ok, a friend of mine has had a remote desktop trojan installed on her pc. It came from a file that someone sent her via IM and was intentionally put there. The person now seems to have control over her pc, at least enough to type on her screen. Her antivirus hasnt detected anything, but she says she watched letters appear on her screen as he typed them and her pc has been acting very weird, freezing and crashing, etc, so im assuming theres something on there. heres a hijack this log that i just had her make: Logfile of HijackThis v1.99.1 Scan saved at 5:59:15 PM, on 8/5/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Executive Software\Diskeeper\DkService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Media Player\WMPNetwk.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\alg.exe C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\MultiRes\MultiRes.exe C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\livecall.exe C:\Program Files\AIM\aim.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\WinRAR\WinRAR.exe C:\DOCUME~1\Hello\LOCALS~1\Temp\Rar$EX00.828\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SEENUS/SAOS01 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cus.../*http://www.yahoo.com/ext/search/search.html O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {b00a2d93-a2c4-48aa-a6d9-e78835eaefc8} - (no file) O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll O4 - HKLM\..\Run: [D-Link AirPlus Xtreme G] C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe O4 - HKLM\..\Run: [ANIWZCSService] C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [\\JOHN-COMP\EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P35 "\\JOHN-COMP\EPSON Stylus C86 Series" /O6 "USB001" /M "Stylus C86" O4 - HKLM\..\Run: [MultiRes] C:\Program Files\MultiRes\MultiRes.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" O4 - HKLM\..\Run: [Auto EPSON Stylus C86 Series on JOHN-COMP] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P41 "Auto EPSON Stylus C86 Series on JOHN-COMP" /O22 "\\JOHN-COMP\EPSON-JOHN" /M "Stylus C86" O4 - HKLM\..\Run: [KAVPersonal50] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" /minimize O4 - HKLM\..\Run: [\\JOHN\EPSON Stylus C86 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P30 "\\JOHN\EPSON Stylus C86 Series" /O6 "USB001" /M "Stylus C86" O4 - HKLM\..\Run: [Auto EPSON Stylus C86 Series on JOHN] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.EXE /P36 "Auto EPSON Stylus C86 Series on JOHN" /O15 "\\JOHN\EPSONSty" /M "Stylus C86" O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {03F49E0E-C43A-4037-BBD6-D681E998A08E} (CodeAx Class) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/CM_CodeAx.cab O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab O16 - DPF: {3C611C53-3468-4F9D-8C2E-ADA0338F9E79} (AcubeComm Control) - http://ezhub.hanyang.ac.kr:8080/EP/web/common/cabfiles/AcubeComm.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} (ijjiPlugin2 Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1120681114483 O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v8.cab O16 - DPF: {710E4921-F77C-4D42-8EC4-4DFDEE52508F} (ictPrintXForm Control) - http://211.35.57.161/web_kiosk_3/activeX/ictPrintX.cab O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx2.6.1.7_en_dl.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BC5E698E-77CF-45EF-80A3-090A4B6AAF83} (HGPlugin8USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin8USA.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab O16 - DPF: {DD583921-A9E9-4FBF-9266-8DC2AB5EA0AF} (HGPlugin10USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin10USA.cab O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://download.games.yahoo.com/games/web_games/popcap/bejeweled2/popcaploader_v6.cab O16 - DPF: {F2D35D99-63B1-46D3-970C-6E22320D5DCB} (kSoloCntrlIE Class) - http://www.ksolo.com/playerBase/kSoloIEHDSD.cab O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O20 - Winlogon Notify: acldit - acldit.dll (file missing) O20 - Winlogon Notify: Antiwpa - antiwpa.dll (file missing) O20 - Winlogon Notify: disldp - disldp.dll (file missing) O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\Diskeeper\DkService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: kavsvc - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kavsvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe Any help would be greatly appreciated so thanks in advance. :] Also, let me know if theres anyother information i could provide you with.
Download and Run ComboFix *Download this file from either of the two below listed places : http://download.bleepingcomputer.com/sUBs/ComboFix.exe http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe *Then double click combofix.exe & follow the prompts. *When finished, it shall produce a log for you. Post that log in your next reply Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall
ok, she got it and ran it, here is the log: ComboFix 07-08-04.3 - "Hello" 2007-08-06 21:20:01.1 [GMT -6:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007 C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode C:\DOCUME~1\Hello\APPLIC~1.\winantispyware 2007 C:\DOCUME~1\Hello\APPLIC~1.\winantispyware 2007\Logs\update.log C:\DOCUME~1\Hello\Desktop\internet.lnk C:\Program Files\Common Files\ladu.dll C:\Program Files\Common Files\winantispyware 2007 C:\Program Files\Common Files\winantispyware 2007\err.log C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe C:\Program Files\MSN Gaming Zone\horefoqe83122.dll C:\Program Files\outerinfo C:\Program Files\outerinfo\Terms.rtf C:\Program Files\tsks~1 C:\Program Files\tsks~1\m?config.exe C:\WINDOWS\b122.exe C:\WINDOWS\dls0523pmw.exe C:\WINDOWS\mbbgrls.exe C:\WINDOWS\rau001978.exe C:\WINDOWS\system32\abadd.ini C:\WINDOWS\system32\aqqtgqln.dll C:\WINDOWS\system32\bkqwkeft.exe C:\WINDOWS\system32\ddaba.dll C:\WINDOWS\system32\driver C:\WINDOWS\system32\driver\w717.exe C:\WINDOWS\system32\drivers\fopn.sys C:\WINDOWS\system32\ehkmp.bak1 C:\WINDOWS\system32\ehkmp.ini C:\WINDOWS\system32\ehkmp.ini2 C:\WINDOWS\system32\ehkmp.tmp C:\WINDOWS\system32\euccrptn.exe C:\WINDOWS\system32\F2 C:\WINDOWS\system32\F3 C:\WINDOWS\system32\F3\n553.exe C:\WINDOWS\system32\jkklj.dll C:\WINDOWS\system32\jlkkj.bak1 C:\WINDOWS\system32\jlkkj.ini2 C:\WINDOWS\system32\jlkkj.tmp C:\WINDOWS\system32\rppxtvro.exe C:\WINDOWS\system32\ssqpmlk.dll C:\WINDOWS\system32\ubkgkpse.exe C:\WINDOWS\system32\urqqrsq.dll C:\WINDOWS\system32\vftrlrag.exe C:\WINDOWS\system32\vvvwa.bak1 C:\WINDOWS\system32\vvvwa.bak2 C:\WINDOWS\system32\vvvwa.ini C:\WINDOWS\system32\vvvwa.ini2 C:\WINDOWS\system32\vvvwa.tmp C:\WINDOWS\system32\wcpicomsv32.exe C:\WINDOWS\system32\yayxuuv.dll C:\WINDOWS\system32\zxdnt3d.cfg C:\WINDOWS\TISKY009.exe C:\WINDOWS\tk58.exe C:\WINDOWS\wnsxs~1 C:\WINDOWS\wnsxs~1\arpa.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_FOPN -------\LEGACY_NET_AGENT -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS -------\Net Agent ((((((((((((((((((((((((( Files Created from 2007-07-07 to 2007-08-07 ))))))))))))))))))))))))))))))) 2007-08-06 21:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-06 20:51 125,504 --a------ C:\WINDOWS\system32\yfinuqvb.dll 2007-08-06 19:02 9,769 --a------ C:\WINDOWS\vfpiy0578.exe 2007-08-06 03:28 60,928 --a------ C:\WINDOWS\system32\qzuv.dll 2007-08-06 03:28 169,147 --a------ C:\WINDOWS\TTC-4444.exe 2007-08-06 03:27 586,352 -r-hs---- C:\WINDOWS\mbbgrlsA.exe 2007-08-06 03:27 <DIR> d-------- C:\WINDOWS\system32\f02WtR 2007-08-06 03:27 <DIR> d-------- C:\WINDOWS\system32\configs 2007-08-06 03:27 <DIR> d-------- C:\temp\fse 2007-08-06 03:27 <DIR> d-------- C:\temp\1cb 2007-08-05 18:16 <DIR> d-------- C:\Program Files\AruaROSE 2007-08-05 18:16 <DIR> d-------- C:\DOCUME~1\Hello\APPLIC~1\InstallShield 2007-08-05 17:06 271,224 --a------ C:\WINDOWS\system32\mucltui.dll 2007-08-05 17:06 208,248 --a------ C:\WINDOWS\system32\muweb.dll 2007-08-05 00:24 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-08-04 17:33 <DIR> d-------- C:\Program Files\iTunes 2007-08-02 19:16 <DIR> d-------- C:\WINDOWS\Windows 2007-08-02 18:43 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Musicnotes 2007-07-31 21:03 <DIR> d-------- C:\WINDOWS\system32\appmgmt 2007-07-23 00:41 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\pixelStorm 2007-07-08 00:53 <DIR> d-------- C:\DOCUME~1\Hello\havenROp 2007-07-07 02:38 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-07-07 02:38 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-06 21:26 --------- d-------- C:\Program Files\MSN Gaming Zone 2007-08-06 09:16 246 --a------ C:\Program Files\Common Files\ladu 2007-08-05 18:16 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-08-04 17:33 --------- d-------- C:\Program Files\iPod 2007-08-02 20:04 --------- d-------- C:\Program Files\XoftSpy 2007-08-01 00:22 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\Apple Computer 2007-07-28 03:06 135 --a------ C:\Program Files\Common Files\promy.html 2007-07-21 17:54 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\AdobeUM 2007-07-14 00:07 --------- d-------- C:\Program Files\QuickTime 2007-07-08 01:32 --------- d-------- C:\Program Files\Gravity 2007-07-04 18:29 65536 --a------ C:\WINDOWS\IFinst27.exe 2007-07-04 11:46 1051442874 --a------ C:\Program Files\SAK_SETUP0417.exe 2007-07-03 15:21 --------- d-------- C:\DOCUME~1\Hello\APPLIC~1\Canon 2007-06-26 22:28 --------- d--h----- C:\DOCUME~1\Hello\APPLIC~1\ijjigame 2007-06-19 02:24 --------- d-------- C:\Program Files\Windows Journal Viewer 2007-05-16 09:12 86528 -----c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 09:12 85504 -----c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 09:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 09:12 683520 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 09:12 510976 -----c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 09:12 1314816 -----c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 03:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2007-04-23 15:57 75040 --a------ C:\DOCUME~1\Hello\APPLIC~1\GDIPFONTCACHEV1.DAT 2007-04-06 20:30 7961888 --a------ C:\Program Files\AnimaRO_Setup_2006-12-23.zip 2007-04-04 23:18 959387001 --a------ C:\Program Files\SAK_SETUP0711.exe 2007-03-29 13:27 621154168 --a------ C:\Program Files\dance_3-28-2007.exe 2007-03-28 21:22 262411 --a------ C:\Program Files\endless_love-reason.zip 2007-03-26 13:18 1367553 --a------ C:\Program Files\mirc621.exe ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{192D6E8A-5CB8-47AF-958E-A29E3BDA374D}] 2007-08-02 07:43 282624 --a------ C:\Program Files\MSN Gaming Zone\horefoqe4444.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3C8CF897-6571-4881-2900-34B67D4DFECE}] 2007-08-01 07:43 60928 --a------ C:\WINDOWS\system32\qzuv.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{991EF04C-93CF-469b-A2BE-CC1B3347566F}] C:\Program Files\BHO\plugin.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{b00a2d93-a2c4-48aa-a6d9-e78835eaefc8}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "D-Link AirPlus Xtreme G"="C:\Program Files\D-Link\AirPlus Xtreme G\AirPlusCFG.exe" [2003-11-04 17:00] "ANIWZCSService"="C:\Program Files\Alpha Networks\ANIWZCS Service\WZCSLDR.exe" [2003-08-21 16:12] "SoundMan"="SOUNDMAN.EXE" [2005-04-15 11:01 C:\WINDOWS\SOUNDMAN.EXE] "\\JOHN-COMP\EPSON Stylus C86 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00] "MultiRes"="C:\Program Files\MultiRes\MultiRes.exe" [2005-01-26 16:40] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-03-24 11:04] "nwiz"="nwiz.exe" [2004-03-24 11:04 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-03-24 11:04] "DiskeeperSystray"="C:\Program Files\Executive Software\Diskeeper\DkIcon.exe" [2005-06-10 15:46] "Auto EPSON Stylus C86 Series on JOHN-COMP"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00] "KAVPersonal50"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal Pro\kav.exe" [2005-08-30 07:20] "\\JOHN\EPSON Stylus C86 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00] "Auto EPSON Stylus C86 Series on JOHN"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2R1.exe" [2003-11-25 04:00] "OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [2003-05-08 12:00] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-06 23:46] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44] "mbbgrlsA"="C:\WINDOWS\mbbgrlsA.exe" [1989-12-12 10:10] "{E1-12-23-31-ZN}"="c:\windows\system32\lodsregj.exe" [] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2005-07-20 16:57] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56] "Aim6"="" [] "Wuch"="C:\WINDOWS\WNSXS~1\arpa.exe" [] "Qca"="C:\Program Files\T?sks\m?config.exe" [] "WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05] C:\Documents and Settings\Hello\Start Menu\Programs\Startup\ Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "AllowLegacyWebView"=1 (0x1) "AllowUnhashedWebView"=1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acldit] acldit.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Antiwpa] antiwpa.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\disldp] disldp.dll R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 Klmc;Klmc;C:\WINDOWS\system32\drivers\klmc.sys R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys S3 FETNDIS;VIA PCI 10/100Mb Fast Ethernet Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\fetnd5.sys S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S3 TIEHDUSB;TIEHDUSB;C:\WINDOWS\system32\drivers\tiehdusb.sys S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" Contents of the 'Scheduled Tasks' folder 2007-08-04 04:19:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe 2007-08-07 02:34:41 C:\WINDOWS\Tasks\XoftSpy.job - C:\Program Files\XoftSpy\XoftSpy.exe ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-06 21:30:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 2239 ************************************************************************** [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "\\\\JOHN-COMP\\EPSON Stylus C86 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P35 \"\\\\JOHN-COMP\\EPSON Stylus C86 Series\" /O6 \"USB001\" /M \"Stylus C86\"" "\\\\JOHN\\EPSON Stylus C86 Series"="C:\\WINDOWS\\System32\\spool\\DRIVERS\\W32X86\\3\\E_S4I2R1.EXE /P30 \"\\\\JOHN\\EPSON Stylus C86 Series\" /O6 \"USB001\" /M \"Stylus C86\"" Completion time: 2007-08-06 21:32:55 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-06 21:32 --- E O F --- anything else i need to have her do? thanks for your help :]
Open notepad and copy/paste the text in the quotebox below into it: Save this as CFScript. (Check the spelling) Refering to the picture above, drag CFScript.txt into ComboFix.exe When finished, it shall produce a log for you, C:\ComboFix.txt. Post that log in your next reply.
