Re: annoying virus prevent hijackthis?
here are the required logs
combofix:
ComboFix 09-04-04.01 - Faraz Ahmed 2009-04-06 19:49:33.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2038.1668 [GMT 5:00]
Running from: c:\documents and settings\Faraz Ahmed\Desktop\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\csrcs.exe
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\x64
c:\windows\system32\userinit.exe . . . is infected!!
c:\windows\system32\spoolsv.exe . . . is infected!!
c:\windows\explorer.exe . . . is infected!!
.
((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))
.
2009-04-03 02:08 . 2009-04-03 02:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\Installations
2009-04-03 02:01 . 2007-02-26 11:33 172,032 --a------ c:\windows\system32\igfxres.dll
2009-04-03 01:56 . 2004-08-04 03:56 221,184 --a------ c:\windows\system32\wmpns.dll
2009-04-03 01:55 . 2009-04-03 01:55 749 -rah----- c:\windows\WindowsShell.Manifest
2009-04-03 01:55 . 2009-04-03 01:55 749 -rah----- c:\windows\system32\wuaucpl.cpl.manifest
2009-04-03 01:55 . 2009-04-03 01:55 749 -rah----- c:\windows\system32\sapi.cpl.manifest
2009-04-03 01:55 . 2009-04-03 01:55 749 -rah----- c:\windows\system32\nwc.cpl.manifest
2009-04-03 01:55 . 2009-04-03 01:55 749 -rah----- c:\windows\system32\ncpa.cpl.manifest
2009-04-03 01:55 . 2009-04-03 01:55 488 -rah----- c:\windows\system32\logonui.exe.manifest
2009-04-03 01:43 . 2004-08-04 04:57 1,086,058 -ra------ c:\windows\SET67.tmp
2009-04-03 01:43 . 2004-08-04 05:03 1,042,903 -ra------ c:\windows\SET64.tmp
2009-04-03 00:33 . 2009-04-03 00:33 <DIR> d-------- C:\dellme
2009-04-02 23:20 . 112,238 c:\windows\system32\drivers\673bbea7.sys
2009-04-02 23:20 . 2009-04-02 23:20 104,597 --a------ C:\cgngclad.exe
2009-04-02 23:20 . 2009-04-02 23:20 46,080 --a------ C:\patq.exe
2009-04-02 23:20 . 2009-04-02 23:20 29,696 --a------ C:\hfusxvb.exe
2009-04-02 23:20 . 2009-04-02 23:20 2 --a------ C:\1236637251
2009-04-02 23:19 . 2009-04-02 23:19 9,216 --a------ c:\windows\system32\ubb.exe
2009-04-02 22:46 . 2009-04-02 22:46 1,195 -rahs---- c:\windows\system32\autorun.i
2009-04-02 22:46 . 2009-04-02 22:46 1,033 -rahs---- c:\windows\system32\autorun.in
2009-04-02 22:46 . 2009-04-02 22:46 0 -rahs---- C:\kht
2009-04-02 22:38 . 2009-04-02 22:38 <DIR> d--hs---- c:\windows\ftpcache
2009-03-31 12:31 . 2009-03-31 12:31 <DIR> d-------- c:\program files\Opera
2009-03-31 12:26 . 2009-03-31 12:26 <DIR> d---s---- c:\documents and settings\Faraz Ahmed\UserData
2009-03-30 15:36 . 2009-03-30 15:37 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\TransRender
2009-03-30 15:36 . 2009-03-30 15:37 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Temporary
2009-03-30 15:36 . 2009-03-30 15:37 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Samsung
2009-03-30 15:36 . 2009-03-30 15:37 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\ConvertTemp
2009-03-30 15:35 . 2009-03-30 15:35 <DIR> d-------- c:\windows\system32\Samsung_USB_Drivers
2009-03-30 15:35 . 2006-05-03 22:53 174,592 --a------ c:\windows\system32\framedyn.dll
2009-03-30 15:35 . 2006-07-24 16:05 5,632 --a------ c:\windows\system32\drivers\StarOpen.sys
2009-03-30 15:35 . 2005-08-28 20:51 766 --a------ c:\windows\system32\Uninstall.ico
2009-03-30 15:34 . 2009-03-30 15:34 <DIR> d-------- c:\program files\Samsung
2009-03-30 15:33 . 2009-03-30 15:33 <DIR> d-------- c:\program files\Common Files\Adobe
2009-03-28 12:27 . 2009-03-28 12:27 <DIR> d-------- c:\documents and settings\All Users\Application Data\Ubisoft
2009-03-28 12:26 . 2009-03-09 15:27 4,178,264 --a------ c:\windows\system32\D3DX9_41.dll
2009-03-28 12:26 . 2009-03-09 15:27 1,846,632 --a------ c:\windows\system32\D3DCompiler_41.dll
2009-03-28 12:26 . 2009-03-16 14:18 517,448 --a------ c:\windows\system32\XAudio2_4.dll
2009-03-28 12:26 . 2009-03-09 15:27 453,456 --a------ c:\windows\system32\d3dx10_41.dll
2009-03-28 12:26 . 2009-03-16 14:18 235,352 --a------ c:\windows\system32\xactengine3_4.dll
2009-03-28 12:26 . 2009-03-16 14:18 69,448 --a------ c:\windows\system32\XAPOFX1_3.dll
2009-03-28 12:26 . 2009-03-16 14:18 22,360 --a------ c:\windows\system32\X3DAudio1_6.dll
2009-03-27 12:13 . 2009-04-02 23:22 85,249 --a------ c:\windows\setupapi.old
2009-03-27 12:12 . 2009-03-10 02:39 2,793,784 --a------ c:\windows\system32\GameMon.des
2009-03-27 12:07 . 2003-07-21 08:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
2009-03-27 12:07 . 2005-01-04 23:43 4,682 --a------ c:\windows\system32\npptNT2.sys
2009-03-27 12:06 . 2009-03-27 12:06 <DIR> d-------- c:\program files\Common Files\INCA Shared
2009-03-26 01:25 . 2009-03-26 01:25 <DIR> d-------- C:\ISO Shrink
2009-03-26 00:57 . 2009-03-26 00:57 <DIR> d-------- c:\program files\danny_kay1710
2009-03-26 00:40 . 2009-03-26 00:40 <DIR> d-------- c:\program files\Winnydows
2009-03-25 22:12 . 2009-03-25 22:12 <DIR> d-------- c:\documents and settings\All Users\Application Data\2DBoy
2009-03-25 12:30 . 2009-03-25 12:30 <DIR> d-------- c:\program files\CCleaner
2009-03-25 12:28 . 2009-03-25 12:28 <DIR> d-------- c:\program files\PaRaMeter
2009-03-25 12:28 . 2009-03-25 12:28 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\PaRaMeter
2009-03-24 20:57 . 2009-03-24 20:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\PMB Files
2009-03-24 20:55 . 2009-03-24 20:55 <DIR> d-------- c:\program files\Pando Networks
2009-03-22 16:14 . 2009-03-22 16:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Blizzard
2009-03-21 16:10 . 2009-03-21 16:10 <DIR> d--hs---- C:\FOUND.000
2009-03-21 15:31 . 2009-03-21 15:31 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Thunderbird
2009-03-19 23:16 . 2009-03-19 23:16 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Apple Computer
2009-03-19 23:15 . 2009-03-19 23:15 <DIR> d-------- c:\program files\Bonjour
2009-03-19 23:15 . 2009-03-19 23:15 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
2009-03-19 23:14 . 2009-03-19 23:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2009-03-19 11:23 . 2009-03-19 11:23 <DIR> d-------- c:\program files\WordFlood 2.0
2009-03-16 18:03 . 2009-03-16 18:03 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\dvdcss
2009-03-15 23:33 . 2009-03-15 23:33 <DIR> d-------- c:\program files\AnswerAnalyst
2009-03-14 18:35 . 2009-03-14 18:35 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\ImgBurn
2009-03-14 03:41 . 2009-03-14 03:41 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Media Player Classic
2009-03-14 00:35 . 2009-03-14 00:35 <DIR> d-------- c:\program files\CSVed
2009-03-14 00:35 . 2009-03-14 00:35 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Sam Francke
2009-03-12 21:14 . 2009-03-12 21:14 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Red Alert 3
2009-03-12 17:49 . 2009-03-12 17:49 <DIR> d-------- c:\windows\Logs
2009-03-12 16:21 . 2009-03-12 16:21 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\FileZilla
2009-03-12 01:59 . 2009-03-12 01:59 <DIR> d-------- c:\program files\RMClock
2009-03-11 17:52 . 2007-02-24 14:42 39,936 --a------ c:\windows\system32\drivers\rimmptsk.sys
2009-03-11 16:42 . 2009-03-11 16:42 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\skypePM
2009-03-11 16:42 . 2009-03-11 16:42 56 --ah----- c:\windows\system32\ezsidmv.dat
2009-03-11 16:40 . 2009-03-11 16:40 <DIR> dr------- c:\program files\Skype
2009-03-11 16:40 . 2009-03-11 16:40 <DIR> d-------- c:\program files\Common Files\Skype
2009-03-11 16:40 . 2009-03-11 16:40 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Skype
2009-03-11 11:17 . 2009-03-11 11:17 <DIR> d-------- c:\program files\CommentKahuna
2009-03-11 11:09 . 2009-03-11 11:09 58,368 --a------ C:\FreeBlogCommenter.exe
2009-03-10 16:40 . 2009-03-10 16:40 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\vlc
2009-03-10 16:13 . 2009-03-10 16:13 <DIR> d-------- c:\program files\Yahoo!
2009-03-10 16:13 . 2009-03-10 16:13 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2009-03-10 16:02 . 2009-03-10 16:02 <DIR> d-------- c:\program files\uTorrent
2009-03-10 16:02 . 2009-03-10 16:02 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\uTorrent
2009-03-10 15:17 . 2009-03-10 15:17 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\Intel
2009-03-10 14:53 . 2009-03-10 14:53 <DIR> dr-h----- c:\documents and settings\Faraz Ahmed\Application Data\SecuROM
2009-03-10 14:53 . 2009-03-10 14:53 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Bioshock
2009-03-10 14:53 . 2009-03-10 14:53 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2009-03-10 14:47 . 2009-01-21 11:43 1,498,560 --a------ c:\windows\system32\igkrng400.bin
2009-03-10 14:47 . 2009-01-21 11:52 155,648 --a------ c:\windows\system32\igfxCoIn_v5029.dll
2009-03-10 14:44 . 2009-03-10 14:44 <DIR> d-------- c:\program files\Orbitdownloader
2009-03-10 14:44 . 2009-03-10 14:44 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Orbit
2009-03-10 14:44 . 2009-03-10 14:44 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\GrabPro
2009-03-10 12:29 . 2009-03-10 12:29 <DIR> d-------- c:\windows\Sun
2009-03-10 12:15 . 2009-03-10 12:15 <DIR> d-------- c:\program files\Java
2009-03-10 12:15 . 2009-03-10 12:15 410,976 --a------ c:\windows\system32\deploytk.dll
2009-03-10 12:15 . 2009-03-10 12:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-03-10 11:30 . 2009-03-10 11:30 <DIR> d-------- c:\documents and settings\Faraz Ahmed\Application Data\Command & Conquer 3 Kane's Wrath
2009-03-10 11:29 . 2007-10-12 15:14 1,374,232 --a------ c:\windows\system32\D3DCompiler_36.dll
2009-03-10 11:29 . 2007-10-02 09:56 444,776 --a------ c:\windows\system32\d3dx10_36.dll
2009-03-10 11:29 . 2007-10-22 03:39 267,272 --a------ c:\windows\system32\xactengine2_10.dll
2009-03-10 11:29 . 2007-10-22 03:37 17,928 --a------ c:\windows\system32\X3DAudio1_2.dll
2009-03-10 11:28 . 2007-10-12 15:14 3,734,536 --a------ c:\windows\system32\d3dx9_36.dll
2009-03-10 11:28 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-03-10 10:46 . 2009-03-10 10:47 0 --a------ c:\windows\nsreg.dat
2009-03-10 05:49 . 2009-03-10 05:49 940,794 --a------ c:\windows\system32\LoopyMusic.wav
2009-03-10 05:49 . 2009-03-10 05:49 146,650 --a------ c:\windows\system32\BuzzingBee.wav
2009-03-10 05:46 . 2004-08-03 23:07 52,864 --a------ c:\windows\system32\drivers\DMusic.sys
2009-03-10 05:46 . 2004-08-03 23:07 6,400 --a------ c:\windows\system32\drivers\splitter.sys
2009-03-10 05:46 . 2007-02-15 13:36 176 --a------ c:\windows\system32\drivers\RTHDAEQ0.dat
2009-03-10 05:45 . 2009-03-10 05:45 <DIR> d-------- c:\windows\system32\RTCOM
2009-03-10 05:45 . 2006-08-01 15:02 49,152 --a------ c:\windows\system32\ChCfg.exe
2009-03-10 05:45 . 2006-10-16 16:10 23,856 --a------ c:\windows\system32\spupdsvc.exe
2009-03-10 05:44 . 2009-03-10 05:44 <DIR> d-------- c:\program files\Synaptics
2009-03-10 05:44 . 2009-03-10 05:44 <DIR> d-------- c:\program files\Realtek
2009-03-10 05:44 . 2009-03-10 05:44 <DIR> d--h----- c:\program files\InstallShield Installation Information
2009-03-10 05:44 . 2009-03-10 05:44 <DIR> d-------- c:\program files\Common Files\InstallShield
2009-03-10 05:42 . 2009-03-10 05:42 <DIR> d-------- c:\windows\system32\Lang
2009-03-10 05:38 . 2009-03-10 05:38 <DIR> d-------- c:\windows\system32\DRVSTORE
2009-03-10 05:38 . 2009-03-10 05:38 <DIR> d-------- c:\program files\Intel
2009-03-10 05:38 . 2009-03-10 05:38 <DIR> d-------- C:\Intel
2009-03-10 03:28 . 2009-03-10 03:28 <DIR> d-------- c:\program files\Lenovo Fingerprint Software
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-03-10 00:44 315,392 ----a-w c:\windows\HideWin.exe
2009-03-09 18:26 --------- d-----w c:\program files\Microsoft ActiveSync
2009-03-09 18:08 --------- d-----w c:\program files\microsoft frontpage
2009-02-12 03:27 993,816 ----a-w c:\windows\system32\igxpun.exe
.
------- Sigcheck -------
2004-08-03 22:56 1051136 bb45164e06588eaaa13d9ddffdf09e5b c:\windows\explorer.exe
2004-08-03 22:56 34304 a1075df3a55057de6c6f49186ee7c918 c:\windows\system32\ctfmon.exe
2004-08-03 22:56 76800 8a5f1e693df9c14085d2d92186aa6e1b c:\windows\system32\spoolsv.exe
2004-08-04 03:56 130048 eb43ed2c10cc29e53f951b0943bdd680 c:\windows\system32\wuauclt.exe
2004-08-03 22:56 43520 7494762415e0e91721b1a98c2f58c778 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-20 4363504]
"RMClock"="c:\program files\RMClock\RMClockLauncher.exe" [2008-02-29 80384]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-19 794713]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-01-25 73728]
"TPWAUDAP"="c:\program files\Lenovo\HOTKEY\TpWAudAp.exe" [2008-03-11 54560]
"TPFNF7"="c:\program files\Lenovo\NPDIRECT\TPFNF7SP.exe" [2009-01-07 60704]
"FingerPrintSoftware"="c:\program files\Lenovo Fingerprint Software\fpapp.exe" [2007-03-02 954368]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-10 136600]
"PMHandler"="c:\progra~1\Lenovo\PMDRIV~1\PMHandler .exe" [2007-03-16 52320]
"QuickTime Task"="c:\program files\QT Lite\QTTask.exe" [2009-01-05 434176]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-03-23 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-03-23 162584]
"Persistence"="c:\windows\system32\igfxpers.ex e" [2007-03-23 138008]
"SkyTel"="SkyTel.EXE" [2006-05-16 c:\windows\SkyTel.exe]
"AGRSMMSG"="AGRSMMSG.exe" [2006-08-30 c:\windows\AGRSMMSG.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-30 c:\windows\RTHDCPL.exe]
c:\documents and settings\Faraz Ahmed\Start Menu\Programs\Startup\
RocketDock.lnk - c:\windows\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe [2007-03-19 651264]
UberIcon.lnk - c:\windows\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe [2006-05-21 200704]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
Orbit.lnk - c:\program files\Orbitdownloader\orbitdm.exe [2009-03-10 1739976]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ATFUS]
2007-02-27 17:26 131072 c:\windows\system32\FpWinlogonNp.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
2008-08-08 19:14 28672 c:\program files\Lenovo\HOTKEY\tphklock.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitdm.exe"=
"c:\\Program Files\\Orbitdownloader\\orbitnet.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"56177:TCP"= 56177:TCP:Pando Media Booster
"56177:UDP"= 56177:UDP:Pando Media Booster
R1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\drivers\smiif32.sys [2008-05-12 13480]
R1 PMHler;PMHler;c:\windows\system32\drivers\PMHler.s ys [2006-05-24 10240]
R2 FingerprintServer;Fingerprint Server;c:\windows\system32\FpLogonServ.exe [2007-01-19 81920]
R2 FNF5SVC;Fn+F5 Service;c:\program files\Lenovo\HOTKEY\FnF5svc.exe [2008-03-14 54560]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\GameMon.des -service --> c:\windows\system32\GameMon.des -service [?]
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{53b8f62f-10bd-11de-ab9b-001dd9f920d1}]
\sheLL\AuTOplaY\cOmmANd - J:\xgat.pif
\sheLL\AutoRun\command - J:\xgat.pif
\sheLL\EXplOrE\CommaND - J:\xgat.pif
\sheLL\oPen\COmMAnD - J:\xgat.pif
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{5aa4677e-0d0b-11de-ab83-db9e9aceb849}]
\shell\autorun\command - G:\kobsgv.exe
\shell\explore\command - G:\kobsgv.exe
\shell\open\command - G:\kobsgv.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{c8669b8c-16b7-11de-abab-001dd9f920d1}]
\shell\autorun\command - G:\wiqtdb.exe
\shell\explore\command - G:\wiqtdb.exe
\shell\open\command - G:\wiqtdb.exe
[HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{d726aa4e-19e7-11de-abb2-001dd9f920d1}]
\sheLL\AuTOplaY\cOmmANd - xgat.pif
\sheLL\AutoRun\command - xgat.pif
\sheLL\EXplOrE\CommaND - xgat.pif
\sheLL\oPen\COmMAnD - xgat.pif
.
- - - - ORPHANS REMOVED - - - -
HKLM-Explorer_Run-csrcs - c:\windows\system32\csrcs.exe
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Send to &Bluetooth Device... - c:\program files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
TCP: {551BFCCC-FB16-4907-9B69-502355D36D6A} = 203.99.163.240,203.99.163.243
TCP: {E2F1BB3B-FEFA-484B-B7CB-59EE6202F1AF} = 203.99.163.240,203.99.163.243
FF - ProfilePath - c:\documents and settings\Faraz Ahmed\Application Data\Mozilla\Firefox\Profiles\h9yxczw6.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll
.
************************************************** ************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-06 19:53:05
Windows 5.1.2600 Service Pack 2 FAT NTAPI
detected NTDLL code modification:
ZwOpenFile
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
************************************************** ************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\n pggsvc]
"ImagePath"="c:\windows\system32\GameMon.des -service"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\6 73bbea7]
"ImagePath"="\SystemRoot\System32\drivers\673bbea7 .sys"
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_USERS\s-1-5-21-583907252-1897051121-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:c3,da,5e,d4,f7,c7,3d,a9,a5,36,ed,12,76,61 ,c0,d6,19,d0,3e,39,d6,d8,4a,
95,30,89,e3,c6,93,24,74,47,36,43,2b,2c,e5,a1,8d,79 ,79,d9,91,61,f7,69,80,a4,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33 ,8f,50
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(1088)
c:\windows\system32\FpWinLogonNp.dll
c:\program files\Lenovo Fingerprint Software\ATCSSINT.dll
c:\program files\Lenovo Fingerprint Software\SharedResources.dll
c:\program files\Lenovo Fingerprint Software\FPResource.dll
c:\program files\Bonjour\mdnsNSP.dll
c:\program files\Lenovo\HOTKEY\tphklock.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\LENOVO\BLUETOOTH SOFTWARE\BIN\BTWDINS.EXE
c:\program files\INTEL\WIRELESS\BIN\EVTENG.EXE
c:\program files\INTEL\WIRELESS\BIN\S24EVMON.EXE
c:\program files\BONJOUR\MDNSRESPONDER.EXE
c:\program files\JAVA\JRE6\BIN\JQS.EXE
c:\program files\LENOVO\PM DRIVER\PMSVEH.EXE
c:\program files\INTEL\WIRELESS\BIN\REGSRVC.EXE
c:\windows\system32\igfxsrvc.exe
c:\program files\Orbitdownloader\orbitnet.exe
c:\windows\system32\wscntfy.exe
.
************************************************** ************************
.
Completion time: 2009-04-06 19:54:40 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-06 14:54:36
Pre-Run: 365,297,664 bytes free
Post-Run: 423,723,008 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect
309
Logfile of HijackThis v1.99.1
Scan saved at 7:56:25 PM, on 4/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\FpLogonServ.exe
C:\Program Files\LENOVO\HOTKEY\FNF5SVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Lenovo\PM Driver\PMSveH.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Orbitdownloader\orbitdm.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
C:\Program Files\Orbitdownloader\orbitnet.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Live Search
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int ernet Settings,ProxyOverride = *.local
O2 - BHO: btorbit.com - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Grab Pro - {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - C:\Program Files\Orbitdownloader\GrabPro.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [TPWAUDAP] C:\Program Files\Lenovo\HOTKEY\TpWAudAp.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPFNF7] C:\Program Files\Lenovo\NPDIRECT\TPFNF7SP.exe /r
O4 - HKLM\..\Run: [FingerPrintSoftware] "C:\Program Files\Lenovo Fingerprint Software\fpapp.exe" \s
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [PMHandler] C:\PROGRA~1\Lenovo\PMDRIV~1\PMHandler.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QT Lite\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [RMClock] "C:\Program Files\RMClock\RMClockLauncher.exe"
O4 - Startup: RocketDock.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\RocketDock\RocketDock.exe
O4 - Startup: UberIcon.lnk = C:\WINDOWS\BricoPacks\Vista Inspirat 2\UberIcon\UberIcon Manager.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Orbit.lnk = C:\Program Files\Orbitdownloader\orbitdm.exe
O8 - Extra context menu item: &Download by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/201
O8 - Extra context menu item: &Grab video by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/204
O8 - Extra context menu item: Do&wnload selected by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/203
O8 - Extra context menu item: Down&load all by Orbit - res://C:\Program Files\Orbitdownloader\orbitmxt.dll/202
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Lenovo\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [searching] Search from the Address bar
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{551BFCCC-FB16-4907-9B69-502355D36D6A}: NameServer = 203.99.163.240,203.99.163.243
O17 - HKLM\System\CCS\Services\Tcpip\..\{E2F1BB3B-FEFA-484B-B7CB-59EE6202F1AF}: NameServer = 203.99.163.240,203.99.163.243
O17 - HKLM\System\CS1\Services\Tcpip\..\{551BFCCC-FB16-4907-9B69-502355D36D6A}: NameServer = 203.99.163.240,203.99.163.243
O17 - HKLM\System\CS2\Services\Tcpip\..\{551BFCCC-FB16-4907-9B69-502355D36D6A}: NameServer = 203.99.163.240,203.99.163.243
O17 - HKLM\System\CS3\Services\Tcpip\..\{551BFCCC-FB16-4907-9B69-502355D36D6A}: NameServer = 203.99.163.240,203.99.163.243
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: ATFUS - C:\WINDOWS\system32\FpWinLogonNp.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: tphotkey - C:\Program Files\Lenovo\HOTKEY\tphklock.dll
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - %fystemRoot%\system32\svchost.exe (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\Lenovo\Bluetooth Software\bin\btwdins.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Fingerprint Server (FingerprintServer) - AuthenTec,Inc - C:\WINDOWS\system32\FpLogonServ.exe
O23 - Service: Fn+F5 Service (FNF5SVC) - Lenovo. - C:\Program Files\LENOVO\HOTKEY\FNF5SVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing)
O23 - Service: PMSveH - Lenovo - C:\Program Files\Lenovo\PM Driver\PMSveH.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - %fystemroot%\system32\svchost.exe (file missing)
Linear Mode
