10 . 2007-07-12 08:42 292,144 --a------ C:\WINDOWS\system32\PavSHook.dll
2008-01-27 18:10 . 2007-03-13 18:01 161,328 --a------ C:\WINDOWS\system32\TpUtil.dll
2008-01-27 18:10 . 2007-04-24 15:43 142,128 --a------ C:\WINDOWS\system32\drivers\netimflt.sys
2008-01-27 18:10 . 2006-06-27 19:36 101,888 --a------ C:\WINDOWS\system32\SYSTOOLS.DLL
2008-01-27 18:10 . 2007-02-28 18:04 63,024 --a------ C:\WINDOWS\system32\pavipc.dll
2008-01-27 18:10 . 2007-02-15 20:02 50,736 --a------ C:\WINDOWS\system32\avldr.dll
2008-01-27 18:10 . 2007-06-08 08:44 24,760 --a------ C:\WINDOWS\system32\drivers\cpoint.sys
2008-01-27 18:10 . 2007-04-24 16:43 1,990 --a------ C:\WINDOWS\system32\drivers\net_m32.inf
2008-01-27 18:04 . 2007-07-12 13:49 178,872 --a------ C:\WINDOWS\system32\drivers\PavProc.sys
2008-01-27 18:04 . 2007-05-23 15:40 38,968 --a------ C:\WINDOWS\system32\drivers\ShlDrv51.sys
2008-01-26 23:45 . 2008-01-26 23:45 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-26 23:19 . 2007-10-10 18:55 6,065,664 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll
2008-01-26 23:19 . 2007-06-30 22:31 2,455,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-01-26 23:19 . 2007-06-30 22:36 991,232 -----c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-01-26 23:19 . 2007-10-10 18:55 459,264 -----c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-01-26 23:19 . 2007-10-10 18:55 383,488 -----c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-01-26 23:19 . 2007-10-10 18:55 267,776 -----c--- C:\WINDOWS\system32\dllcache\iertutil.dll
2008-01-26 23:19 . 2007-10-10 18:55 63,488 -----c--- C:\WINDOWS\system32\dllcache\icardie.dll
2008-01-26 23:19 . 2007-10-10 18:55 52,224 -----c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-01-26 23:19 . 2007-10-10 05:59 13,824 -----c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-01-26 23:09 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-01-26 21:26 . 2008-01-26 21:26 0 --a------ C:\WINDOWS\7F.tmp
2008-01-26 20:19 . 2008-01-27 18:04 <DIR> d-------- C:\Program Files\Common Files\Panda Software
2008-01-23 03:02 . 2008-01-23 03:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-01-22 16:10 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-01-22 16:10 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-01-22 16:10 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-01-22 02:25 . 2008-01-22 02:32 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-01-22 02:24 . 2008-01-22 02:34 <DIR> d-------- C:\Program Files\Windows Live
2008-01-17 22:58 . 2008-01-26 19:00 16,384 --a------ C:\WINDOWS\system32\nod32se.exe
2008-01-17 22:58 . 2008-01-26 19:00 80 --a------ C:\WINDOWS\system32\suspend.bin
2008-01-14 01:55 . 2008-01-22 02:08 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-14 01:55 . 2008-01-14 01:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-13 00:24 . 2008-01-27 03:11 1,058,561 ---hs---- C:\WINDOWS\system32\196A600c__.ini2
2008-01-13 00:24 . 2008-01-13 00:24 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.tmp
2008-01-08 23:05 . 2008-01-12 23:15 1,058,455 ---hs---- C:\WINDOWS\system32\196A600c__.ini
2008-01-08 22:14 . 2008-01-08 22:14 1,461,797 ---hs---- C:\WINDOWS\system32\3F07800c__.ini
2007-12-12 23:31 . 2008-01-10 03:15 118 --a------ C:\WINDOWS\system32\MRT.INI
2007-12-04 18:28 . 2007-12-04 18:30 <DIR> d-------- C:\Program Files\Zune
2007-12-01 02:37 . 2008-01-08 22:14 1,462,782 ---hs---- C:\WINDOWS\svutvw.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-28 01:18 --------- d-----w C:\Program Files\Apoint
2008-01-27 17:57 --------- d-----w C:\Program Files\Viewpoint
2008-01-27 02:43 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-27 01:06 --------- d-----w C:\Program Files\Java
2008-01-09 16:00 4,224 ----a-w C:\WINDOWS\system32\drivers\beep.sys
2008-01-07 03:38 --------- d-----w C:\Program Files\PerfMon
2008-01-03 02:18 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-03 01:35 --------- d-----w C:\Program Files\SystemDefender
2007-12-03 06:24 --------- d-----w C:\Program Files\SDMon
.
Files Infected - Win32.Agent.zb
C:\Program Files\Windows Live\Messenger\MsnMsgr.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\VirtualExpanderFile.1]
@={E4000AC4-5E5F-4956-807A-C5854405D64F}

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="D:\Program Files\yahoo\Messenger\YahooMessenger.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [ ]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-11-13 12:39 1289000]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"Aim6"="" []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [ ]
"RTHDCPL"="RTHDCPL.EXE" [2005-06-29 15:25 14720000 C:\WINDOWS\RTHDCPL.EXE]
"AzMixerSel"="C:\Program Files\Realtek\InstallShield\AzMixerSel.exe" [ ]
"VAIO Recovery"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"SonyPowerCfg"="C:\Program Files\Sony\VAIO Power Management\SPMgr.exe" [ ]
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [ ]
"VAIO Update 2"="C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 00:36 151552]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [ ]
"PartSeal"="C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-19 23:08 28672]
"QuickTime Task"="D:\Downloads\quicktime\qttask.exe" [ ]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2006-10-31 14:34 20752]
"SystemDefender"="C:\Program Files\SystemDefender\SystemDefender.exe" [ ]
"OpwareSE2"="D:\Program Files\canon picture\OpwareSE2.exe" [ ]
"OPSE reminder"="D:\Program Files\EregEng\Ereg.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe" [ ]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - D:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 20:01:04 83360]
WinZip Quick Pick.lnk - D:\Program Files\WinZip\WZQKPICK.EXE [2006-09-09 15:44:36 106560]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\ComPlus Applications\profsyfs.html
FriendlyName=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr]
avldr.dll 2007-02-15 20:02 50736 C:\WINDOWS\system32\avldr.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2005-05-20 20:42 73728 C:\WINDOWS\system32\VESWinlogon.dll

R1 APPFLT;App Filter Plugin;C:\WINDOWS\system32\Drivers\APPFLT.SYS [2007-05-11 09:33]
R1 DSAFLT;DSA Filter Plugin;C:\WINDOWS\system32\Drivers\DSAFLT.SYS [2007-05-11 09:33]
R1 FNETMON;NetMon Filter Plugin;C:\WINDOWS\system32\Drivers\fnetmon.SYS [2007-05-11 09:33]
R1 IDSFLT;Ids Filter Plugin;C:\WINDOWS\system32\Drivers\IDSFLT.SYS [2007-07-11 11:39]
R1 NETFLTDI;Panda Net Driver [TDI Layer];C:\WINDOWS\system32\Drivers\NETFLTDI.SYS [2007-05-11 09:33]
R1 ShldDrv;Panda File Shield Driver;C:\WINDOWS\system32\DRIVERS\ShlDrv51.sys [2007-05-23 15:40]
R1 SMSFLT;SMS Filter Plugin;C:\WINDOWS\system32\Drivers\SMSFLT.SYS [2007-05-11 09:33]
R1 WNMFLT;Wifi Monitor Filter Plugin;C:\WINDOWS\system32\Drivers\WNMFLT.SYS [2007-05-11 09:33]
R2 cpoint;Panda CPoint Driver;C:\WINDOWS\system32\Drivers\cpoint.sys [2007-06-08 08:44]
R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
R2 PavProc;Panda Process Protection Driver;C:\WINDOWS\system32\DRIVERS\PavProc.sys [2007-07-12 13:49]
R3 AvFlt;Antivirus Filter Driver;C:\WINDOWS\system32\drivers\av5flt.sys []
R3 NETIMFLT;PANDA NDIS IM Filter Miniport;C:\WINDOWS\system32\DRIVERS\netimflt.sys [2007-04-24 15:43]
R3 PavSRK.sys;PavSRK.sys;C:\WINDOWS\system32\PavSRK.sys []
R3 PavTPK.sys;PavTPK.sys;C:\WINDOWS\system32\PavTPK.sys []
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 21:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-30 20:01:48
Windows 5.1.2600 Service Pack 2 NTFS

detected NTDLL code modification:
ZwEnumerateKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-30 20:11:39 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-31 01:11:32
ComboFix2.txt 2008-01-28 01:35:10
ComboFix3.txt 2008-01-27 18:36:42
ComboFix4.txt 2008-01-27 11:06:06
ComboFix5.txt 2008-01-27 10:42:26
.
2008-01-28 00:18:18 --- E O F ---

truguate 0 Light Poster · Answer 24 · 2008-01-31T07:18:51+00:00

hijack log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:17:43 PM, on 1/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\AVENGINE.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
c:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\MERCEDEZ\Desktop\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\canon picture\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [AzMixerSel] "C:\Program Files\Realtek\InstallShield\AzMixerSel.exe"
O4 - HKLM\..\Run: [VAIO Recovery] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] "C:\Program Files\Sony\ISB Utility\ISBMgr.exe"
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [PartSeal] "C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Downloads\quicktime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [SystemDefender] "C:\Program Files\SystemDefender\SystemDefender.exe" hide
O4 - HKLM\..\Run: [OpwareSE2] "D:\Program Files\canon picture\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "D:\Program Files\EregEng\Ereg.exe" -r "D:\Program Files\EregEng\ereg.ini"
O4 - HKCU\..\Run: [Yahoo! Pager] "D:\Program Files\yahoo\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] D:\Downloads\picassa\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = D:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\canon picture\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O23 - Service: Automatic LiveUpdate Scheduler - Unknown owner - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe (file missing)
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe
O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe
O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe
O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrv51.exe
O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE
O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
O24 - Desktop Component 0: (no name) - C:\Program Files\ComPlus Applications\profsyfs.html

--
End of file - 11964 bytes

Thanx for your time crunchie

unsure what is wrong please help thanx

Recommended Answers Collapse Answers

All 33 Replies

Recommended Answers