Win32:BHO-KD [Trj] is reoccuring and cannot be deleted

system · January 28, 2008, 1:16am

PLEASE HELP!!! I looked up other posts regarding this problem but everyone started with a HJT Log. I have no idea what that is or how to attain it. I only have the log from booting. I’m really new at this, please be patient with me. Thanks.

All infected files were deleted except this: File C:\WINDOWS\SYSTEM32\dcyxloc.dll[UPX] is infected by Win32:BHO-KD [trj], Delete: Error 0xC0000022 {Access Denied}

Full Log:

01/27/2008 18:23
Scan of all local drives
File C:\Documents and Settings\Kittie\Local Settings\Temp\gzaqvwnd.sys is infected by Win32:Delf-FNP [trj], Deleted
File C:\Documents and Settings\Kittie\Local Settings\Temp\ltohccdj.exe is infected by Win32:Trojan-gen {Other}, Deleted
File C:\Documents and Settings\Kittie\Local Settings\Temp\sch16.dll is infected by Win32:Delf-GKL [trj], Deleted
File C:\Documents and Settings\Kittie\Local Settings\Temp_avast4_\unp205088679.tmp is infected by Win32:BHO-KD [trj], Deleted
File C:\do_work\sawjeeha.exe is infected by Win32:Trojano-1165 [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX][UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].2[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].3[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].4[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].5[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].6[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].7[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].8[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\Program Files\Alwil Software\Avast4\DATA\moved[UPX].9[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\System Volume Information_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP13\A0000813.exe is infected by Win32:Trojano-1165 [trj], Deleted
File C:\WINDOWS\SYSTEM32\aaoqlaim.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\afbglgnp.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\afqecdti.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ahfyrfdr.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\aifcqmvu.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\akcrcqdv.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\alrsv.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\amqeoibh.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\amstrea.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\apndptre.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\apxywpmh.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\asycfil.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\asycfils.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\atfjquhe.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\aujvnmtb.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\aykyyxrw.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bcmsrydl.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bebapydd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\benadphy.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bghwqmdj.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\bhlfgvrj.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bingukdi.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\bjfywqov.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\bkseimbi.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\blogrwlf.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bousnacn.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\bqdiatqe.dll is infected by Win32:Klone-CJ [trj], Deleted
File C:\WINDOWS\SYSTEM32\brxlwplb.dll is infected by Win32:BHO-AP [trj], Deleted
File C:\WINDOWS\SYSTEM32\btmnorde.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\btrrxvkp.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bwcdebav.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\bwnfmxmd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\bxgrkthi.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\bxrggrav.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\bycibpuw.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\byrlfmeu.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\caouuldh.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\ccfbirbd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\chefstsh.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\cinxuauu.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ckqdxepr.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\cogvuykj.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\csdssmdw.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ctnnlaid.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\cwkkkfpn.dll is infected by Win32:Morphine-G [trj], Deleted
File C:\WINDOWS\SYSTEM32\cyiiqlqb.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\daccayiv.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\dbmsrpc.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.1 is infected by Win32:Delf-HWF [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.2 is infected by Win32:Delf-HWF [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.3 is infected by Win32:BHO-ID [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.4 is infected by Win32:Agent-MVI [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.5 is infected by Win32:BHO-LT [Adw], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.6 is infected by Win32:BHO-JS [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.7 is infected by Win32:Agent-OUX [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.8[UPX] is infected by Win32:BHO-KD [trj], Deleted
File C:\WINDOWS\SYSTEM32\dcyxloc.dll[UPX] is infected by Win32:BHO-KD [trj], Delete: Error 0xC0000022 {Access Denied}, Delete: Error 0xC0000022 {Access Denied}, Delete: Error 0xC0000022 {Access Denied}, Delete: Error 0xC0000022 {Access Denied}, Delete: Error 0xC0000022 {Access Denied}, Move: Error 0xC0000022 {Access Denied}, Repair: Error 42060 {The file was not repaired.}, Move to chest: Error 0xC0000022 {Access Denied}

system · January 28, 2008, 1:18am

LOG CONTINUED:

File C:\WINDOWS\SYSTEM32\dcyxloce.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\djcfjqcq.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\dlkmsbs.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\dlkmsbsc.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\dmuti.dll is infected by Win32:BHO-HY [trj], Deleted
File C:\WINDOWS\SYSTEM32\dosimlsk.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\dphdbesu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\DRIVERS\wterazjq.sys is infected by Win32:Agent-MEU [Rtk], Deleted
File C:\WINDOWS\SYSTEM32\drmomavo.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\dufjibge.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\dxadvlqu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\effcbndu.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\efsgnacr.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ehjsjano.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\eihytups.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ejsklobf.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\eksdcnph.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\emwxevcp.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\enepoiso.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\eqfbvqbl.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\erjyrass.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\erwnquot.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\esflpxyw.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\espayxoo.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\etdjlqee.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\etojorvw.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\eufvqywd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\evvvdtei.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\exjuqkbu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\famhnceu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\fbwcrxbc.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\fbwoqvyo.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\fcvxbeyi.exe is infected by Win32:Agent-LML [trj], Deleted
File C:\WINDOWS\SYSTEM32\ffkwsbrw.dll is infected by Win32:Klone-BL [trj], Deleted
File C:\WINDOWS\SYSTEM32\fhcvcgln.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\fjcbspfd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\fmextoxw.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\fopgbyux.dll is infected by Win32:Morphine-G [trj], Deleted
File C:\WINDOWS\SYSTEM32\fqvdtdrc.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\frcsytxl.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\fsckwopg.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\fvwlequn.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\fxfwvven.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\fxlcdfdg.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\galcfenk.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gayaenpw.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gayxdqqg.dll is infected by Win32:Klone-BS [trj], Deleted
File C:\WINDOWS\SYSTEM32\gcadwhwa.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\gdcsirfk.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gdpwwidr.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gelmimnw.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\gemsedsg.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\gljfrrgo.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\gnxniwxv.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\gpaqmggg.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\gpvjwfqt.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gqfghgbb.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\gsdmsliy.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\gugulinn.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\gwfxfvdf.dll is infected by Win32:Klone-BL [trj], Deleted

system · January 28, 2008, 1:20am

CONTINUED:

File C:\WINDOWS\SYSTEM32\gwtvthcf.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hameeqtd.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\hbwdhter.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hepjtnkl.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\hfqyynrd.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\hhhxmikt.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hhwexobe.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hisrniha.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\hkpvtcvw.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\hlpdxydo.exe is infected by Win32:Agent-LML [trj], Deleted
File C:\WINDOWS\SYSTEM32\hmykivii.dll is infected by Win32:Klone-CH [trj], Deleted
File C:\WINDOWS\SYSTEM32\hpibufow.exe is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hremuken.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\hsbjqqhy.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\hxcytrlx.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\hxfacgpn.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\hxmnjpak.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\hykejjiw.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\icmwimys.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\iflpedow.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\igubursu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\iitkomey.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\iltrgsnh.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\inpixbfy.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ioieqydn.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ipxooqpv.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\irlbymmo.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\irxwbggc.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\isciqgmh.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ixjwvrrw.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\jagumsfv.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\jcpuypec.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\jglpgosu.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\jgstghjj.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\jhrywslp.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\jjqiffey.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\jladccsv.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\jlfdrshn.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\jneytovn.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\jofiqdiy.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\joubxslg.exe is infected by Win32:Agent-LML [trj], Deleted
File C:\WINDOWS\SYSTEM32\joujdoye.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\jtukdrsg.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\juhfnvbc.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\jwnwyofs.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\jxvoxaot.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\kadgcmkc.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\kaljwyiq.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\kbnpaafb.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\kcxufiuw.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\khwwckjg.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\klipogtt.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\kmeqyydp.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\kovihjev.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ksmdrklc.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\kujfnpbw.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\kvyfefcl.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lacyqfkl.dll is infected by Win32:Klone-BK [trj], Deleted
File C:\WINDOWS\SYSTEM32\ldapmkgn.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\lehwkvdm.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\leilpdeh.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\leuekteq.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\lftbixib.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lgmxxwwx.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ljylhlek.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\lkwnvvjf.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\llkwlxlt.dll is infected by Win32:BHO-AC [trj], Deleted
File C:\WINDOWS\SYSTEM32\lolhalbl.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lrahgudr.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\lsvjxofd.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ltfmagwc.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\luymyren.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lvucsvot.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lwfdisye.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\lwumfiyf.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\mbdkcare.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\megprbfe.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\mftbbovs.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\mgdlreyt.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\mgsuquqf.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\mgxcdyhi.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\mhwxkqud.dll is infected by Win32:BHO-BG [trj], Deleted
File C:\WINDOWS\SYSTEM32\mmfbsgrq.exe is infected by Win32:Agent-LAP [trj], Deleted

system · January 28, 2008, 1:20am

CONTINUED:

File C:\WINDOWS\SYSTEM32\mnqwiayg.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\mubuilmg.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\muqvbqvk.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\muvcdpmm.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\mxaxngcl.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\nbpmfsaj.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\nceoullh.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\nchmfkvh.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ndetucny.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\neyktprq.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\nfhquogj.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\nfouyghq.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\nhhasjne.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\nkpyuqmc.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\nxaybihv.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\nyrvkwvn.dll is infected by Win32:Klone-BS [trj], Deleted
File C:\WINDOWS\SYSTEM32\oakobcvn.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\obssbxxa.dll is infected by Win32:Klone-BS [trj], Deleted
File C:\WINDOWS\SYSTEM32\ocvteogr.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\ocvvayfl.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\odrccqlm.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\oeaccjip.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\oeqpvbtg.dll is infected by Win32:Klone-CH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ofdhdjfd.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ofgyguat.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ogheplco.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ohrejkmt.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ohtltyca.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\ojdrdnht.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ojpnwgvy.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ojpynfik.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\olrvqjpk.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\onaetwlk.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\ookscynl.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\oolkdhlb.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\orvihtkp.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\orypnaol.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ovvjhmye.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\owniksud.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\owotyjru.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\paofukpn.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\pcnwjvjv.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\peesgwmo.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\pelkuhls.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\pemxmpfb.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\phmmuout.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\phosgpgo.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\pjnrhgku.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\pogkdmfr.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\poneupmr.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\pqluoens.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\pqvounru.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\prfgtajf.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ptjevkde.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\pvkbojir.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\pwfnpsui.dll is infected by Win32:Klone-CF [trj], Deleted
File C:\WINDOWS\SYSTEM32\pwqnqqep.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\pxyjxgra.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\qcrrhbmj.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\qcymxifd.dll is infected by Win32:Klone-BJ [trj], Deleted
File C:\WINDOWS\SYSTEM32\qeawmeew.dll is infected by Win32:Adware-gen [Adw], Deleted

system · January 28, 2008, 1:21am

CONTINUED:

File C:\WINDOWS\SYSTEM32\qebansut.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qekmauxt.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\qfnvoams.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qftobuku.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qfwxuagn.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qhgsuaec.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\qhlcgoea.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qhuktslt.exe is infected by Win32:Zlob-ZL [trj], Deleted
File C:\WINDOWS\SYSTEM32\qjbvsvmx.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\qknxombe.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qkwggthi.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qllpfpdq.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qlrbaknb.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\qlrlnbqw.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qlsdamxs.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qnfoxmak.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qohgxtjn.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\qojhwbti.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\qqghwjlt.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qqifmrky.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qqjjadfk.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\qsqbakos.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qufxcehk.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\quxlgrhl.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\qxchympf.dll is infected by Win32:AgoBot-CL [trj], Deleted
File C:\WINDOWS\SYSTEM32\qyfyfowo.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\rbvbmmqh.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\rckgionl.dll is infected by Win32:Klone-BJ [trj], Deleted
File C:\WINDOWS\SYSTEM32\redbqrvh.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\rggmvqus.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\rgjgsgki.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\rhjspbuh.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\rjgxelbf.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\rmxvrlhe.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\roglxaad.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\royltxsq.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\rphdkave.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\rqtasmyf.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\rshjthgb.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\ruagkvyq.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\rvysseue.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\rweecbkn.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\rwscvvvm.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\sapmfddv.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\sbblqtvq.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sbhlcedi.dll is infected by Win32:Klone-BK [trj], Deleted
File C:\WINDOWS\SYSTEM32\sdkfeyuj.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\sexxtwbk.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sglswlvk.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\sikcskyd.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\silanmdl.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sjlnjxfp.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sjlteyly.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sjomxjnh.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\sjwkqiyr.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\smfsxlea.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\snwblbrw.exe is infected by Win32:Searchcolor [Adw], Deleted
File C:\WINDOWS\SYSTEM32\sobnvrum.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\spmqehbt.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ssjadbya.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\stjsevgv.exe is infected by Win32:Agent-LAP [trj], Deleted

system · January 28, 2008, 1:21am

File C:\WINDOWS\SYSTEM32\sttgrxty.dll is infected by Win32:Klone-CJ [trj], Deleted
File C:\WINDOWS\SYSTEM32\sweqhdjo.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\sydvgylg.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\taurbjrb.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\tccjxteb.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\tcrnrexg.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tdikdclu.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\tdqnxsfj.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tdropptj.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tedyrxet.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tehvbops.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\tepuhfje.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tfbvpnyg.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\tfqaudnr.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\tgufubdl.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\tpgchvke.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\tqkpnupu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\tqlpamym.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\tvnpyren.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\txeldsus.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\uatosuii.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\uhdaelgm.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ujqxxqln.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ulsxkpkk.exe is infected by Win32:Agent-LML [trj], Deleted
File C:\WINDOWS\SYSTEM32\umyevbrh.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\unupidla.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\uyodmcqb.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\vckjuqpo.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\vdneyywc.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\vdxnahax.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\vejwtobv.dll is infected by Win32:Klone-BQ [trj], Deleted
File C:\WINDOWS\SYSTEM32\vgwnnqsf.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\vifuqnpo.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\vipcnxuq.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\vjltsxmv.exe is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\vkovoqeq.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\vokuwgno.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\vpadiglh.dll is infected by Win32:Klone-BU [trj], Deleted
File C:\WINDOWS\SYSTEM32\vpybmhnw.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\vqrlesax.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\vrkykesf.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\vsvcarcu.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\vubglyft.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\vyctpgqb.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\wbbdxdyb.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\wdvlfaig.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\wetwusek.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\wfmjxpyj.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\whuxtqed.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\wkyephre.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\wncoxsyl.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\wndpaqjl.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\wnftcgfg.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\wnxyuscb.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\wpaevoma.exe is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\wpuhudnt.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\wqrlehor.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\wviivygv.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\xaaaluqs.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\xcgqylsy.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\xesviqad.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xgsuhwco.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\xijtwpub.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xixbrmlb.dll is infected by Win32:Vundo-gen47 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xjbvdlyk.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xkyaqybk.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\xllnejlw.dll is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xmdkjxyv.dll is infected by Win32:Klone-CF [trj], Deleted
File C:\WINDOWS\SYSTEM32\xmurhevs.exe is infected by Win32:Agent-HZS [trj], Deleted
File C:\WINDOWS\SYSTEM32\xoggonpn.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xogirvje.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\xoryhjvj.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\xruxqqag.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\xsrxobwr.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\xthoyvbj.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\xuqsjbtb.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\xvkakfwr.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\xwadircr.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\ybyetnrb.exe is infected by Win32:Obfuscated-CCV [trj], Deleted
File C:\WINDOWS\SYSTEM32\ycserule.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ycuxcehq.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\yesvgvmy.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\yfmviumy.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\yfsoilew.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\yhtqlnfb.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\yisnkqkm.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ykjotobr.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ylhbsqke.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\yloxnlkg.exe[PECompact] is infected by Win32:Agent-ISI [trj], Deleted
File C:\WINDOWS\SYSTEM32\ynbnmsfx.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\ynenyhpf.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\yonwnpqo.dll is infected by Win32:Klone-BJ [trj], Deleted
File C:\WINDOWS\SYSTEM32\yqvbiyci.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\yrhvglgm.dll is infected by Win32:Trojan-gen {Other}, Deleted
File C:\WINDOWS\SYSTEM32\ysnqjnyc.dll[Morphine] is infected by Win32:Adware-gen [Adw], Deleted
File C:\WINDOWS\SYSTEM32\yuexlkas.exe is infected by Win32:Agent-LAP [trj], Deleted
File C:\WINDOWS\SYSTEM32\ywsyaqpq.dll is infected by Win32:Vundo-gen49 [Adw], Deleted
File C:\WINDOWS\SYSTEM32\yxdmcxmx.exe is infected by Win32:Agent-JOH [trj], Deleted
File C:\WINDOWS\SYSTEM32\yxiisggy.dll is infected by Win32:Vundo-gen49 [Adw], Deleted

Number of searched folders: 8232
Number of tested files: 88960
Number of infected files: 436

system · January 28, 2008, 6:13am

You’re going to need these two programs at least.

Download ComboFix from Here or Here to your Desktop.

Double click combofix.exe and follow the prompts.

When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix’s window while its running. That may cause it to stall.

Click here to download HJTsetup.exe

[*]Save HJTsetup.exe to your desktop.
[*]Doubleclick on the HJTsetup.exe icon on your desktop.
[*]By default it will install to C:\Program Files\Hijack This.
[*]Continue to click Next in the setup dialogue boxes until you get to the Select Addition Tasks dialogue.
[*]Put a check by Create a desktop icon then click Next again.
[*]Continue to follow the rest of the prompts from there.
[*]At the final dialogue box click Finish and it will launch Hijack This.
[*]Click on the Do a system scan and save a logfile button. It will scan and the log should open in notepad.
[*]Click on “Edit > Select All” then click on “Edit > Copy” to copy the entire contents of the log.
[*]Come back here to this thread and Paste the log in your next reply.
[*]DO NOT have Hijack This fix anything yet. Most of what it finds will be harmless or even required.

Run combofix first then HJT thanks

system · January 28, 2008, 3:54pm

Thank you so much for the instruction! I just ran Combofix and the Log is followed. QUESTION: why did Combofix bring back IE icon on my desktop? I use Firefox. I’ve been trying to remove IE off my computer and it wouldn’t let me. But it’s been off the map for a while. Strange to see it back again after downloading Combofix. Should I be concerned? And now I’m going to run HJT. Please wait.

ComboFix 08-01-28.2 - Kittie 2008-01-28 10:34:56.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.936.86.1033.18.201 [GMT -5:00]
Running from: C:\Documents and Settings\Kittie\Desktop\ComboFix.exe

Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\dcyxloc.dll
C:\WINDOWS\system32\drivers\wterazjq.dat
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player#SharedObjects\HE3D9K29\www.broadcaster.com
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player#SharedObjects\HE3D9K29\www.broadcaster.com\bc_video_vars.sol
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player#SharedObjects\HE3D9K29\www.inter-focus.cn
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player#SharedObjects\HE3D9K29\www.inter-focus.cn\flashad.swf\IFFLASHAD.sol
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys#www.broadcaster.com
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys#www.broadcaster.com\settings.sol
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys#www.inter-focus.cn
C:\Documents and Settings\Kittie\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys#www.inter-focus.cn\settings.sol
C:\Program Files\MyWay
C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\dcyxloc.dll
C:\WINDOWS\system32\drivers\wterazjq.dat
C:\WINDOWS\system32\mcrh.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_OMHSDDPC
-------\omhsddpc

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-28 )))))))))))))))))))))))))))))))
.

2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\SYSTEM32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\SYSTEM32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 18:30 --------- d-----w C:\Program Files\iTunes
2008-02-21 18:29 --------- d-----w C:\Program Files\iPod
2008-02-21 18:27 --------- d-----w C:\Program Files\QuickTime
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-05-08 03:14 51,592 ----a-w C:\Documents and Settings\Kittie\Application Data\GDIPFONTCACHEV1.DAT
2005-04-10 09:14 1,943,936 ----a-w C:\Program Files\pn31lous.exe
2004-12-20 01:52 4,032,512 ----a-w C:\Program Files\msgrplus.exe
2004-11-24 02:38 7,071,334 ----a-w C:\Program Files\vlc-0.8.1-win32.exe
2004-11-24 02:19 2,376,448 ----a-w C:\Program Files\Cdivx.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{301DEC3E-BEA4-4166-863F-4A9D6020B5Db}]
C:\WINDOWS\system32\rxlycdhp.dll

[HKEY_LOCAL_MACHINE~\Browser Helper Objects{B6F5B5F7-A020-4FCA-858F-7CE0C85DE59D}]
C:\WINDOWS\Microsoft.NET\odsxep.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 02:56 15360]
“Aim6”=“”
“OfotoNow USB Detection”=“C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL” [2002-11-05 09:32 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SunJavaUpdateSched”=“C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe” [2003-11-19 17:48 32881]
“DVDLauncher”=“C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe” [2004-04-11 11:43 53248]
“PCMService”=“C:\Program Files\Dell\Media Experience\PCMService.exe” [2004-04-11 20:15 290816]
“dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-15 01:04 122933]
“UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 01:01 110592]
“DwlClient”=“c:\Program Files\Common Files\Dell\EUSW\Support.exe” [2004-05-27 20:05 323584]
“igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” [2005-09-20 09:35 94208]
“igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” [2005-09-20 09:32 77824]
“igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” [2005-09-20 09:36 114688]
“Acrobat Assistant 7.0”=“C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” [2004-12-14 02:12 483328]
“j5251532”=“C:\WINDOWS\system32\j5251532.dll”
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 08:00 79224]
“QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2008-01-10 15:27 385024]
“iTunesHelper”=“C:\Program Files\iTunes\iTunesHelper.exe” [2008-01-15 03:22 267048]

C:\Documents and Settings\Kittie\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-11-26 21:39:10 110592]
Shortcut to PsnLite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2004-10-15 13:26:54 2080768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\odsxep]
C:\WINDOWS\Microsoft.NET\odsxep.dll

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-03-22 18:17]

.
Contents of the ‘Scheduled Tasks’ folder
“2008-01-17 15:21:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job”

C:\Program Files\Apple Software Update\SoftwareUpdate.exe
“2004-09-26 00:31:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job”
C:\WINDOWS\System32\OOBE\OOBEBALN.EXE
“2008-02-21 18:46:12 C:\WINDOWS\Tasks\Symantec NetDetect.job”
C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-28 10:41:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RunDLL32.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
.

.
Completion time: 2008-01-28 10:44:59 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-28 15:44:56
.
2008-01-10 02:37:45 — E O F —

system · January 28, 2008, 4:02pm

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:59:15 AM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\conime.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RunDLL32.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {301DEC3E-BEA4-4166-863F-4A9D6020B5Db} - C:\WINDOWS\system32\rxlycdhp.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: (no name) - {B6F5B5F7-A020-4FCA-858F-7CE0C85DE59D} - C:\WINDOWS\Microsoft.NET\odsxep.dll (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM..\Run: [DVDLauncher] “C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe”
O4 - HKLM..\Run: [PCMService] “C:\Program Files\Dell\Media Experience\PCMService.exe”
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM..\Run: [UpdateManager] “C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” /r
O4 - HKLM..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM..\Run: [Acrobat Assistant 7.0] “C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe”
O4 - HKLM..\Run: [j5251532] rundll32 C:\WINDOWS\system32\j5251532.dll sook
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime
O4 - HKLM..\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe”
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Shortcut to PsnLite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097300065745
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68/ePlayer/2_0/ACNePlayer.cab
O20 - Winlogon Notify: odsxep - C:\WINDOWS\Microsoft.NET\odsxep.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8563 bytes

system · January 28, 2008, 5:54pm

IE is a now a part of window and required for some updates, such as some windows updates and java updates. It’s nothing to worry about, just set firefox as your default browser. The icon is just a shortcut to ie.

Please submit this file to www.virustotal .com for analysis

copy and paste this line into the submit a file box on their site, click send file and please post the results.

C:\WINDOWS\system32\j5251532.dll

Open HJT, run a system scan only, check mark these lines if present

O2 - BHO: (no name) - {301DEC3E-BEA4-4166-863F-4A9D6020B5Db} - C:\WINDOWS\system32\rxlycdhp.dll (file missing)
O2 - BHO: (no name) - {B6F5B5F7-A020-4FCA-858F-7CE0C85DE59D} - C:\WINDOWS\Microsoft.NET\odsxep.dll (file missing)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O20 - Winlogon Notify: odsxep - C:\WINDOWS\Microsoft.NET\odsxep.dll (file missing)

Close all other browsers/windows, click fix, close HJT.

There are some entries for windows messenger with missing files. If you have uninstalled windows messenger you can also fix these lines as above

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra ‘Tools’ menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)

There are still some traces of old versions of java, It can be exploited by malware, you can get the newest version here.

Open an Internet Explorer (only) window and go to http://java.sun.com/javase/downloads/index.jsp > Scroll down to “Java Runtime Environment (JRE) 6 Update 4…allows end-users to run Java applications”.

Click the download button on the right.

If Information Bar pop-ups up, right-click on it and say it’s OK to display the blocked content.

You do not have to install the Java Web Start ActiveX Control

Accept the license agreement > Click on Windows (XP,Vista, .etc) Offline Installation, Multi-language and Save the file jre-6u4-windows-i586-p.exe to your desktop; do not Run it.

When the download is complete, Open Control Panel > Add/Remove Programs:

Uninstall anything that says Sun Java, Java JRE, or similar.

Close Add/Remove Programs.

In Windows Explorer, navigate to C:\Program Files\Java <=this folder, if found. Delete any subfolders it may contain.

Do NOT delete C:\Program Files[b]JavaVM[/b] <=this folder, if found!

Reboot your computer.

Double-click on the saved file to install the update.

Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Please post the virustotal results and a new HJT log. Thanks.

system · January 29, 2008, 3:29am

Thanks maggie! I tried the virustotal.com and it didn’t work… ??? i tried sending through ssl too, didnt work. I download the uploader and the uploader doesn’t work either. i know email is the last option. but is it safe to send though email? what are some of the precautions i need to take?

this is the message i get “0 bytes size received / Se ha recibido un archivo vacio”.

i’m now gonna move on to the rest of the steps.

system · January 29, 2008, 4:20am

Here is the new HJT Log after the Java update. Thanks~!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:18:30 PM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RunDLL32.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM..\Run: [DVDLauncher] “C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe”
O4 - HKLM..\Run: [PCMService] “C:\Program Files\Dell\Media Experience\PCMService.exe”
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM..\Run: [UpdateManager] “C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” /r
O4 - HKLM..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM..\Run: [Acrobat Assistant 7.0] “C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe”
O4 - HKLM..\Run: [j5251532] rundll32 C:\WINDOWS\system32\j5251532.dll sook
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime
O4 - HKLM..\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe”
O4 - HKLM..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe”
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Shortcut to PsnLite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097300065745
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68/ePlayer/2_0/ACNePlayer.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8048 bytes

system · January 29, 2008, 5:15am

Hi. I really dislike those 0 byte files. They are usually up to no good. You did everything right when you submitted the file. A little more research on my part says it has to go.

Open HJT, run a system scan only, check mark these lines if present

O4 - HKLM..\Run: [j5251532] rundll32 C:\WINDOWS\system32\j5251532.dll sook

Close all other browsers/windows, click fix, close HJT.

Open a new Notepad session (Do not use a Word Processor or WordPad). Click “Format” and be certain that Word Wrap is not enabled.

Copy and paste all the text in the quote box below into Notepad.

Click File, Save as…, and set the location to your Desktop, and enter (including quotation marks) as the filename: “CFscript.txt” . Using your mouse left button, drag the new file CFscript.txt and drop it on the ComboFix.exe icon as shown at the bottom of this post.

File:: C:\WINDOWS\system32\j5251532.dll

This will start ComboFix again.Close all browser/windows first. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new hjt log.

system · January 29, 2008, 5:32pm

Trouble! after following all steps, cfscript was dragged to combofix, it reacted with a running meter, but nothing after that. so i doubled clicked on combix and that didn’t even run. it gave some error about .bat file not found or something. sorry i didn’t get the whole text. then i took out “File::” in the text content and dragged again. same thing. but when i double clicked on combofix, it worked this time and gave me a log. As followed:

ComboFix 08-01-28.2 - Kittie 2008-01-29 12:21:31.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.936.86.1033.18.218 [GMT -5:00]
Running from: C:\Documents and Settings\Kittie\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-28 to 2008-01-29 )))))))))))))))))))))))))))))))
.

2008-01-28 23:17 . 2007-12-14 01:59 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-01-28 23:16 . 2008-01-28 23:17 d-------- C:\Program Files\Java
2008-01-28 10:58 . 2008-01-28 10:58 d-------- C:\Program Files\Trend Micro
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\SYSTEM32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\SYSTEM32\QuickTime.qts

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 18:30 --------- d-----w C:\Program Files\iTunes
2008-02-21 18:29 --------- d-----w C:\Program Files\iPod
2008-02-21 18:27 --------- d-----w C:\Program Files\QuickTime
2007-12-04 14:56 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\SYSTEM32\AvastSS.scr
2007-11-14 07:26 450,560 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\jscript.dll
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\SYSTEM32\lsasrv.dll
2007-11-07 09:26 721,920 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\lsasrv.dll
2007-10-30 17:20 360,064 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\tcpip.sys
2007-10-30 09:55 3,065,856 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-05-08 03:14 51,592 ----a-w C:\Documents and Settings\Kittie\Application Data\GDIPFONTCACHEV1.DAT
2005-04-10 09:14 1,943,936 ----a-w C:\Program Files\pn31lous.exe
2004-12-20 01:52 4,032,512 ----a-w C:\Program Files\msgrplus.exe
2004-11-24 02:38 7,071,334 ----a-w C:\Program Files\vlc-0.8.1-win32.exe
2004-11-24 02:19 2,376,448 ----a-w C:\Program Files\Cdivx.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
Note empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 02:56 15360]
“Aim6”=“”
“OfotoNow USB Detection”=“C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL” [2002-11-05 09:32 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“DVDLauncher”=“C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe” [2004-04-11 11:43 53248]
“PCMService”=“C:\Program Files\Dell\Media Experience\PCMService.exe” [2004-04-11 20:15 290816]
“dla”=“C:\WINDOWS\system32\dla\tfswctrl.exe” [2004-03-15 01:04 122933]
“UpdateManager”=“C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” [2003-08-19 01:01 110592]
“DwlClient”=“c:\Program Files\Common Files\Dell\EUSW\Support.exe” [2004-05-27 20:05 323584]
“igfxtray”=“C:\WINDOWS\system32\igfxtray.exe” [2005-09-20 09:35 94208]
“igfxhkcmd”=“C:\WINDOWS\system32\hkcmd.exe” [2005-09-20 09:32 77824]
“igfxpers”=“C:\WINDOWS\system32\igfxpers.exe” [2005-09-20 09:36 114688]
“Acrobat Assistant 7.0”=“C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe” [2004-12-14 02:12 483328]
“avast!”=“C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe” [2007-12-04 08:00 79224]
“QuickTime Task”=“C:\Program Files\QuickTime\QTTask.exe” [2008-01-10 15:27 385024]
“iTunesHelper”=“C:\Program Files\iTunes\iTunesHelper.exe” [2008-01-15 03:22 267048]
“SunJavaUpdateSched”=“C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe” [2007-12-14 03:42 144784]

C:\Documents and Settings\Kittie\Start Menu\Programs\Startup
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2004-11-26 21:39:10 110592]
Shortcut to PsnLite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2004-10-15 13:26:54 2080768]

R3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);C:\WINDOWS\system32\DRIVERS\A3AB.sys [2005-03-22 18:17]

.
Contents of the ‘Scheduled Tasks’ folder
“2008-01-17 15:21:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job”

C:\Program Files\Apple Software Update\SoftwareUpdate.exe
“2004-09-26 00:31:52 C:\WINDOWS\Tasks\ISP signup reminder 1.job”
C:\WINDOWS\System32\OOBE\OOBEBALN.EXE
“2008-02-21 18:46:12 C:\WINDOWS\Tasks\Symantec NetDetect.job”
C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-29 12:24:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

.
Completion time: 2008-01-29 12:25:36
ComboFix-quarantined-files.txt 2008-01-29 17:25:13
ComboFix2.txt 2008-01-28 15:45:00
.
2008-01-10 02:37:45 — E O F —

system · January 29, 2008, 5:40pm

And this is the new HJT Log. Thanks.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:39:28 PM, on 1/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\Dell\Support\Alert\bin\NotifyAlert.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
C:\Program Files\3M\PSNLite\PsnLite.exe
C:\PROGRA~1\3M\PSNLite\PSNGive.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM..\Run: [DVDLauncher] “C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe”
O4 - HKLM..\Run: [PCMService] “C:\Program Files\Dell\Media Experience\PCMService.exe”
O4 - HKLM..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM..\Run: [UpdateManager] “C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe” /r
O4 - HKLM..\Run: [DwlClient] c:\Program Files\Common Files\Dell\EUSW\Support.exe
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM..\Run: [Acrobat Assistant 7.0] “C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe”
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM..\Run: [QuickTime Task] “C:\Program Files\QuickTime\QTTask.exe” -atboottime
O4 - HKLM..\Run: [iTunesHelper] “C:\Program Files\iTunes\iTunesHelper.exe”
O4 - HKLM..\Run: [SunJavaUpdateSched] “C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe”
O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU..\Run: [OfotoNow USB Detection] C:\WINDOWS\system32\RunDLL32.exe C:\PROGRA~1\Ofoto\OfotoNow\OFUSBS.DLL,WatchForConnection OfotoNow
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Shortcut to PsnLite.lnk = C:\Program Files\3M\PSNLite\PsnLite.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer{AC76BA86-1033-0000-7760-100000000002}\SC_Acrobat.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra ‘Tools’ menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra ‘Tools’ menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1097300065745
O16 - DPF: {B991DA79-51F7-4011-98D2-1F2592E82A56} (ACNPlayer2 Class) - http://209.67.146.68/ePlayer/2_0/ACNePlayer.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe

–
End of file - 8144 bytes

system · January 29, 2008, 6:30pm

Hi :

 It would be wise to get a software Firewall on your computer, since the
"Built-In" Windows One is NOT very good; I recommend you get either
 Zone Alarm, Sunbelt Kerio or Sygate. ALL are available at 
 www.filehippo.com/software/firewalls .
 Also Spybot is no longer a TOP antiSPYWARE program; would be wise
 to install & use the FREE Version of "SUPERAntiSpyware" from
 www.superantispyware.com .
 And with those IPod and Quicktime on your computer AND the recent
 News of some serious Vulnerabilities, would recommend you run the
 FREE "Software Inspector", available at
 http://secunia.com/software_inspector and follow any of its
 recommendations for "Updates" .

system · January 29, 2008, 6:34pm

And just now, as the new Java is getting activated, Trojan siren went on 3 times. Why God Why?!

system · January 29, 2008, 6:42pm

Hmm…when you saved the notepad, did you save it as “CFscript.txt” including the “” marks? and was word wrap unchecked?

The file is not running right now. Everything seem ok? We can search for the file.

In windows explorer set folder options as this

At the top of windows explorer, click tools, folder options, click the
view tab

check Show hidden files and folders
uncheck “Hide extensions for known file types” box
uncheck “Hide protecting operating system files” box

use the search function to search for C:\WINDOWS\system32\j5251532.dll in the windows folder.

Okay, what where the detections, file name and full path. You can get that infromation from the avast log viewer, warning section.

Let me know what you find.

system · January 29, 2008, 6:45pm

Hi Kittie :

 Did you remember to uninstall ALL the "Old" versions of Sun Java !?

system · January 29, 2008, 8:39pm

hi maggie, i didn’t save the quotation marks. :o oops. should i try that again then?

hi SS, thanks for the links. i have installed Sygate and super anti-spyware. the Secunia one…i didn’t understand. it scans my files from remote? sorry i didn’t have the patience to read on because all the other things i had to do. should i go ahead and uninstall Spybot then?

and as for Java…according to maggie’s instructions…i only found Java2 and i deleted it already and installed the new version…i didn’t see SunJava.

Win32:BHO-KD [Trj] is reoccuring and cannot be deleted

Announcements