Trouble removing Trojan.FakeAlert - Free Antivirus Forum

Trouble removing Trojan.FakeAlert

BullGuard Antivirus Forum > Virus Removal > Removal Help > Trouble removing Trojan.FakeAlert

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

Phil86
New Member

Date Joined Aug 2008
Total Posts : 8

Posted 8-27-2008 12:09 (GMT +1)

Hello,

Two days ago my computer was infected with a trojan, I immedialy carried out a virus scan scan and Bullguard detected two viruses named phcag1j0enae.bmp and bphcag1j0enae.scr. Since then i have been trying to remove these trojans with no success. When I turned on my computer the next day my desktop background had been changed to white screen with an imitation windows vista box, and a pop up called 'Antivirus XP 2008'. After reading about others with the same problems I downloaded MalwareBytes, SuperAntispyware, Combofix and HijackThis but so far none have been able to remove the trojans.

Below are the logs from SuperAntispyware, HiJackThis and Combofix respectively.

I hope that you can help me to remove these problems as quickly as possible.

Thank you very much.

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 08/26/2008 at 11:39 PM

Application Version : 4.20.1046

Core Rules Database Version : 3548
Trace Rules Database Version: 1536

Scan type : Complete Scan
Total Scan Time : 00:32:21

Memory items scanned      : 593
Memory threats detected   : 1
Registry items scanned    : 7224
Registry threats detected : 6
File items scanned        : 24600
File threats detected     : 8

Trojan.Dropper/Gen
C:\WINDOWS\SYSTEM32\PGRENQPC.EXE
C:\WINDOWS\SYSTEM32\PGRENQPC.EXE
[smartsyssrv] C:\WINDOWS\SYSTEM32\PGRENQPC.EXE
[WebStr] C:\WINDOWS\SYSTEM32\WVKTQFGX.EXE
C:\WINDOWS\SYSTEM32\WVKTQFGX.EXE
[MonUtilStr] C:\WINDOWS\SYSTEM32\PEPUXITS.EXE
C:\WINDOWS\SYSTEM32\PEPUXITS.EXE
[ActCfg] C:\WINDOWS\SYSTEM32\AVSRENSB.EXE
C:\WINDOWS\SYSTEM32\AVSRENSB.EXE
[MntDbDsc] C:\WINDOWS\SYSTEM32\GNMDUNQT.EXE
C:\WINDOWS\SYSTEM32\GNMDUNQT.EXE
[UiActCmd] C:\WINDOWS\SYSTEM32\QNAVWFEB.EXE
C:\WINDOWS\SYSTEM32\QNAVWFEB.EXE

Rogue.AntiVirus 2008
C:\WINDOWS\SYSTEM32\PHCAG1J0ENAE.BMP

NotHarmful.Sysinternals Bluescreen Screen Saver
C:\WINDOWS\SYSTEM32\BLPHCAG1J0ENAE.SCR

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:07:51, on 27/08/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Creative\Shared Files\CTAudSvc.exe
C:\Program Files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\dllhost.exe
C:\Documents and Settings\All Users\Application Data\rclgpmbi\bgrkdwpu.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe
C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\CyberLink\PowerCinema\PCMService.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\WINDOWS\system32\cpclkriv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\vqxgtmle.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
c:\program files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\svchost.exe
C:\HJT\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [VolPanel] "C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" /r
O4 - HKLM\..\Run: [AudioDrvEmulator] "C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "C:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\CyberLink\PowerCinema\PCMService.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lphcag1j0enae] C:\WINDOWS\system32\lphcag1j0enae.exe
O4 - HKLM\..\Run: [inrhceg1j0enae] C:\Documents and Settings\Phil\Local Settings\temp\.tt8.tmp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [mntapp] C:\WINDOWS\system32\cpclkriv.exe
O4 - HKCU\..\Run: [uicfg] C:\WINDOWS\system32\lmhezyzq.exe
O4 - HKLM\..\Policies\Explorer\Run: [l40mWh0AQy] C:\Documents and Settings\All Users\Application Data\rclgpmbi\bgrkdwpu.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O14 - IERESET.INF: START_PAGE_URL=http://www.meshcomputers.com
O16 - DPF: {4F5E4276-C120-11D6-A1FD-00508B9D48EA} (dldisplay Class) - http://www.gamehouse.com/ghdlctl.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161947083750
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su2/CTL_V02002/ocx/15033/CTPID.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O21 - SSODL: ChkShCom - {70C2B6EE-7439-0217-1873-0B913CEAD49A} - C:\Program Files\upgtdnd\ChkShCom.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Backbone Service (BBDemon) - Dassault Systemes - C:\Program Files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: CyberLink Media Library Service - Cyberlink - C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe

--
End of file - 10418 bytes

ComboFix 08-08-25.01 - Phil 2008-08-26 23:57:28.6 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.505 [GMT 1:00]
Running from: C:\Documents and Settings\Phil\My Documents\Programs\ComboFix.exe
* Resident AV is active

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\blphcag1j0enae.scr
C:\WINDOWS\system32\lphcag1j0enae.exe
C:\WINDOWS\system32\phcag1j0enae.bmp

.
((((((((((((((((((((((((( Files Created from 2008-07-26 to 2008-08-26 )))))))))))))))))))))))))))))))
.

2019-03-07 18:56 . 2004-08-10 20:00 13,107,200 --a------ C:\WINDOWS\system32\oembios.bin
2019-03-07 18:54 . 2019-03-07 18:56 <DIR> d-------- C:\i386
2019-03-07 18:53 . 2019-03-07 18:53 <DIR> d-------- C:\cmpnents
2008-08-26 23:41 . 2008-08-26 23:41 203,776 --a------ C:\WINDOWS\system32\ifglstoj.exe
2008-08-26 23:41 . 2008-08-26 23:41 86,016 --a------ C:\WINDOWS\system32\cpclkriv.exe
2008-08-26 17:42 . 2008-08-26 17:42 203,776 --a------ C:\WINDOWS\system32\heravgfm.exe
2008-08-26 16:38 . 2008-08-26 19:01 <DIR> d-------- C:\HJT
2008-08-26 16:14 . 2008-08-26 16:14 203,776 --a------ C:\WINDOWS\system32\wvqnupmd.exe
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-08-26 15:03 . 2008-08-26 15:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-26 15:03 . 2008-08-26 15:58 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-26 15:03 . 2008-08-26 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-26 13:36 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 13:36 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-26 11:48 . 2008-08-26 22:57 353 --a------ C:\WINDOWS\wininit.ini
2008-08-25 22:04 . 2008-08-25 22:04 <DIR> d-------- C:\Program Files\Reality Pump
2008-08-25 20:54 . 2008-08-25 20:54 <DIR> d-------- C:\Program Files\upgtdnd
2008-08-25 20:54 . 2008-08-25 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\rclgpmbi
2008-08-21 11:43 . 2008-08-21 23:31 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-21 11:43 . 2008-08-21 23:31 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-21 11:43 . 2008-08-21 23:31 <DIR> d-------- C:\WINDOWS\system32\bits
2008-08-21 11:43 . 2008-08-21 23:27 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-21 11:39 . 2008-08-21 23:44 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-08-21 11:28 . 2007-10-26 04:34 8,460,288 --a------ C:\WINDOWS\system32\dllcache\shell32.dll
2008-08-21 11:27 . 2007-02-28 10:08 2,136,064 --a------ C:\WINDOWS\system32\ntoskrnl.exe
2008-08-20 14:05 . 2008-04-14 01:12 727,040 --a------ C:\WINDOWS\system32\SET7BD.tmp
2008-08-20 14:04 . 2008-04-14 01:12 8,461,312 --a------ C:\WINDOWS\system32\SET819.tmp
2008-08-20 14:03 . 2008-04-14 01:11 1,082,368 --a------ C:\WINDOWS\system32\SET9A5.tmp
2008-08-20 14:02 . 2008-04-14 01:11 1,267,200 --a------ C:\WINDOWS\system32\SETA13.tmp
2008-08-20 13:28 . 2008-08-22 11:08 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-16 20:09 . 2008-08-16 20:31 <DIR> d-------- C:\Program Files\Mafia
2008-08-16 20:09 . 2002-08-08 00:13 319,488 -ra------ C:\WINDOWS\system32\MafiaSetup.exe
2008-08-09 14:01 . 2008-08-09 15:43 <DIR> d-------- C:\Documents and Settings\Phil\.gimp-2.4
2008-08-08 13:08 . 2008-08-09 15:43 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\gtk-2.0
2008-08-08 13:08 . 2008-08-08 13:08 <DIR> d-------- C:\Documents and Settings\Phil\.thumbnails
2008-08-08 12:40 . 2008-08-09 14:00 <DIR> d-------- C:\Program Files\GIMP-2.0
2008-08-04 16:41 . 2008-08-04 16:41 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\InstallShield
2008-07-31 22:39 . 2008-08-04 16:45 <DIR> d-------- C:\Program Files\THQ
2008-07-31 03:42 . 2008-07-31 03:42 <DIR> d-------- C:\Program Files\Maxis
2008-07-31 03:35 . 2008-07-31 03:36 <DIR> d-------- C:\Program Files\MagicDisc
2008-07-31 03:35 . 2008-07-28 17:19 116,736 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2008-07-31 03:32 . 2008-07-31 03:35 <DIR> d-------- C:\Program Files\MagicISO
2008-07-30 16:25 . 2008-07-30 16:25 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Nokia Multimedia Player
2008-07-30 16:24 . 2008-07-30 16:25 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Nokia
2008-07-30 16:24 . 2008-07-30 16:24 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Datalayer
2008-07-30 16:23 . 2008-07-30 21:19 <DIR> d-------- C:\Documents and Settings\Phil\Phone Browser
2008-07-30 16:20 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\DIFX
2008-07-30 16:20 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-07-30 16:19 . 2008-07-30 16:23 <DIR> d-------- C:\Program Files\Nokia
2008-07-30 16:19 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-07-30 16:19 . 2008-07-30 16:20 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\PC Suite
2008-07-30 16:19 . 2008-07-30 16:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-07-30 16:19 . 2006-05-29 08:26 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-07-30 16:19 . 2006-05-29 08:26 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-07-30 16:19 . 2006-05-29 08:26 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-07-30 16:19 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-07-30 16:19 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-07-30 16:19 . 2006-05-29 08:26 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-07-30 16:19 . 2006-05-29 08:26 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll
2008-07-30 16:18 . 2008-07-30 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-26 22:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\BullGuard
2008-08-26 21:48 --------- d-----w C:\Documents and Settings\Phil\Application Data\Azureus
2008-08-26 01:00 --------- d-----w C:\Program Files\complete
2008-08-25 23:50 --------- d-----w C:\Documents and Settings\Phil\Application Data\BullGuard
2008-08-25 22:30 --------- d-----w C:\Program Files\Disk 2
2008-08-25 18:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-21 22:52 --------- d-----w C:\Program Files\Creative
2008-08-16 10:13 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-08-14 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-10 21:39 --------- d-----w C:\Program Files\Sony
2008-08-10 21:39 --------- d-----w C:\Program Files\Common Files\Sony Shared
2008-07-02 11:56 --------- d-----w C:\Program Files\Azureus
2008-07-01 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
.

((((((((((((((((((((((((((((( snapshot@2008-08-26_19.00.03.82 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-26 17:55:54 222,393 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-08-26 23:01:37 222,392 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-08-26 23:02:15 86,016 ----a-w C:\WINDOWS\system32\lmhezyzq.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-23 05:17 67128]
"BullGuard"="C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" [2007-12-23 03:39 102400]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"mntapp"="C:\WINDOWS\system32\cpclkriv.exe" [2008-08-26 23:41 86016]
"uicfg"="C:\WINDOWS\system32\lmhezyzq.exe" [2008-08-27 00:02 86016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2006-08-14 14:39 98304]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2006-08-14 14:41 114688]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2006-08-14 14:38 94208]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2008-05-02 22:46 13529088]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 15:11 122880]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2008-05-02 22:46 86016]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe" [2005-08-26 19:14 36975]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-02 10:10 98304]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-01-14 19:21 110744]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-10-28 18:41 185896]
"lphcag1j0enae"="C:\WINDOWS\system32\lphcag1j0enae.exe" [2008-08-27 00:02 203776]
"inrhceg1j0enae"="C:\Documents and Settings\Phil\Local Settings\temp\.tt8.tmp.exe" [2008-08-27 00:02 1613605]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 C:\WINDOWS\system32\ptipbmf.dll]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]
"nwiz"="nwiz.exe" [2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2008-02-20 20:58 19456 C:\WINDOWS\system32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-02-20 20:58 19968 C:\WINDOWS\system32\Ctxfihlp.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"l40mWh0AQy"="C:\Documents and Settings\All Users\Application Data\rclgpmbi\bgrkdwpu.exe" [2008-08-25 20:54 57344]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-23 05:17:35 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-01-01 17:38:41 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)
"NoDispScrSavPage"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ChkShCom"= {70C2B6EE-7439-0217-1873-0B913CEAD49A} - C:\Program Files\upgtdnd\ChkShCom.dll [2008-08-25 20:54 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\Phil\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Phil\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 C:\PROGRA~1\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-10-28 18:41 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 21:05 204288 C:\Program Files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}]
--a------ 2004-06-08 19:33 69721 C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\generals.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\generals.exe"=
"C:\\Program Files\\Dassault Systemes\\B16\\intel_a\\code\\bin\\CNEXT.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\patchget.dat"=
"C:\\Documents and Settings\\Phil\\My Documents\\My Games\\[PC GAME] Worms Armageddon + All weapons unblocked + cracked + xp patch by Lupen[FUMAI]\\wormsarm\\WA.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 14:22]
R2 BBDemon;Backbone Service;C:\Program Files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe [2005-09-06 23:11]
R2 CTAudSvcService;Creative Audio Service;C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 19:24]
R3 FileSpy5;BullGuard File Monitor;C:\Program Files\BullGuard Software\BullGuard\filespy5.sys [2007-12-23 03:39]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2008-02-25 09:44]
R3 Reconn;BullGuard Email Monitor;C:\Program Files\BullGuard Software\BullGuard\reconn.sys [2007-12-23 03:39]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2006-06-16 08:30]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-07-28 20:28]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\PROGRA~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS []
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S4 m5287;m5287;C:\WINDOWS\system32\DRIVERS\m5287.sys [2005-02-05 08:00]
S4 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 11:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bg5 REG_MULTI_SZ BGMainSvc BsFileSpy BsMailProxy BsFirewall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74127d8c-d92c-11db-89fa-0018e7046c1b}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Toy.exe
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Local Page = \blank.htm
R0 -: HKCU-Main,Start Page = hxxp://www.google.co.uk/
R1 -: HKCU-Internet Settings,ProxyOverride = localhost
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O18 -: Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-27 00:01:53
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\WINDOWS\system32\lphcag1j0enae.exe 203776 bytes executable
C:\WINDOWS\system32\phcag1j0enae.bmp 625208 bytes
C:\WINDOWS\system32\lmhezyzq.exe 86016 bytes executable
C:\WINDOWS\system32\blphcag1j0enae.scr 118784 bytes executable

scan completed successfully
hidden files: 4

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLCapSvc.exe
C:\Program Files\CyberLink\PowerCinema\Kernel\TV\CLSched.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLServer.exe
C:\Program Files\CyberLink\Shared Files\CLML_NTService\CLMLService.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\CTxfispi.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\PROGRA~1\COMMON~1\PCSuite\DataLayer\DataLayer.exe
C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
C:\WINDOWS\system32\lphcag1j0enae.exepplication Data\PC Suite
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-27 0:06:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-26 23:06:15
ComboFix2.txt 2008-08-26 22:00:18
ComboFix3.txt 2008-08-26 18:12:27
ComboFix4.txt 2008-08-26 18:00:31
ComboFix5.txt 2008-08-26 22:57:15

Pre-Run: 119,871,971,328 bytes free
Post-Run: 119,880,962,048 bytes free

309 --- E O F --- 2008-08-22 10:13:12

dziguru
New Member

Date Joined Aug 2008
Total Posts : 6

Posted 8-27-2008 9:13 (GMT +1)

Hi,

i had a same ANTIVIRUS xp - 2008 !!!! and bunch of trojans..
Some of them called Trojan.FakeAlert..

I removed trojan very elegant with Antivirus program NOD32:
http://www.nod32.com.hr/

Good luck!

Phil86
New Member

Date Joined Aug 2008
Total Posts : 8

Posted 8-28-2008 11:59 (GMT +1)

Thanks for the input Dziguru, unfortunately it hasn't worked for me

dziguru
New Member

Date Joined Aug 2008
Total Posts : 6

Posted 8-28-2008 2:02 (GMT +1)

oh?
!!!!..
sorry, it worked in my case..
hm..i'm not an expert in virus removal, so don't know what else to tell you except what programs did i ran..

Little !!!!!!!s were:
Smithfraud-C.gp
SmithfraudC.gp -Win32/Bagle.gen.zip worm
Fake.Alert.HC trojan
Fake.Alert.GS trojan
Adware.XP.Antivirus application
some malware with name smth like: Antivirus-xp 2008
Kritptik.E trojan
Hijack
Win32 Trojans
some spyware i don't remember name right now
and there was at the end some Trojan that was recognized by ComboFix as a Rootkit (with name Trojan.Agent - tdssserv)

and the programs were:
Spybot S&D
NOD32
Superantispyware
Dr. Web Cureit
ComboFix
Malwarebytes' Anti-Malware
..
and for cleaning i used ATF Cleaner, and Ccleaner

I ran them in many variations,
e.g. to kill Smithfraud.C i used Spybot, and somehow Smithfraud attached on Spybot, and i killed him very easy with NOD32 which find him in Spybot S&D..

Maybe try with Malwarebytes' Anti-Malware, i killed yesterday with that Trojan.Agent and some Hijack..

i think i kill them all..but you never know with them..so i'm waitig for admins to reply on my topic:
http://www.bullguard.com/forum/10/ROOTKIT-PROBLEM-HELP-PLEASE_65351.html

Cheers

http://www.myspace.com/protestefekt

Phil86
New Member

Date Joined Aug 2008
Total Posts : 8

Posted 8-29-2008 11:35 (GMT +1)

Thanks, I already have many programs that seem to get rid of the problems initially. However the main problem is the fact that as soon as my computer is reset with the internet running, the files are straight back onto my computer causing havoc and I cant find a reason for this.

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 14325

Posted 8-29-2008 12:09 (GMT +1)

Phil86 - > I´ll suggest you post fresh combofix log

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Phil86
New Member

Date Joined Aug 2008
Total Posts : 8

Posted 8-29-2008 12:20 (GMT +1)

ComboFix 08-08-25.01 - Phil 2008-08-29 12:41:05.9 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.506 [GMT 1:00]
Running from: C:\Documents and Settings\Phil\My Documents\Programs\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_004809_.tmp.dll
C:\WINDOWS\system32\_004810_.tmp.dll
C:\WINDOWS\system32\_004811_.tmp.dll
C:\WINDOWS\system32\_004812_.tmp.dll
C:\WINDOWS\system32\_004819_.tmp.dll
C:\WINDOWS\system32\_004820_.tmp.dll
C:\WINDOWS\system32\_004821_.tmp.dll
C:\WINDOWS\system32\_004823_.tmp.dll
C:\WINDOWS\system32\_004824_.tmp.dll
C:\WINDOWS\system32\_004827_.tmp.dll
C:\WINDOWS\system32\_004828_.tmp.dll
C:\WINDOWS\system32\_004830_.tmp.dll
C:\WINDOWS\system32\_004831_.tmp.dll
C:\WINDOWS\system32\_004832_.tmp.dll
C:\WINDOWS\system32\_004834_.tmp.dll
C:\WINDOWS\system32\_004837_.tmp.dll
C:\WINDOWS\system32\_004838_.tmp.dll
C:\WINDOWS\system32\_004842_.tmp.dll
C:\WINDOWS\system32\_004843_.tmp.dll
C:\WINDOWS\system32\_004845_.tmp.dll
C:\WINDOWS\system32\_004847_.tmp.dll
C:\WINDOWS\system32\_004848_.tmp.dll
C:\WINDOWS\system32\_004850_.tmp.dll
C:\WINDOWS\system32\_004851_.tmp.dll
C:\WINDOWS\system32\_004852_.tmp.dll
C:\WINDOWS\system32\_004853_.tmp.dll
C:\WINDOWS\system32\_004856_.tmp.dll
C:\WINDOWS\system32\_004857_.tmp.dll
C:\WINDOWS\system32\_004858_.tmp.dll
C:\WINDOWS\system32\_004859_.tmp.dll
C:\WINDOWS\system32\_004860_.tmp.dll
C:\WINDOWS\system32\_004865_.tmp.dll
C:\WINDOWS\system32\_004867_.tmp.dll
C:\WINDOWS\system32\blphcag1j0enae.scr
C:\WINDOWS\system32\lphcag1j0enae.exe
C:\WINDOWS\system32\phcag1j0enae.bmp

.
((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-29 )))))))))))))))))))))))))))))))
.

2019-03-07 18:56 . 2004-08-10 20:00 13,107,200 --a------ C:\WINDOWS\system32\oembios.bin
2019-03-07 18:54 . 2019-03-07 18:56 <DIR> d-------- C:\i386
2019-03-07 18:53 . 2019-03-07 18:53 <DIR> d-------- C:\cmpnents
2008-08-29 02:48 . 2008-08-29 02:48 98,304 --a------ C:\WINDOWS\system32\xcbqluhs.exe
2008-08-28 23:23 . 2008-08-28 23:23 203,776 --a------ C:\WINDOWS\system32\gzelgrab.exe
2008-08-28 21:08 . 2008-08-28 23:35 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-28 21:08 . 2008-08-29 12:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-28 18:22 . 2008-08-28 18:22 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\PC Suite
2008-08-28 01:09 . 2004-08-10 20:00 4,256,768 --a------ C:\WINDOWS\system32\dllcache\wmm2res.dll
2008-08-28 01:08 . 2007-10-26 04:34 8,460,288 --a------ C:\WINDOWS\system32\dllcache\shell32.dll
2008-08-27 22:30 . 2008-08-27 22:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-08-27 19:44 . 2008-08-27 19:52 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-27 17:47 . 2008-08-27 17:47 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2008-08-26 16:38 . 2008-08-28 19:11 <DIR> d-------- C:\HJT
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\SUPERAntiSpyware.com
2008-08-26 15:58 . 2008-08-26 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-08-26 15:03 . 2008-08-26 15:03 <DIR> d-------- C:\Program Files\Lavasoft
2008-08-26 15:03 . 2008-08-26 15:58 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-26 15:03 . 2008-08-26 15:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Malwarebytes
2008-08-26 13:36 . 2008-08-26 13:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-26 13:36 . 2008-08-17 15:01 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-26 13:36 . 2008-08-17 15:01 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-26 11:48 . 2008-08-28 18:23 581 --a------ C:\WINDOWS\wininit.ini
2008-08-25 22:04 . 2008-08-25 22:04 <DIR> d-------- C:\Program Files\Reality Pump
2008-08-25 20:54 . 2008-08-25 20:54 <DIR> d-------- C:\Program Files\upgtdnd
2008-08-25 20:54 . 2008-08-25 20:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\rclgpmbi
2008-08-21 11:43 . 2008-08-28 01:53 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-21 11:43 . 2008-08-28 01:53 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-21 11:43 . 2008-08-28 01:53 <DIR> d-------- C:\WINDOWS\system32\bits
2008-08-21 11:43 . 2008-08-28 01:50 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-21 11:39 . 2008-08-28 02:06 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-08-21 11:28 . 2004-08-10 20:00 71,040 --------- C:\WINDOWS\system32\drivers\_004787_.tmp.dll
2008-08-20 14:04 . 2008-04-14 01:12 8,461,312 --a------ C:\WINDOWS\system32\SET819.tmp
2008-08-20 14:03 . 2008-04-14 01:11 1,082,368 --a------ C:\WINDOWS\system32\SET9A5.tmp
2008-08-20 14:02 . 2008-04-14 01:11 1,267,200 --a------ C:\WINDOWS\system32\SETA13.tmp
2008-08-20 13:28 . 2008-08-28 01:38 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-16 20:09 . 2002-08-08 00:13 319,488 -ra------ C:\WINDOWS\system32\MafiaSetup.exe
2008-08-09 14:01 . 2008-08-09 15:43 <DIR> d-------- C:\Documents and Settings\Phil\.gimp-2.4
2008-08-08 13:08 . 2008-08-09 15:43 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\gtk-2.0
2008-08-08 13:08 . 2008-08-08 13:08 <DIR> d-------- C:\Documents and Settings\Phil\.thumbnails
2008-08-08 12:40 . 2008-08-09 14:00 <DIR> d-------- C:\Program Files\GIMP-2.0
2008-08-04 16:41 . 2008-08-04 16:41 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\InstallShield
2008-07-31 22:39 . 2008-08-04 16:45 <DIR> d-------- C:\Program Files\THQ
2008-07-31 03:42 . 2008-07-31 03:42 <DIR> d-------- C:\Program Files\Maxis
2008-07-31 03:35 . 2008-07-31 03:36 <DIR> d-------- C:\Program Files\MagicDisc
2008-07-31 03:35 . 2008-07-28 17:19 116,736 --a------ C:\WINDOWS\system32\drivers\mcdbus.sys
2008-07-31 03:32 . 2008-07-31 03:35 <DIR> d-------- C:\Program Files\MagicISO
2008-07-30 16:25 . 2008-07-30 16:25 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Nokia Multimedia Player
2008-07-30 16:24 . 2008-07-30 16:25 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Nokia
2008-07-30 16:24 . 2008-07-30 16:24 <DIR> d-------- C:\Documents and Settings\Phil\Application Data\Datalayer
2008-07-30 16:23 . 2008-07-30 21:19 <DIR> d-------- C:\Documents and Settings\Phil\Phone Browser
2008-07-30 16:20 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\DIFX
2008-07-30 16:20 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\Common Files\Nokia
2008-07-30 16:19 . 2008-07-30 16:23 <DIR> d-------- C:\Program Files\Nokia
2008-07-30 16:19 . 2008-07-30 16:20 <DIR> d-------- C:\Program Files\Common Files\PCSuite
2008-07-30 16:19 . 2008-07-30 16:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-07-30 16:19 . 2006-05-29 08:26 127,488 --a------ C:\WINDOWS\system32\drivers\nmwcd.sys
2008-07-30 16:19 . 2006-05-29 08:26 50,688 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-07-30 16:19 . 2006-05-29 08:26 30,720 --a------ C:\WINDOWS\system32\nmwcdcocls.dll
2008-07-30 16:19 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcm.sys
2008-07-30 16:19 . 2006-05-29 08:26 13,312 --a------ C:\WINDOWS\system32\drivers\nmwcdcj.sys
2008-07-30 16:19 . 2006-05-29 08:26 8,704 --a------ C:\WINDOWS\system32\drivers\nmwcdc.sys
2008-07-30 16:19 . 2006-05-29 08:26 4,608 --a------ C:\WINDOWS\system32\nmwcdlog.dll
2008-07-30 16:18 . 2008-07-30 16:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Downloaded Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-28 22:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\BullGuard
2008-08-28 14:43 --------- d-----w C:\Documents and Settings\Phil\Application Data\BullGuard
2008-08-27 16:14 --------- d-----w C:\Documents and Settings\Phil\Application Data\Azureus
2008-08-26 01:00 --------- d-----w C:\Program Files\complete
2008-08-25 22:30 --------- d-----w C:\Program Files\Disk 2
2008-08-25 18:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-21 22:52 --------- d-----w C:\Program Files\Creative
2008-08-21 17:24 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-16 10:13 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-08-14 19:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-10 21:39 --------- d-----w C:\Program Files\Sony
2008-08-10 21:39 --------- d-----w C:\Program Files\Common Files\Sony Shared
2008-08-10 21:37 118,784 ----a-w C:\WINDOWS\Web\Wallpaper\Stately Waterfall Wallpaper.exe
2008-07-18 21:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 21:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 21:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 21:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 21:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 21:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 21:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 21:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 21:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 21:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\dllcache\es.dll
2008-07-02 11:56 --------- d-----w C:\Program Files\Azureus
2008-07-01 12:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\Creative
2008-06-27 11:23 118,784 ----a-w C:\WINDOWS\Web\Wallpaper\Stately Waterfall Wallpaper dir\uninstall.exe
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-23 01:58 413,696 ----a-w C:\WINDOWS\system32\wrap_oal.dll
2008-06-23 01:58 110,592 ----a-w C:\WINDOWS\system32\OpenAL32.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-13 13:10 272,128 ----a-w C:\WINDOWS\system32\dllcache\bthport.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-27_19.30.00.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-21 22:41:20 8,704 ----a-w C:\WINDOWS\assembly\GAC\Accessibility\1.0.3300.0__b03f5f7f11d50a3a\Accessibility.dll
+ 2008-08-28 01:03:08 8,704 ----a-w C:\WINDOWS\assembly\GAC\Accessibility\1.0.3300.0__b03f5f7f11d50a3a\Accessibility.dll
- 2008-08-21 22:49:26 117,248 ----a-w C:\WINDOWS\assembly\GAC\BDATunePIA\6.0.3000.0__31bf3856ad364e35\bdatunepia.dll
+ 2008-08-28 01:10:55 117,248 ----a-w C:\WINDOWS\assembly\GAC\BDATunePIA\6.0.3000.0__31bf3856ad364e35\bdatunepia.dll
- 2008-08-21 22:41:17 12,288 ----a-w C:\WINDOWS\assembly\GAC\cscompmgd\7.0.3300.0__b03f5f7f11d50a3a\cscompmgd.dll
+ 2008-08-28 01:03:04 12,288 ----a-w C:\WINDOWS\assembly\GAC\cscompmgd\7.0.3300.0__b03f5f7f11d50a3a\cscompmgd.dll
- 2008-08-21 22:41:19 34,816 ----a-w C:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.3300.0__b03f5f7f11d50a3a\CustomMarshalers.dll
+ 2008-08-28 01:03:07 34,816 ----a-w C:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.3300.0__b03f5f7f11d50a3a\CustomMarshalers.dll
- 2008-08-21 22:49:25 102,400 ----a-w C:\WINDOWS\assembly\GAC\ehCIR\6.0.3000.0__31bf3856ad364e35\ehCIR.dll
+ 2008-08-28 01:10:55 102,400 ----a-w C:\WINDOWS\assembly\GAC\ehCIR\6.0.3000.0__31bf3856ad364e35\ehCIR.dll
- 2008-08-21 22:49:26 1,863,680 ----a-w C:\WINDOWS\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\EhCM.dll
+ 2008-08-28 01:10:55 1,863,680 ----a-w C:\WINDOWS\assembly\GAC\EhCM\6.0.3000.0__31bf3856ad364e35\EhCM.dll
- 2008-08-21 22:49:26 192,512 ----a-w C:\WINDOWS\assembly\GAC\ehcommon\6.0.3000.0__31bf3856ad364e35\ehcommon.dll
+ 2008-08-28 01:10:55 192,512 ----a-w C:\WINDOWS\assembly\GAC\ehcommon\6.0.3000.0__31bf3856ad364e35\ehcommon.dll
- 2008-08-21 22:49:26 868,352 ----a-w C:\WINDOWS\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
+ 2008-08-28 01:10:55 868,352 ----a-w C:\WINDOWS\assembly\GAC\ehepg\6.0.3000.0__31bf3856ad364e35\ehepg.dll
- 2008-08-21 22:49:25 126,976 ----a-w C:\WINDOWS\assembly\GAC\ehepgdat\6.0.3000.0__31bf3856ad364e35\ehepgdat.dll
+ 2008-08-28 01:10:55 126,976 ----a-w C:\WINDOWS\assembly\GAC\ehepgdat\6.0.3000.0__31bf3856ad364e35\ehepgdat.dll
- 2008-08-21 22:49:26 110,592 ----a-w C:\WINDOWS\assembly\GAC\ehExtCOM\6.0.3000.0__31bf3856ad364e35\ehExtCOM.dll
+ 2008-08-28 01:10:55 110,592 ----a-w C:\WINDOWS\assembly\GAC\ehExtCOM\6.0.3000.0__31bf3856ad364e35\ehExtCOM.dll
- 2008-08-21 22:49:25 8,192 ----a-w C:\WINDOWS\assembly\GAC\ehiExtCOM\6.0.3000.0__31bf3856ad364e35\ehiExtCOM.dll
+ 2008-08-28 01:10:55 8,192 ----a-w C:\WINDOWS\assembly\GAC\ehiExtCOM\6.0.3000.0__31bf3856ad364e35\ehiExtCOM.dll
- 2008-08-21 22:49:25 73,728 ----a-w C:\WINDOWS\assembly\GAC\ehiExtens\6.0.3000.0__31bf3856ad364e35\ehiExtens.dll
+ 2008-08-28 01:10:55 73,728 ----a-w C:\WINDOWS\assembly\GAC\ehiExtens\6.0.3000.0__31bf3856ad364e35\ehiExtens.dll
- 2008-08-21 22:49:26 167,936 ----a-w C:\WINDOWS\assembly\GAC\ehiMsgr\6.0.3000.0__31bf3856ad364e35\ehiMsgr.dll
+ 2008-08-28 01:10:55 167,936 ----a-w C:\WINDOWS\assembly\GAC\ehiMsgr\6.0.3000.0__31bf3856ad364e35\ehiMsgr.dll
- 2008-08-21 22:49:25 204,800 ----a-w C:\WINDOWS\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiPlay.dll
+ 2008-08-28 01:10:55 204,800 ----a-w C:\WINDOWS\assembly\GAC\ehiPlay\6.0.3000.0__31bf3856ad364e35\ehiPlay.dll
- 2008-08-21 22:49:25 389,120 ----a-w C:\WINDOWS\assembly\GAC\ehiProxy\6.0.3000.0__31bf3856ad364e35\ehiProxy.dll
+ 2008-08-28 01:10:55 389,120 ----a-w C:\WINDOWS\assembly\GAC\ehiProxy\6.0.3000.0__31bf3856ad364e35\ehiProxy.dll
- 2008-08-21 22:49:25 18,944 ----a-w C:\WINDOWS\assembly\GAC\ehiUserXp\6.0.3000.0__31bf3856ad364e35\ehiuserxp.dll
+ 2008-08-28 01:10:55 18,944 ----a-w C:\WINDOWS\assembly\GAC\ehiUserXp\6.0.3000.0__31bf3856ad364e35\ehiuserxp.dll
- 2008-08-21 22:49:26 278,528 ----a-w C:\WINDOWS\assembly\GAC\ehiVidCtl\6.0.3000.0__31bf3856ad364e35\ehiVidCtl.dll
+ 2008-08-28 01:10:55 278,528 ----a-w C:\WINDOWS\assembly\GAC\ehiVidCtl\6.0.3000.0__31bf3856ad364e35\ehiVidCtl.dll
- 2008-08-21 22:49:25 122,880 ----a-w C:\WINDOWS\assembly\GAC\ehiwmp\6.0.3000.0__31bf3856ad364e35\ehiwmp.dll
+ 2008-08-28 01:10:55 122,880 ----a-w C:\WINDOWS\assembly\GAC\ehiwmp\6.0.3000.0__31bf3856ad364e35\ehiwmp.dll
- 2008-08-21 22:49:26 53,248 ----a-w C:\WINDOWS\assembly\GAC\ehiWUapi\6.0.3000.0__31bf3856ad364e35\ehiWUapi.dll
+ 2008-08-28 01:10:55 53,248 ----a-w C:\WINDOWS\assembly\GAC\ehiWUapi\6.0.3000.0__31bf3856ad364e35\ehiWUapi.dll
- 2008-08-21 22:49:25 389,120 ----a-w C:\WINDOWS\assembly\GAC\ehRecObj\6.0.3000.0__31bf3856ad364e35\ehRecObj.dll
+ 2008-08-28 01:10:55 389,120 ----a-w C:\WINDOWS\assembly\GAC\ehRecObj\6.0.3000.0__31bf3856ad364e35\ehRecObj.dll
- 2008-08-21 22:41:26 7,168 ----a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.3300.0__b03f5f7f11d50a3a\IEExecRemote.dll
+ 2008-08-28 01:03:16 7,168 ----a-w C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.3300.0__b03f5f7f11d50a3a\IEExecRemote.dll
- 2008-08-21 22:41:26 32,768 ----a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.3300.0__b03f5f7f11d50a3a\IEHost.dll
+ 2008-08-28 01:03:17 32,768 ----a-w C:\WINDOWS\assembly\GAC\IEHost\1.0.3300.0__b03f5f7f11d50a3a\IEHost.dll
- 2008-08-21 22:41:27 4,096 ----a-w C:\WINDOWS\assembly\GAC\IIEHost\1.0.3300.0__b03f5f7f11d50a3a\IIEHost.dll
+ 2008-08-28 01:03:17 4,096 ----a-w C:\WINDOWS\assembly\GAC\IIEHost\1.0.3300.0__b03f5f7f11d50a3a\IIEHost.dll
- 2008-08-21 22:41:27 27,136 ----a-w C:\WINDOWS\assembly\GAC\ISymWrapper\1.0.3300.0__b03f5f7f11d50a3a\ISymWrapper.dll
+ 2008-08-28 01:03:18 27,136 ----a-w C:\WINDOWS\assembly\GAC\ISymWrapper\1.0.3300.0__b03f5f7f11d50a3a\ISymWrapper.dll
- 2008-08-21 22:41:17 712,704 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
+ 2008-08-28 01:03:05 712,704 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.JScript.dll
- 2008-08-21 22:49:26 45,056 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.MediaCenter\6.0.3100.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
+ 2008-08-28 01:10:55 45,056 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.MediaCenter\6.0.3100.0__31bf3856ad364e35\Microsoft.MediaCenter.dll
- 2008-08-21 22:41:16 28,672 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
+ 2008-08-28 01:03:04 28,672 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll
- 2008-08-21 22:41:18 286,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
+ 2008-08-28 01:03:05 286,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll
- 2008-08-21 22:41:18 5,632 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
+ 2008-08-28 01:03:05 5,632 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll
- 2008-08-21 22:41:15 11,264 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
+ 2008-08-28 01:03:03 11,264 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll
- 2008-08-21 22:41:16 18,944 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
+ 2008-08-28 01:03:03 18,944 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll
- 2008-08-21 22:41:15 6,656 ----a-w C:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.3300.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
+ 2008-08-28 01:03:03 6,656 ----a-w C:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.3300.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll
- 2008-08-21 22:41:28 1,564,672 ----a-w C:\WINDOWS\assembly\GAC\mscorcfg\1.0.3300.0__b03f5f7f11d50a3a\mscorcfg.dll
+ 2008-08-28 01:03:18 1,564,672 ----a-w C:\WINDOWS\assembly\GAC\mscorcfg\1.0.3300.0__b03f5f7f11d50a3a\mscorcfg.dll
- 2008-08-21 22:41:18 32,768 ----a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.3300.0__b03f5f7f11d50a3a\RegCode.dll
+ 2008-08-28 01:03:06 32,768 ----a-w C:\WINDOWS\assembly\GAC\Regcode\1.0.3300.0__b03f5f7f11d50a3a\RegCode.dll
- 2008-08-21 22:49:26 77,824 ----a-w C:\WINDOWS\assembly\GAC\SonicMCEBurnEngine\0.9.0.0__17c52700e9a64fd0\SonicMCEBurnEngine.dll
+ 2008-08-28 01:10:55 77,824 ----a-w C:\WINDOWS\assembly\GAC\SonicMCEBurnEngine\0.9.0.0__17c52700e9a64fd0\SonicMCEBurnEngine.dll
- 2008-08-21 22:41:20 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.3300.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
+ 2008-08-28 01:03:08 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.3300.0__b03f5f7f11d50a3a\System.Configuration.Install.dll
- 2008-08-21 22:41:24 1,179,648 ----a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.3300.0__b77a5c561934e089\System.Data.dll
+ 2008-08-28 01:03:12 1,179,648 ----a-w C:\WINDOWS\assembly\GAC\System.Data\1.0.3300.0__b77a5c561934e089\System.Data.dll
- 2008-08-21 22:41:24 1,695,744 ----a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.3300.0__b03f5f7f11d50a3a\System.Design.dll
+ 2008-08-28 01:03:13 1,695,744 ----a-w C:\WINDOWS\assembly\GAC\System.Design\1.0.3300.0__b03f5f7f11d50a3a\System.Design.dll
- 2008-08-21 22:41:21 86,016 ----a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.3300.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
+ 2008-08-28 01:03:08 86,016 ----a-w C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.3300.0__b03f5f7f11d50a3a\System.DirectoryServices.dll
- 2008-08-21 22:41:21 65,536 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
+ 2008-08-28 01:03:09 65,536 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.Design.dll
- 2008-08-21 22:41:25 462,848 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.dll
+ 2008-08-28 01:03:14 462,848 ----a-w C:\WINDOWS\assembly\GAC\System.Drawing\1.0.3300.0__b03f5f7f11d50a3a\System.Drawing.dll
- 2008-08-21 22:41:19 212,992 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.3300.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
+ 2008-08-28 01:03:06 212,992 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.3300.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll
- 2008-08-21 22:41:19 48,640 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.3300.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
+ 2008-08-28 01:03:06 48,640 ----a-w C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.3300.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll
- 2008-08-21 22:41:28 352,256 ----a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.3300.0__b03f5f7f11d50a3a\System.Management.dll
+ 2008-08-28 01:03:19 352,256 ----a-w C:\WINDOWS\assembly\GAC\System.Management\1.0.3300.0__b03f5f7f11d50a3a\System.Management.dll
- 2008-08-21 22:41:26 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.3300.0__b03f5f7f11d50a3a\System.Messaging.dll
+ 2008-08-28 01:03:15 241,664 ----a-w C:\WINDOWS\assembly\GAC\System.Messaging\1.0.3300.0__b03f5f7f11d50a3a\System.Messaging.dll
- 2008-08-21 22:41:28 311,296 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.3300.0__b77a5c561934e089\System.Runtime.Remoting.dll
+ 2008-08-28 01:03:19 311,296 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.3300.0__b77a5c561934e089\System.Runtime.Remoting.dll
- 2008-08-21 22:41:29 131,072 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.3300.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
+ 2008-08-28 01:03:19 131,072 ----a-w C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.3300.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll
- 2008-08-21 22:41:19 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.3300.0__b03f5f7f11d50a3a\System.Security.dll
+ 2008-08-28 01:03:07 77,824 ----a-w C:\WINDOWS\assembly\GAC\System.Security\1.0.3300.0__b03f5f7f11d50a3a\System.Security.dll
- 2008-08-21 22:41:21 126,976 ----a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.3300.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
+ 2008-08-28 01:03:09 126,976 ----a-w C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.3300.0__b03f5f7f11d50a3a\System.ServiceProcess.dll
- 2008-08-21 22:41:22 61,440 ----a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.3300.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
+ 2008-08-28 01:03:10 61,440 ----a-w C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.3300.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll
- 2008-08-21 22:41:23 507,904 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.3300.0__b03f5f7f11d50a3a\System.Web.Services.dll
+ 2008-08-28 01:03:11 507,904 ----a-w C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.3300.0__b03f5f7f11d50a3a\System.Web.Services.dll
- 2008-08-21 22:41:22 1,200,128 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
+ 2008-08-28 01:03:10 1,200,128 ----a-w C:\WINDOWS\assembly\GAC\System.Web\1.0.3300.0__b03f5f7f11d50a3a\System.Web.dll
- 2008-08-21 22:41:23 2,002,944 ----a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.3300.0__b77a5c561934e089\System.Windows.Forms.dll
+ 2008-08-28 01:03:11 2,002,944 ----a-w C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.3300.0__b77a5c561934e089\System.Windows.Forms.dll
- 2008-08-21 22:41:24 1,302,528 ----a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.3300.0__b77a5c561934e089\System.Xml.dll
+ 2008-08-28 01:03:12 1,302,528 ----a-w C:\WINDOWS\assembly\GAC\System.Xml\1.0.3300.0__b77a5c561934e089\System.Xml.dll
- 2008-08-21 22:41:25 1,179,648 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.3300.0__b77a5c561934e089\System.dll
+ 2008-08-28 01:03:14 1,179,648 ----a-w C:\WINDOWS\assembly\GAC\System\1.0.3300.0__b77a5c561934e089\System.dll
+ 2008-08-28 01:10:38 258,048 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\BDATunePIA\6.0.3000.0__31bf3856ad364e35_4d9278fe\BDATunePIA.dll
+ 2008-08-28 01:10:23 159,744 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehCIR\6.0.3000.0__31bf3856ad364e35_188c7930\ehCIR.dll
+ 2008-08-28 01:10:37 2,326,528 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\EhCM\6.0.3000.0__31bf3856ad364e35_35f6a03f\EhCM.dll
+ 2008-08-28 01:10:38 299,008 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehcommon\6.0.3000.0__31bf3856ad364e35_ad121f43\ehcommon.dll
+ 2008-08-28 01:10:32 1,306,624 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehepg\6.0.3000.0__31bf3856ad364e35_900f5fac\ehepg.dll
+ 2008-08-28 01:10:24 167,936 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehepgdat\6.0.3000.0__31bf3856ad364e35_49e8a94e\ehepgdat.dll
+ 2008-08-28 01:10:41 167,936 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehExtCOM\6.0.3000.0__31bf3856ad364e35_39d2395e\ehExtCOM.dll
+ 2008-08-28 01:10:53 155,648 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehExtHost\6.0.3000.0__31bf3856ad364e35_8ed46c20\ehExtHost.exe
+ 2008-08-28 01:09:58 10,752 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiExtCOM\6.0.3000.0__31bf3856ad364e35_106f53ca\ehiExtCOM.dll
+ 2008-08-28 01:09:59 102,400 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiExtens\6.0.3000.0__31bf3856ad364e35_5ba27595\ehiExtens.dll
+ 2008-08-28 01:10:27 266,240 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiMsgr\6.0.3000.0__31bf3856ad364e35_8475d0d7\ehiMsgr.dll
+ 2008-08-28 01:10:25 380,928 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiPlay\6.0.3000.0__31bf3856ad364e35_8cd2fd7b\ehiPlay.dll
+ 2008-08-28 01:10:25 565,248 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiProxy\6.0.3000.0__31bf3856ad364e35_08263e68\ehiProxy.dll
+ 2008-08-28 01:10:26 40,960 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiUserXp\6.0.3000.0__31bf3856ad364e35_b5fe5327\ehiUserXp.dll
+ 2008-08-28 01:10:26 458,752 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiVidCtl\6.0.3000.0__31bf3856ad364e35_82252e8e\ehiVidCtl.dll
+ 2008-08-28 01:09:57 180,224 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiwmp\6.0.3000.0__31bf3856ad364e35_1e2eec54\ehiwmp.dll
+ 2008-08-28 01:10:39 69,632 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehiWUapi\6.0.3000.0__31bf3856ad364e35_b17ddf7d\ehiWUapi.dll
+ 2008-08-28 01:10:09 684,032 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehRecObj\6.0.3000.0__31bf3856ad364e35_31a509e6\ehRecObj.dll
+ 2008-08-28 01:10:52 6,336,512 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\ehshell\6.0.3000.0__31bf3856ad364e35_fc9f64c2\ehshell.exe
+ 2008-08-28 01:10:39 65,536 ----a-w C:\WINDOWS\assembly\NativeImages1_v1.1.4322\Microsoft.MediaCenter\6.0.3100.0__31bf3856ad364e35_3d26beab\Microsoft.MediaCenter.dll
- 2008-08-21 11:00:04 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-28 00:43:29 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-21 11:00:04 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-28 00:43:29 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-28 00:43:18 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008081820080825\index.dat
+ 2008-08-28 00:43:18 32,768 --sha-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008082820080829\index.dat
- 2008-08-21 11:00:04 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-28 00:43:29 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2004-08-10 19:00:00 71,040 ------w C:\WINDOWS\system32\drivers\_004787_.tmp.dll
- 2008-08-22 09:55:59 192,184 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-08-28 11:05:20 192,184 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-08-27 18:26:37 222,395 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
+ 2008-08-29 10:49:58 222,391 ----a-w C:\WINDOWS\system32\inetsrv\MetaBase.bin
- 2008-08-05 18:11:01 15,888,504 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-08-05 10:11:02 15,888,504 ----a-w C:\WINDOWS\system32\MRT.exe
- 2008-08-21 22:51:35 86,494 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-08-28 01:13:03 86,494 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-08-21 22:51:35 471,940 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-08-28 01:13:03 471,940 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2004-10-27 14:21:36 138,240 ----a-w C:\WINDOWS\system32\ReinstallBackups\0015\DriverFiles\hdaudbus.sys
+ 2004-08-10 19:00:00 36,096 ----a-w C:\WINDOWS\system32\ReinstallBackups\0018\DriverFiles\i386\intelppm.sys
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 20:00 15360]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-23 05:17 67128]
"BullGuard"="C:\Program Files\BullGuard Software\BullGuard\bullguard.exe" [2007-12-23 03:39 102400]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 21:05 204288]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-08-18 18:41 1832272]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-05 14:56 64512]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 09:11 925696]
"VolPanel"="C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe" [2006-07-13 15:11 122880]
"AudioDrvEmulator"="C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-11-04 19:07 49152]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00 90112]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-12-02 10:10 98304]
"PCMService"="C:\Program Files\CyberLink\PowerCinema\PCMService.exe" [2005-01-14 19:21 110744]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"Ptipbmf"="ptipbmf.dll" [2003-06-20 15:06 118784 C:\WINDOWS\system32\ptipbmf.dll]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2004-10-27 15:21 61952 C:\WINDOWS\system32\HdAShCut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-10 20:00 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"l40mWh0AQy"="C:\Documents and Settings\All Users\Application Data\rclgpmbi\bgrkdwpu.exe" [2008-08-25 20:54 57344]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 04:21:22 288472]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-23 05:17:35 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-01-01 17:38:41 450560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
"SynchronousMachineGroupPolicy"= 0 (0x0)
"SynchronousUserGroupPolicy"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoStrCmpLogical"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMBalloonTip"= 1 (0x1)
"MemCheckBoxInRunDlg"= 0 (0x0)
"NoAutoTrayNotify"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoDesktopCleanupWizard"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"ChkShCom"= {70C2B6EE-7439-0217-1873-0B913CEAD49A} - C:\Program Files\upgtdnd\ChkShCom.dll [2008-08-25 20:54 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= C:\PROGRA~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dllschannel.dlldigest.dllmsnsspc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\Phil\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=C:\Documents and Settings\Phil\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=C:\WINDOWS\pss\OneNote 2007 Screen Clipper and Launcher.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
--a------ 2006-08-14 14:41 114688 C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--a------ 2006-08-14 14:39 98304 C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2008-05-02 22:46 13529088 C:\WINDOWS\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2008-05-02 22:46 86016 C:\WINDOWS\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-06-15 12:36 229376 C:\PROGRA~1\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
--a------ 2006-08-14 14:38 94208 C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2004-11-02 21:24 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-08-26 19:14 36975 C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-10-28 18:41 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--------- 2006-10-18 21:05 204288 C:\Program Files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{1290A33C-85F5-4164-A1BE-7DD299D4986A}]
--a------ 2004-06-08 19:33 69721 C:\Program Files\CyberLink\PowerBackup\PBKScheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper]
--a------ 2008-02-20 20:58 19456 C:\WINDOWS\system32\CtHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTxfiHlp]
--a------ 2008-02-20 20:58 19968 C:\WINDOWS\system32\Ctxfihlp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2008-05-02 22:46 1630208 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\age2_x1\\age2_x1.icd"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Microsoft Games\\Age of Empires II\\EMPIRES2.ICD"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\generals.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\generals.exe"=
"C:\\Program Files\\Dassault Systemes\\B16\\intel_a\\code\\bin\\CNEXT.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\game.dat"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\EA Games\\Command and Conquer Generals\\patchget.dat"=
"C:\\Documents and Settings\\Phil\\My Documents\\My Games\\[PC GAME] Worms Armageddon + All weapons unblocked + cracked + xp patch by Lupen[FUMAI]\\wormsarm\\WA.exe"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\THQ\\Dawn of War\\W40k.exe"=
"C:\\Program Files\\THQ\\Dawn of War - Dark Crusade\\DarkCrusade.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R1 LUMDriver;LUMDriver;C:\WINDOWS\system32\drivers\LUMDriver.sys [2003-07-11 14:22]
R2 BBDemon;Backbone Service;C:\Program Files\Dassault Systemes\B16\intel_a\code\bin\CATSysDemon.exe [2005-09-06 23:11]
R2 CTAudSvcService;Creative Audio Service;C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-03-07 19:24]
R3 FileSpy5;BullGuard File Monitor;C:\Program Files\BullGuard Software\BullGuard\filespy5.sys [2007-12-23 03:39]
R3 ha20x2k;Creative 20X HAL Driver;C:\WINDOWS\system32\drivers\ha20x2k.sys [2008-02-25 09:44]
R3 Reconn;BullGuard Email Monitor;C:\Program Files\BullGuard Software\BullGuard\reconn.sys [2007-12-23 03:39]
R3 RTLWUSB;Realtek RTL8187 Wireless 802.11g 54Mbps USB 2.0 Network Adapter;C:\WINDOWS\system32\DRIVERS\RTL8187.sys [2006-06-16 08:30]
S3 AtcL001;NDIS Miniport Driver for Attansic L1 Gigabit Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\atl01_xp.sys [2006-07-28 20:28]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;C:\PROGRA~1\Belkin\BELKIN~1.11G\DNINDIS5.SYS []
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-04 00:01]
S4 m5287;m5287;C:\WINDOWS\system32\DRIVERS\m5287.sys [2005-02-05 08:00]
S4 m5289;m5289;C:\WINDOWS\system32\DRIVERS\m5289.sys [2004-12-01 11:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bg5 REG_MULTI_SZ BGMainSvc BsFileSpy BsMailProxy BsFirewall

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{74127d8c-d92c-11db-89fa-0018e7046c1b}]
\Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Toy.exe

*Newly Created Service* - CATCHME
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Local Page = \blank.htm
R0 -: HKCU-Main,Start Page = hxxp://www.google.co.uk/
R1 -: HKCU-Internet Settings,ProxyOverride = localhost
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O18 -: Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-29 12:43:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-29 12:44:24
ComboFix-quarantined-files.txt 2008-08-29 11:44:21
ComboFix2.txt 2008-08-27 18:30:23
ComboFix3.txt 2008-08-27 17:59:51
ComboFix4.txt 2008-08-26 23:06:23
ComboFix5.txt 2008-08-29 11:40:37

Pre-Run: 121,692,532,736 bytes free
Post-Run: 121,662,025,728 bytes free

491 --- E O F --- 2008-08-22 10:13:12

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 14325

Posted 8-29-2008 4:43 (GMT +1)

Update Malwarebytes' Anti-Malware.

If an update is found, it will download and install the latest version.

Once the program has loaded, select Perform full scan, then click Scan.

When the scan is complete, click OK, then Show Results to view the results.

Be sure that everything is checked, and click Remove Selected.

When completed, a log will open in Notepad. Please save it to a convenient location.

NB: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

---------------------------------------------------------------

Open notepad and copy/paste the text in the quotebox below into it:

Quote:

Killall::

Snapshot::

File::
C:\WINDOWS\system32\xcbqluhs.exe
C:\WINDOWS\system32\gzelgrab.exe

Folder::
C:\Program Files\upgtdnd

C:\Documents and Settings\All Users\Application Data\rclgpmbi

C:\Program Files\Logitech\Desktop Messenger

Folderlook::

C:\cmpnents

Folderlook:

C:\cmpnents

Save this as:
CFScript

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Refering to the picture above, drag CFScript into ComboFix.exe

Then post fresh combofix log along with malwarbyte log

Do NOT post your problem in someone elses thread.