I Have Tro Jans HELP

system · 2007-06-24T06:51:42.000Z

((((((((((((((((((((((((( Files Created from 2007-05-24 to 2007-06-24 )))))))))))))))))))))))))))))))

2007-06-24 01:59 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-24 01:59 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-23 23:25 122,900 --a------ C:\WINDOWS\system32\jbscyogw.exe
2007-06-23 23:25 122,900 --a------ C:\WINDOWS\system32\jbscyogw.exe
2007-06-23 23:11 83,456 --a------ C:\WINDOWS\system32\ggf.exe
2007-06-23 23:11 83,456 --a------ C:\WINDOWS\system32\ggf.exe
2007-06-23 09:44 335 --a------ C:\WINDOWS\mozregistry.dat
2007-06-23 09:44 335 --a------ C:\WINDOWS\mozregistry.dat
2007-06-22 23:26 122,900 --a------ C:\WINDOWS\system32\gutfclrd.exe
2007-06-22 23:26 122,900 --a------ C:\WINDOWS\system32\gutfclrd.exe
2007-06-22 23:25 d-------- C:\WINDOWS\LastGood.Tmp
2007-06-22 23:25 d-------- C:\WINDOWS\LastGood.Tmp
2007-06-22 21:42 55 --a------ C:\DOCUME~1\Slayer\xdkntevekill.bat
2007-06-22 20:26 4,628 --a------ C:\WINDOWS\system32\sxbwslgv.exe
2007-06-22 20:26 4,628 --a------ C:\WINDOWS\system32\sxbwslgv.exe
2007-06-21 21:08 d-------- C:\DOCUME~1\Slayer\APPLIC~1\OpenOffice.org2
2007-06-21 21:04 d-------- C:\Program Files\OpenOffice.org 2.2
2007-06-20 22:35 d-------- C:\Program Files\Lavasoft
2007-06-20 22:35 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-20 22:34 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-20 22:34 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-06-19 21:59 d-------- C:\Veoh
2007-06-19 21:59 d-------- C:\Veoh
2007-06-19 21:01 122,900 --a------ C:\WINDOWS\system32\xdknteve.exe
2007-06-19 21:01 122,900 --a------ C:\WINDOWS\system32\xdknteve.exe
2007-06-19 10:28 d-------- C:\Incomplete
2007-06-19 10:28 d-------- C:\Incomplete
2007-06-18 18:41 d-------- C:\Program Files\LimeWire
2007-06-18 18:41 d-------- C:\Music
2007-06-18 18:41 d-------- C:\Music
2007-06-18 18:41 d-------- C:\DOCUME~1\Slayer\Incomplete
2007-06-18 18:41 d-------- C:\DOCUME~1\Slayer\APPLIC~1\LimeWire
2007-06-17 20:11 3,192,825 --a------ C:\haloce.exe
2007-06-17 20:11 3,192,825 --a------ C:\haloce.exe
2007-06-17 19:39 d-------- C:\DOCUME~1\Slayer\APPLIC~1\WinRAR
2007-06-17 18:25 d-------- C:\WINDOWS\system32\rserver30
2007-06-17 18:25 d-------- C:\WINDOWS\system32\rserver30
2007-06-17 18:15 d-------- C:\DOCUME~1\Slayer\APPLIC~1\Radmin
2007-06-17 15:19 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-16 20:37 125,972 --a------ C:\WINDOWS\system32\cgdncaox.dll
2007-06-16 20:37 125,972 --a------ C:\WINDOWS\system32\cgdncaox.dll
2007-06-16 20:29 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-06-16 20:29 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2007-06-16 20:29 d-------- C:\Program Files\ATI Technologies
2007-06-16 20:27 d-------- C:\ATI
2007-06-16 20:27 d-------- C:\ATI
2007-06-16 20:20 50,510,847 --a------ C:\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185.exe
2007-06-16 20:20 50,510,847 --a------ C:\6-11-pre-r300_xp-2k_dd_ccc_wdm_38185.exe
2007-06-16 20:14 921,475 --a------ C:\WINDOWS\system32\ati3d2ag.dll
2007-06-16 20:14 921,475 --a------ C:\WINDOWS\system32\ati3d2ag.dll
2007-06-16 20:14 844,675 --a------ C:\WINDOWS\system32\ati3d1ag.dll
2007-06-16 20:14 844,675 --a------ C:\WINDOWS\system32\ati3d1ag.dll
2007-06-12 19:04 d-------- C:\DOCUME~1\Slayer\runtime-EclipseApplication
2007-06-12 18:46 d-------- C:\DOCUME~1\Slayer\workspace
2007-06-12 10:11 d-------- C:\DOCUME~1\Slayer\APPLIC~1\MSN6
2007-06-12 10:11 d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\MSN6
2007-06-09 19:20 d-------- C:\Hero Editor
2007-06-09 19:20 d-------- C:\Hero Editor
2007-06-09 19:19 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-06-09 19:19 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2007-06-09 19:19 249,856 --------- C:\WINDOWS\Setup1.exe
2007-06-09 19:19 249,856 --------- C:\WINDOWS\Setup1.exe
2007-06-09 14:16 d–h----- C:\WINDOWS$hf_mig$
2007-06-09 14:16 d–h----- C:\WINDOWS$hf_mig$
2007-06-08 16:14 499,712 -ra------ C:\WINDOWS\system32\msvcp71.dll
2007-06-08 16:14 499,712 -ra------ C:\WINDOWS\system32\msvcp71.dll
2007-06-08 16:14 1,060,864 -ra------ C:\WINDOWS\system32\MFC71.dll
2007-06-08 16:14 1,060,864 -ra------ C:\WINDOWS\system32\MFC71.dll
2007-06-06 20:30 55,316 --a------ C:\WINDOWS\system32\msgemkdu.dll
2007-06-06 20:30 55,316 --a------ C:\WINDOWS\system32\msgemkdu.dll
2007-06-06 20:17 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-06 20:17 208,896 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2007-06-06 20:16 d-------- C:\NVIDIA
2007-06-06 20:16 d-------- C:\NVIDIA
2007-06-06 12:52 36,864 --a------ C:\Diablo II.exe
2007-06-06 12:52 36,864 --a------ C:\Diablo II.exe
2007-06-06 10:53 d–h----- C:\WINDOWS\PIF
2007-06-06 10:53 d–h----- C:\WINDOWS\PIF
2007-06-05 18:57 248,320 --a------ C:\WINDOWS\system32\installer_s.exe
2007-06-05 18:57 248,320 --a------ C:\WINDOWS\system32\installer_s.exe
2007-06-04 15:36 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-06-04 15:36 94,208 --a------ C:\WINDOWS\DIIUnin.exe
2007-06-04 15:36 26,330 --a------ C:\WINDOWS\DIIUnin.dat
2007-06-04 15:36 26,330 --a------ C:\WINDOWS\DIIUnin.dat
2007-06-04 15:36 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-06-04 15:36 2,829 --a------ C:\WINDOWS\DIIUnin.pif
2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:18 9,344 --a------ C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-04 15:14 6,272 --a------ C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-03 14:56 d-------- C:\Starcraft
2007-06-03 14:56 d-------- C:\Starcraft
2007-06-03 13:59 967 --a------ C:\WINDOWS\ScUnin.pif
2007-06-03 13:59 967 --a------ C:\WINDOWS\ScUnin.pif
2007-06-03 13:59 70,656 --a------ C:\WINDOWS\ScUnin.exe
2007-06-03 13:59 70,656 --a------ C:\WINDOWS\ScUnin.exe
2007-06-03 13:59 34,615 --a------ C:\WINDOWS\scunin.dat
2007-06-03 13:59 34,615 --a------ C:\WINDOWS\scunin.dat

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-21 15:32:38 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-06-21 15:32:37 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-06-21 15:32:37 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-06-20 03:01:20 -------- d–h–w C:\Program Files\InstallShield Installation Information
2007-06-18 01:10:45 -------- d-----w C:\Program Files\Microsoft Games
2007-06-12 20:42:43 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2007-06-12 15:11:09 -------- d-----w C:\Program Files\Online Services
2007-06-06 16:17:54 -------- d-----w C:\Program Files\Windows NT
2007-06-03 03:16:00 -------- d–h–w C:\Program Files\WindowsUpdate
2007-06-02 11:58:55 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\U3
2007-06-01 02:59:15 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\Simple Sudoku
2007-06-01 02:26:39 11,376 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-24 08:24:49 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\ChessBase
2007-05-24 01:32:34 -------- d-----w C:\Program Files\Common Files\ChessBase
2007-05-15 05:35:13 -------- d-----w C:\Program Files\Blender
2007-04-28 23:31:32 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\Help
2007-04-28 23:27:17 178 ----a-w C:\WINDOWS\PowerReg.dat
2007-04-18 13:51:20 2,113,536 ----a-w C:\WINDOWS\system32\python25.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 20:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-03-27 02:38:20 0 ----a-w C:\WINDOWS\nsreg.dat
2007-03-27 02:38:12 2,301 ----a-w C:\WINDOWS\mozver.dat
No new files created in this timespan

system · 2007-06-24T06:52:20.000Z

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-21 15:32:38 21,840 ----atw C:\WINDOWS\system32\SIntfNT.dll
2007-06-21 15:32:37 17,212 ----atw C:\WINDOWS\system32\SIntf32.dll
2007-06-21 15:32:37 12,067 ----atw C:\WINDOWS\system32\SIntf16.dll
2007-06-20 03:01:20 -------- d–h–w C:\Program Files\InstallShield Installation Information
2007-06-18 01:10:45 -------- d-----w C:\Program Files\Microsoft Games
2007-06-12 20:42:43 2,864 ----a-w C:\WINDOWS\system32\winsock.dll
2007-06-12 15:11:09 -------- d-----w C:\Program Files\Online Services
2007-06-06 16:17:54 -------- d-----w C:\Program Files\Windows NT
2007-06-03 03:16:00 -------- d–h–w C:\Program Files\WindowsUpdate
2007-06-02 11:58:55 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\U3
2007-06-01 02:59:15 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\Simple Sudoku
2007-06-01 02:26:39 11,376 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-24 08:24:49 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\ChessBase
2007-05-24 01:32:34 -------- d-----w C:\Program Files\Common Files\ChessBase
2007-05-15 05:35:13 -------- d-----w C:\Program Files\Blender
2007-04-28 23:31:32 -------- d-----w C:\DOCUME~1\Slayer\APPLIC~1\Help
2007-04-28 23:27:17 178 ----a-w C:\WINDOWS\PowerReg.dat
2007-04-18 13:51:20 2,113,536 ----a-w C:\WINDOWS\system32\python25.dll
2007-04-17 03:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-17 03:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-17 03:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-17 03:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-04-13 20:19:52 7,680 ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-03-27 02:38:20 0 ----a-w C:\WINDOWS\nsreg.dat
2007-03-27 02:38:12 2,301 ----a-w C:\WINDOWS\mozver.dat

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

Note empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{18C7DC10-D544-4398-8B09-7477CAAA896b}=C:\WINDOWS\System32\cgdncaox.dll [2007-06-16 20:37]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“nwiz”=“nwiz.exe” [2006-10-22 12:22 C:\WINDOWS\system32\nwiz.exe]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 10:42]

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{18C7DC10-D544-4398-8B09-7477CAAA896b}=C:\WINDOWS\System32\cgdncaox.dll [2007-06-16 20:37]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 01:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-04-30 10:42]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winkcv32]
winkcv32.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slayer^Start Menu^Programs^Startup^MagicDisc.lnk]
path=C:\Documents and Settings\Slayer\Start Menu\Programs\Startup\MagicDisc.lnk
backup=C:\WINDOWS\pss\MagicDisc.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Slayer^Start Menu^Programs^Startup^SDK Tray Menu.lnk]
path=C:\Documents and Settings\Slayer\Start Menu\Programs\Startup\SDK Tray Menu.lnk
backup=C:\WINDOWS\pss\SDK Tray Menu.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ApachInc]
rundll32.exe “C:\WINDOWS\System32\pobohgdk.dll”,realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\arwlapwl]
C:\WINDOWS\System32\arwlapwl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bgjcpcji]
C:\WINDOWS\System32\bgjcpcji.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\bmbqpkvy]
C:\WINDOWS\System32\bmbqpkvy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cbqzidut]
C:\WINDOWS\System32\cbqzidut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dkvwdapk]
C:\WINDOWS\System32\dkvwdapk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dkzelohy]
C:\WINDOWS\System32\dkzelohy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmjkdazs]
C:\WINDOWS\System32\dmjkdazs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dmzqrely]
C:\WINDOWS\System32\dmzqrely.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dybenetq]
C:\WINDOWS\System32\dybenetq.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ebezizsn]
C:\WINDOWS\System32\ebezizsn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\epyngpar]
C:\WINDOWS\System32\epyngpar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eviholov]
C:\WINDOWS\System32\eviholov.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ezodefqf]
C:\WINDOWS\System32\ezodefqf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fklcrqdm]
C:\WINDOWS\System32\fklcrqdm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fonyrgtk]
C:\WINDOWS\System32\fonyrgtk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fsjujszm]
C:\WINDOWS\System32\fsjujszm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\fuxqpchc]
C:\WINDOWS\System32\fuxqpchc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GPLv3]
rundll32.exe “C:\WINDOWS\System32\ulhrysdx.dll”,realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gpuzqrsn]
C:\WINDOWS\System32\gpuzqrsn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\gtabetsp]
C:\WINDOWS\System32\gtabetsp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hmhuvwju]
C:\WINDOWS\System32\hmhuvwju.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hmrezmtw]
C:\WINDOWS\System32\hmrezmtw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hynupatw]
C:\WINDOWS\System32\hynupatw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\inqrqnal]
C:\WINDOWS\System32\inqrqnal.exe

system · 2007-06-24T06:53:19.000Z

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ivybmvmb]
C:\WINDOWS\System32\ivybmvmb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ixevgdoz]
C:\WINDOWS\System32\ixevgdoz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\j3241731]
rundll32 C:\WINDOWS\System32\j3241731.dll sook

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jgfunafq]
C:\WINDOWS\System32\jgfunafq.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jizkjcnw]
C:\WINDOWS\System32\jizkjcnw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jqlwdojk]
C:\WINDOWS\System32\jqlwdojk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jqpwvgjs]
C:\WINDOWS\System32\jqpwvgjs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jsnoxiza]
C:\WINDOWS\System32\jsnoxiza.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\jyhadqly]
C:\WINDOWS\System32\jyhadqly.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\kbglanyj]
C:\WINDOWS\System32\kbglanyj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\khofengf]
C:\WINDOWS\System32\khofengf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\knwlalqt]
C:\WINDOWS\System32\knwlalqt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lcfidcns]
C:\WINDOWS\System32\lcfidcns.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lmjsjuni]
C:\WINDOWS\System32\lmjsjuni.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mbypqbej]
C:\WINDOWS\System32\mbypqbej.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfalmjaf]
C:\WINDOWS\System32\mfalmjaf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mfizgtez]
C:\WINDOWS\System32\mfizgtez.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mhijmvqd]
C:\WINDOWS\System32\mhijmvqd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mhoxwdyv]
C:\WINDOWS\System32\mhoxwdyv.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mlqvgzgb]
C:\WINDOWS\System32\mlqvgzgb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mzsxszwd]
C:\WINDOWS\System32\mzsxszwd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nebyzkdm.exe]
C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nydqjapo]
C:\WINDOWS\System32\nydqjapo.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\obspotal]
C:\WINDOWS\System32\obspotal.exe

system · 2007-06-24T06:54:16.000Z

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ojmnctax]
C:\WINDOWS\System32\ojmnctax.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\olsfkdyz]
C:\WINDOWS\System32\olsfkdyz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\otwdmfin]
C:\WINDOWS\System32\otwdmfin.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ovuvadgn]
C:\WINDOWS\System32\ovuvadgn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pcxihedu]
C:\WINDOWS\System32\pcxihedu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pehcbcdy]
C:\WINDOWS\System32\pehcbcdy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pkbefaxc]
C:\WINDOWS\System32\pkbefaxc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pqnqfavi]
C:\WINDOWS\System32\pqnqfavi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pqxupqpu]
C:\WINDOWS\System32\pqxupqpu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qbclwdwp]
C:\WINDOWS\System32\qbclwdwp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qfsvajob]
C:\WINDOWS\System32\qfsvajob.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qjqnepgl]
C:\WINDOWS\System32\qjqnepgl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qjyjcdmn]
C:\WINDOWS\System32\qjyjcdmn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qtqzaxql]
C:\WINDOWS\System32\qtqzaxql.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\qxajexcf]
C:\WINDOWS\System32\qxajexcf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Rooh]
“C:\DOCUME~1\Slayer\MYDOCU~1\YMANTE~1\winlogon.exe” -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ropmzork]
C:\WINDOWS\System32\ropmzork.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rslkxgnm]
C:\WINDOWS\System32\rslkxgnm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ruvsfglg]
C:\WINDOWS\System32\ruvsfglg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sjwpufex]
C:\WINDOWS\System32\sjwpufex.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\spobozyf]
C:\WINDOWS\System32\spobozyf.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\srsxafsh]
C:\WINDOWS\System32\srsxafsh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
“C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe”

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tcjspube]
C:\WINDOWS\System32\tcjspube.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tghoboji]
C:\WINDOWS\System32\tghoboji.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tqtghkbi]
C:\WINDOWS\System32\tqtghkbi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tsbqnybm]
C:\WINDOWS\System32\tsbqnybm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tudglytw]
C:\WINDOWS\System32\tudglytw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\twpabuja]
C:\WINDOWS\System32\twpabuja.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tytunopk]
C:\WINDOWS\System32\tytunopk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tyvubivk]
C:\WINDOWS\System32\tyvubivk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\unadgpgr]
C:\WINDOWS\System32\unadgpgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uvixwxon]
C:\WINDOWS\System32\uvixwxon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uvkrujqn]
C:\WINDOWS\System32\uvkrujqn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vabgbkxs]
C:\WINDOWS\System32\vabgbkxs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vcdqnexq]
C:\WINDOWS\System32\vcdqnexq.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vcjurepe]
C:\WINDOWS\System32\vcjurepe.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]
“C:\Veoh\VeohClient.exe” /VeohHide

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\vofuxspa]
C:\WINDOWS\System32\vofuxspa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\volmlkjy]
C:\WINDOWS\System32\volmlkjy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wnkvazyp]
C:\WINDOWS\System32\wnkvazyp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\wvuxqbkl]
C:\WINDOWS\System32\wvuxqbkl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xmjmjcri]
C:\WINDOWS\System32\xmjmjcri.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xspotslk]
C:\WINDOWS\System32\xspotslk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xulalydm]
C:\WINDOWS\System32\xulalydm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ylkryzqn]
C:\WINDOWS\System32\ylkryzqn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ylqzmjaz]
C:\WINDOWS\System32\ylqzmjaz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ypelyvch]
C:\WINDOWS\System32\ypelyvch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\yrqpulih]
C:\WINDOWS\System32\yrqpulih.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ytepqhcp]
C:\WINDOWS\System32\ytepqhcp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\yzytwxqt]
C:\WINDOWS\System32\yzytwxqt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zgjivwtc]
C:\WINDOWS\System32\zgjivwtc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zozgzcnm]
C:\WINDOWS\System32\zozgzcnm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zsvuruly]
C:\WINDOWS\System32\zsvuruly.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zwpiduzg]
C:\WINDOWS\System32\zwpiduzg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zybiloxk]
C:\WINDOWS\System32\zybiloxk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
“NVSvc”=2 (0x2)
“AppServer9PE”=2 (0x2)

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-24 02:07:01
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\AppServer9PE]
“ImagePath”=“C:\Sun\SDK 2\lib\appservService.exe "\“C:\Sun\SDK 2\bin\asadmin.bat\” start-domain --user passpass domain1" "\“C:\Sun\SDK 2\bin\asadmin.bat\” stop-domain domain1\”"

Completion time: 2007-06-24 2:09:00 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-06-24 02:08

--- E O F ---

system · 2007-06-24T06:54:49.000Z

Logfile of HijackThis v1.99.1
Scan saved at 2:17:37 AM, on 6/24/2007
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\System32\xdknteve.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = wmplayer.exe
O2 - BHO: (no name) - {18C7DC10-D544-4398-8B09-7477CAAA896b} - C:\WINDOWS\System32\cgdncaox.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM..\Run: [nwiz] nwiz.exe /install
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file)
O20 - Winlogon Notify: winkcv32 - winkcv32.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: DomainService - - C:\WINDOWS\System32\xdknteve.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

system · 2007-06-24T06:58:37.000Z

Wow - at least your HJT log is short.

Comodo Firewall has been working well for me. PC Tools Firewall and Zone Alarm are also good, and all 3 are free. Here’s a link to a Comodo download

http://filehippo.com/download_comodo/

Get one of the firewalls installed, then run a thorough scan with either AVG AntiSpyware or SuperAntiSpyware and post that log. I will review things in the morning.

system · 2007-06-24T07:10:01.000Z

One more thing. Upload these files to Virus Total for analysis and post the results

C:\WINDOWS\system32\cgdncaox.dll

C:\WINDOWS\System32\xdknteve.exe

system · 2007-06-24T07:14:44.000Z

I, too, must turn in, it is 3:13am here, but I will post the avg log asap. thank you for all of your help.

alert users of this forum to never go to seriall.com to find serial codes to games. (i only misplaced mine) i believe this website to be the root of my problems.

Lisandro · 2007-06-24T13:24:21.000Z

Cracking is closely related to pornography and these two with malware.
Safe browsing is not that close with these activities.

system · 2007-06-24T13:48:55.000Z

Essexboy has kindly offered to write a registry fix. It will be posted shortly.

essexboy · 2007-06-24T14:33:27.000Z

Please download the OTMoveIt http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe by OldTimer.
Save it to your desktop.
Please double-click OTMoveIt.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\system32\jbscyogw.exe
C:\WINDOWS\system32\ggf.exe
C:\WINDOWS\system32\gutfclrd.exe
C:\DOCUME~1\Slayer\xdkntevekill.bat
C:\WINDOWS\system32\xdknteve.exe
C:\WINDOWS\system32\cgdncaox.dll
C:\WINDOWS\system32\msgemkdu.dll
C:\WINDOWS\system32\sxbwslgv.exe
C:\WINDOWS\System32\cgdncaox.dll
C:\WINDOWS\System32\pobohgdk.dll
C:\WINDOWS\System32\arwlapwl.exe
C:\WINDOWS\System32\bgjcpcji.exe
C:\WINDOWS\System32\bmbqpkvy.exe
C:\WINDOWS\System32\cbqzidut.exe
C:\WINDOWS\System32\dkvwdapk.exe
C:\WINDOWS\System32\dkzelohy.exe
C:\WINDOWS\System32\dmjkdazs.exe
C:\WINDOWS\System32\dmzqrely.exe
C:\WINDOWS\System32\dybenetq.exe
C:\WINDOWS\System32\ebezizsn.exe
C:\WINDOWS\System32\epyngpar.exe
C:\WINDOWS\System32\eviholov.exe
C:\WINDOWS\System32\ezodefqf.exe
C:\WINDOWS\System32\fklcrqdm.exe
C:\WINDOWS\System32\fonyrgtk.exe
C:\WINDOWS\System32\fsjujszm.exe
C:\WINDOWS\System32\fuxqpchc.exe
C:\WINDOWS\System32\ulhrysdx.dll
C:\WINDOWS\System32\gpuzqrsn.exe
C:\WINDOWS\System32\gtabetsp.exe
C:\WINDOWS\System32\hmhuvwju.exe
C:\WINDOWS\System32\hmrezmtw.exe
C:\WINDOWS\System32\hynupatw.exe
C:\WINDOWS\System32\inqrqnal.exe
C:\WINDOWS\System32\ivybmvmb.exe
C:\WINDOWS\System32\ixevgdoz.exe
C:\WINDOWS\System32\j3241731.dll
C:\WINDOWS\System32\jgfunafq.exe
C:\WINDOWS\System32\jizkjcnw.exe
C:\WINDOWS\System32\jqlwdojk.exe
C:\WINDOWS\System32\jqpwvgjs.exe
C:\WINDOWS\System32\jsnoxiza.exe
C:\WINDOWS\System32\jyhadqly.exe
C:\WINDOWS\System32\kbglanyj.exe
C:\WINDOWS\System32\khofengf.exe
C:\WINDOWS\System32\knwlalqt.exe
C:\WINDOWS\System32\lcfidcns.exe
C:\WINDOWS\System32\lmjsjuni.exe
C:\WINDOWS\System32\mbypqbej.exe
C:\WINDOWS\System32\mfalmjaf.exe
C:\WINDOWS\System32\mfizgtez.exe
C:\WINDOWS\System32\mhijmvqd.exe
C:\WINDOWS\System32\mhoxwdyv.exe
C:\WINDOWS\System32\mlqvgzgb.exe
C:\WINDOWS\System32\mzsxszwd.exe
C:\Documents and Settings\All Users\Application Data\nebyzkdm.exe
C:\WINDOWS\System32\nydqjapo.exe
C:\WINDOWS\System32\obspotal.exe
C:\WINDOWS\System32\ojmnctax.exe
C:\WINDOWS\System32\olsfkdyz.exe
C:\WINDOWS\System32\otwdmfin.exe
C:\WINDOWS\System32\ovuvadgn.exe
C:\WINDOWS\System32\pcxihedu.exe
C:\WINDOWS\System32\pehcbcdy.exe
C:\WINDOWS\System32\pkbefaxc.exe
C:\WINDOWS\System32\pqnqfavi.exe
C:\WINDOWS\System32\pqxupqpu.exe
C:\WINDOWS\System32\qbclwdwp.exe
C:\WINDOWS\System32\qfsvajob.exe
C:\WINDOWS\System32\qjqnepgl.exe
C:\WINDOWS\System32\qjyjcdmn.exe
C:\WINDOWS\System32\qtqzaxql.exe
C:\WINDOWS\System32\qxajexcf.exe
C:\DOCUME~1\Slayer\MYDOCU~1\YMANTE~1
C:\WINDOWS\System32\ropmzork.exe
C:\WINDOWS\System32\rslkxgnm.exe
C:\WINDOWS\retadpu1000272.exe 61A847B5BBF72813329B385475FB01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
C:\WINDOWS\System32\ruvsfglg.exe
C:\WINDOWS\System32\sjwpufex.exe
C:\WINDOWS\System32\spobozyf.exe
C:\WINDOWS\System32\srsxafsh.exe
C:\WINDOWS\System32\tcjspube.exe
C:\WINDOWS\System32\tghoboji.exe
C:\WINDOWS\System32\tqtghkbi.exe
C:\WINDOWS\System32\tsbqnybm.exe
C:\WINDOWS\System32\tudglytw.exe
C:\WINDOWS\System32\twpabuja.exe
C:\WINDOWS\System32\tytunopk.exe
C:\WINDOWS\System32\tyvubivk.exe
C:\WINDOWS\System32\unadgpgr.exe
C:\WINDOWS\System32\uvixwxon.exe
C:\WINDOWS\System32\uvkrujqn.exe
C:\WINDOWS\System32\wnkvazyp.exe
C:\WINDOWS\System32\wvuxqbkl.exe
C:\WINDOWS\System32\xmjmjcri.exe
C:\WINDOWS\System32\xspotslk.exe
C:\WINDOWS\System32\xulalydm.exe
C:\WINDOWS\System32\ylkryzqn.exe
C:\WINDOWS\System32\ylqzmjaz.exe
C:\WINDOWS\System32\ypelyvch.exe
C:\WINDOWS\System32\yrqpulih.exe
C:\WINDOWS\System32\ytepqhcp.exe
C:\WINDOWS\System32\zgjivwtc.exe
C:\WINDOWS\System32\zozgzcnm.exe
C:\WINDOWS\System32\zsvuruly.exe
C:\WINDOWS\System32\zwpiduzg.exe
C:\WINDOWS\System32\zybiloxk.exe

Return to OTMoveIt, right click on the “Paste List of Files/Folders to be moved” window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Microsoft files should then be back in the majority ;D

essexboy · 2007-06-24T14:36:52.000Z

Please download ERUNT from here and back up your entire registry http://www.snapfiles.com/get/erunt.html

Having done that then please apply the registry fix below

REGISTRY FIX

REGEDIT4
[-HKEY_CLASSES_ROOT\CLSID{18C7DC10-D544-4398-8B09-7477CAAA896b}]

[-HKEY_LOCAL_MACHINE\Software\Classes\CLSID{18C7DC10-D544-4398-8B09-7477CAAA896b}]

[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{18C7DC10-D544-4398-8B09-7477CAAA896b}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winkcv32]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
“ApachInc”=-
“arwlapwl”=-
“bgjcpcji”=-
“bmbqpkvy”=-
“cbqzidut”=-
“dkvwdapk”=-
“dkzelohy”=-
“dmjkdazs”=-
“dmzqrely”=-
“dybenetq”=-
“ebezizsn”=-
“epyngpar”=-
“eviholov”=-
“ezodefqf”=-
“fklcrqdm”=-
“fonyrgtk”=-
“fsjujszm”=-
“fuxqpchc”=-
“GPLv3”=-
“gpuzqrsn”=-
“gtabetsp”=-
“hmhuvwju”=-
“hmrezmtw”=-
“hynupatw”=-
“inqrqnal”=-
“ivybmvmb”=-
“ixevgdoz”=-
“j3241731”=-
“jgfunafq”=-
“jizkjcnw”=-
“jqlwdojk”=-
“jqpwvgjs”=-
“jsnoxiza”=-
“jyhadqly”=-
“kbglanyj”=-
“khofengf”=-
“knwlalqt”=-
“lcfidcns”=-
“lmjsjuni”=-
“mbypqbej”=-
“mfalmjaf”=-
“mfizgtez”=-
“mhijmvqd”=-
“mhoxwdyv”=-
“mlqvgzgb”=-
“mzsxszwd”=-
“nebyzkdm.exe”=-
“nydqjapo”=-
“obspotal”=-
“ojmnctax”=-
“olsfkdyz”=-
“otwdmfin”=-
“ovuvadgn”
“pcxihedu”=-
“pehcbcdy”=-
“pkbefaxc”=-
“pqnqfavi”=-
“pqxupqpu”=-
“qbclwdwp”=-
“qfsvajob”=-
“qjqnepgl”=-
“qjyjcdmn”=-
“qtqzaxql”=-
“qxajexcf”=-
“Rooh”=-
“ropmzork”=-
“rslkxgnm”=-
“runner1”=-
“ruvsfglg”=-
“sjwpufex”=-
“spobozyf”=-
“srsxafsh”=-
“tcjspube”=-
“tghoboji”=-
“tqtghkbi”=-
“tsbqnybm”=-
“tudglytw”=-
“twpabuja”=-
“tytunopk”=-
“tyvubivk”=-
“unadgpgr”=-
“uvixwxon”=-
“uvkrujqn”=-
“wnkvazyp”=-
“wvuxqbkl”=-
“xmjmjcri”=-
“xspotslk”=-
“xulalydm”=-
“ylkryzqn”=-
“ylqzmjaz”=-
“ypelyvch”=-
“yrqpulih”=-
“ytepqhcp”=-
“yzytwxqt”=-
“zgjivwtc”=-
“zozgzcnm”=-
“zsvuruly”=-
“zwpiduzg”=-
“zybiloxk”=-

Next you will need to create the repair registry fix to do that copy and paste ALL of the above in the quote box to a notepad file. Ensure there is no space above the REGEDIT4.
Then in notepad go to FILE > SAVE AS and in the dropdown box select SAVE AS TYPE to ALL FILES
Then in the FILE NAME box type fix.reg
This will create a fix.reg file on your desktop
http://img127.imageshack.us/img127/433/regtg8.jpg

To use this file you will need to right click the icon and select merge, accept the warning if it appears and you are done.

Download WinPFind3u.exe to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.

[*]Close ALL OTHER PROGRAMS.
[*]Open the WinPFind3u folder and double-click on WinPFind3U.exe to start the program.
[*]Now click the Run Scan button on the toolbar.
[*]Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. If, after posting, the last line is not < End of Report > then the log is too big to fit into a single post and you will need to split it into multiple posts.

essexboy · 2007-06-24T14:38:39.000Z

I require the winpfind to destroy the other hidden elements not detected by combofix

system · 2007-06-24T14:51:40.000Z

Ta essexboy.

@Tom2Die - if you haven’t already done the AVG AS scan discussed on page 1 you can skip that for now. Give priority to Essexboy’s instructions.

system · 2007-06-24T18:54:04.000Z

I scanned with AVG - 109 ‘traces’ - but it wont let me make a log. the button is unavailable. It did tell me xdknteve.exe was bad and quarantined it for me when i tried to end it using the Analysis tab.

essexboy · 2007-06-24T22:01:39.000Z

Hi Tom2Die follow my instructions re OTMoveit and the registry fix and follow that up with with the Winpfind.
You are so badly infected that until we nuke the base files not a lot is going to go right

No more cracks please otherwise you will never be clean

system · 2007-06-24T22:52:20.000Z

Complete scanning result of “xdknteve.exe”, received in VirusTotal at 06.24.2007, 20:58:10 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.21.1 06.22.2007 Win-Trojan/Xema.variant
AntiVir 7.4.0.34 06.24.2007 TR/Agent.aoy.1
Authentium 4.93.8 06.22.2007 no virus found
Avast 4.7.997.0 06.24.2007 no virus found
AVG 7.5.0.476 06.24.2007 Generic5.CF
BitDefender 7.2 06.24.2007 Trojan.Fotomoto.A
CAT-QuickHeal 9.00 06.23.2007 Trojan.Agent.aoy
ClamAV devel-20070416 06.24.2007 Trojan.Agent-4880
DrWeb 4.33 06.24.2007 Trojan.EzulaAd
eSafe 7.0.15.0 06.24.2007 no virus found
eTrust-Vet 30.8.3736 06.22.2007 no virus found
Ewido 4.0 06.24.2007 Trojan.Agent.aoy
FileAdvisor 1 06.24.2007 no virus found
Fortinet 2.91.0.0 06.24.2007 no virus found
F-Prot 4.3.2.48 06.22.2007 no virus found
F-Secure 6.70.13030.0 06.22.2007 Trojan.Win32.Agent.aoy
Ikarus T3.1.1.8 06.24.2007 Trojan.Win32.Agent.aoy
Kaspersky 4.0.2.24 06.24.2007 Trojan.Win32.Agent.aoy
McAfee 5059 06.22.2007 no virus found
Microsoft 1.2701 06.23.2007 Trojan:Win32/Fotomoto.gen!A
NOD32v2 2349 06.23.2007 no virus found
Norman 5.80.02 06.22.2007 W32/Agent.BSOF
Panda 9.0.0.4 06.24.2007 Trj/Downloader.OZB
Sophos 4.19.0 06.22.2007 no virus found
Sunbelt 2.2.907.0 06.21.2007 no virus found
Symantec 10 06.24.2007 Trojan.Vundo
TheHacker 6.1.6.137 06.22.2007 Trojan/Agent.aoy
VBA32 3.12.0.2 06.23.2007 Trojan.Win32.Agent.aoy
VirusBuster 4.3.23:9 06.24.2007 no virus found
Webwasher-Gateway 6.0.1 06.22.2007 Trojan.Agent.aoy.1

Aditional Information
File size: 122900 bytes
MD5: 23819fc93b5dcbf55f1b809e82e4743e
SHA1: 3a4aad3692cf0406eb07a08bc2f3bef791aed334

Complete scanning result of “cgdncaox.dll”, received in VirusTotal at 06.24.2007, 21:04:52 (CET).

Antivirus Version Update Result
AhnLab-V3 2007.6.21.1 06.22.2007 no virus found
AntiVir 7.4.0.34 06.24.2007 TR/Dldr.ConHook.Gen
Authentium 4.93.8 06.22.2007 no virus found
Avast 4.7.997.0 06.24.2007 no virus found
AVG 7.5.0.476 06.24.2007 no virus found
BitDefender 7.2 06.24.2007 Trojan.BHO.AR
CAT-QuickHeal 9.00 06.23.2007 no virus found
ClamAV devel-20070416 06.24.2007 no virus found
DrWeb 4.33 06.24.2007 no virus found
eSafe 7.0.15.0 06.24.2007 Suspicious Trojan/Worm
eTrust-Vet 30.8.3736 06.22.2007 no virus found
Ewido 4.0 06.24.2007 no virus found
FileAdvisor 1 06.24.2007 no virus found
Fortinet 2.91.0.0 06.24.2007 no virus found
F-Prot 4.3.2.48 06.22.2007 no virus found
F-Secure 6.70.13030.0 06.22.2007 Packed.Win32.Morphine.a
Ikarus T3.1.1.8 06.24.2007 MalwareScope.Trojan-Spy.BZub.1
Kaspersky 4.0.2.24 06.24.2007 Packed.Win32.Morphine.a
McAfee 5059 06.22.2007 no virus found
Microsoft 1.2701 06.23.2007 VirTool:Win32/Obfuscator.E
NOD32v2 2349 06.23.2007 probably a variant of Win32/Adware.BHO.V
Norman 5.80.02 06.22.2007 W32/BHO.QG
Panda 9.0.0.4 06.24.2007 Suspicious file
Sophos 4.19.0 06.22.2007 Mal/BHO-C
Sunbelt 2.2.907.0 06.21.2007 no virus found
Symantec 10 06.24.2007 no virus found
TheHacker 6.1.6.137 06.22.2007 Trojan/Morphine.a
VBA32 3.12.0.2 06.23.2007 Adware.Crew
VirusBuster 4.3.23:9 06.24.2007 no virus found
Webwasher-Gateway 6.0.1 06.22.2007 Trojan.Dldr.ConHook.Gen

Aditional Information
File size: 125972 bytes
MD5: 6807bb03664f055d6a09966e819bb76f
SHA1: 47924b97d472cfd129d68711969ac2b6754b1198
packers: MORPHINE
packers: Morphine

Lisandro · 2007-06-24T23:01:19.000Z

Tom2Die post:24:

Complete scanning result of “xdknteve.exe”, received in VirusTotal at 06.24.2007, 20:58:10 (CET).
Complete scanning result of “cgdncaox.dll”, received in VirusTotal at 06.24.2007, 21:04:52 (CET).

I won’t have that much doubts about the infection of these two files.
I hope avast improve detection. :-\

system · 2007-06-24T23:55:10.000Z

In addition to the files essexboy posted to be removed by OTMoveIt, add these two files to the list

C:\WINDOWS\system32\cgdncaox.dll
C:\WINDOWS\System32\xdknteve.exe

You can do this by appending them to the bottom of the list and doing a single run with OTMoveIt, or you can do a separate run with just these two files if its easier.

system · 2007-06-25T01:47:21.000Z

I’m an idiot. I had trouble reading the forum because I was too stupid to realize that there were two pages… But i suppose I’m not the first one to do that huh. I will follow your advice and check to see if it works. I will post results. Thank you all for your help. If you do want to see the actual log of the AVG scan, somebody will have to tell me how to activate the ‘Create Log’ command button. It won’t work.

Announcements