Week Long Fight

X

-(Xyphox)-

Supreme [H]ardness
Joined
Sep 9, 2004
Messages
6,518
Ok before I get started, please only post use full information on how to remove this damn bug.
Background:
Well as title states. I have having major problems with a few bugs for the last week. I came across this forum searching how to remove it. I have currently Trojan.MailDrop, Trojan.dropper, and win32.sality.y running wild on my network. So for this is what I've done and i a little background on me. This is by far the most pain the *** bug I've ever seen. So last week a few customer computers started to act up, i keep getting task manager was disabled by your administrator. I ran all my usually tools. Malware Bytes, SAS, AVG, Dial-A-Fix, etc. The PCs also blue screened going into safe mode. Later i found how to fix this, but.. Back to the story. So i was like umm this must be a new bug out. So after a few days of very intense scans i gave up and just formatted and reloaded the machines. That worked great, i copied their data back and everything was fine. Until i plugged in my pen drive to install some programs back into the PC. And BOOM its infected again.
I noticed this and reloaded the machines again, and did not use the pen drive. I got theirs done and out of the shop. But in the process i had infected my own PC, and 2 Network Mapped Drives. I have reloaded my PC 3 times now, but every time i connect to the map drive its auto reinfects itself. Sad thing, all my installer files are on these mapped drives. Which some of the virus scans picked up as viruses and totally messed them up. So i here i set with these files on both my HD's, both my Pen Drivers and Both my mapped drives. The one pen drive CAN NOT be formatted, either can the map drives.
The files are: autorun.inf, and thbh.exe, bwcaqe.exe, a Ms-Dos Shortcut- vmoo.
Please Help........
Update:
After a week of fighting, i some how clean my pen drive, but both server's are still infected, along with my pc again. Which can be reloaded no problem. Its cleaning the server i am having a problem with.

The Bug is Win32.Sality

I've ran Flash_Disinfector a few times on my pendrive, also ran combo_fix with this script
KillAll::
Driver::
dac970nt
File::
Z:\ueka.exe
X:\hlhks.exe
Folder::
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"\\\\192.168.0.200\\Storage\\ueka.exe"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##websrv1#Storage]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standard profile\authorizedapplications\list]
"Z:\\ueka.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\efqbvc.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winyrnb.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\khlbj.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\fppd.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winrgiig.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winirgd.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winfmydl.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winpmbxwy.exe"=-

I also disconnected the mapped drives on the pc, those logs i ran on my pc. It got it about 70% clean, but its still infected. I am not worried about the pc's as much as the server's. I've also used AVG's removal tool for this and it did nothing
 
Back up your data as required, and reinstall the OS on the server and the workstation as required.

Nobody is going to offer you a more salient and reliable as well as 100% working solution to the problem(s) you just posted about. You've spent a week of your life trying to resolve something that really has no solution because it's so deeply entrenched and embedded as of the time you took to make that very detailed and rather complex posting.

You could back up your current data as required and start over fresh inside of a few hours, give or take a few minutes, with a clean installation that'll be ready to roll.

If you don't consider that useful information, then waste as much of your life and effort as you wish, I guess. The simple fact is you have an infection that isn't going to be cleaned out effectively, it's time to back up the personal data and start fresh.

'Nuff typed.
 
Sounds to me like AVG is not doing a very good job. I would try another AV program. If you don't want to pay for a good AV program then as they say, "you get what you pay for".
I would at least try the trial version of NOD32 and do a full scan on all drives. Better yet, buy it.
Others worth trying, Avira, Avast, Kapersky.
 
Joe Average said:
Back up your data as required, and reinstall the OS on the server and the workstation as required.

Nobody is going to offer you a more salient and reliable as well as 100% working solution to the problem(s) you just posted about. You've spent a week of your life trying to resolve something that really has no solution because it's so deeply entrenched and embedded as of the time you took to make that very detailed and rather complex posting.

You could back up your current data as required and start over fresh inside of a few hours, give or take a few minutes, with a clean installation that'll be ready to roll.

If you don't consider that useful information, then waste as much of your life and effort as you wish, I guess. The simple fact is you have an infection that isn't going to be cleaned out effectively, it's time to back up the personal data and start fresh.

'Nuff typed.
Click to expand...

These server's are our 2 main business servers, reloading is not a option, there is always a solution that does not enough formatting.

Mister Natural said:
Sounds to me like AVG is not doing a very good job. I would try another AV program. If you don't want to pay for a good AV program then as they say, "you get what you pay for".
I would at least try the trial version of NOD32 and do a full scan on all drives. Better yet, buy it.
Others worth trying, Avira, Avast, Kapersky.
Click to expand...
Main problem with this bug is that it disables reg editing, and running of most av's and other programs
Remember, we are running this stuff on Server 2003, i ran Nod32 trail on the effected XP machine and it did not find it or delete it
 
If you know the names of the files that are causing the most headache, boot with a linux live cd and delete those files. then if you're lucky you might be able to boot back into windows and have your AV clean out what's left.
 
Joe's suggestion may likely be the best. Eset and Kapersky recommend that you pull the drive and scan it on a fully updated and protected system, then re-install and install AV program and scan again. Even after cleaning you'll likely have a lot of executable's which will need to be replaced.
 
Mister Natural said:
Joe's suggestion may likely be the best. Eset and Kapersky recommend that you pull the drive and scan it on a fully updated and protected system, then re-install and install AV program and scan again. Even after cleaning you'll likely have a lot of executable's which will need to be replaced.
Click to expand...

I did this, and it just infected the other machine and never fully healed it, and yes it removed all the .exe files. I moved on from the windows machine, that is a lost cause and it will be reloaded, i am moving onto the 2 server's that have it
 
what linux tool can i use that will allow access to the registry using the load hiv, and allow me to delete the files. I know exactly what to look for.
 
hmmm I don't know of any linux tools for a windows reg. I was thinking along the lines of deleting the files that are running these reg edits, then running your AV or antispyware.
 
And you don't want to delete the registry files, that would be bad.

You can't always undo what a virus does, and you may indeed need to repair the workstation and the server by reinstalling the operating system. If the servers are as mission critical as you suggest, then you may benefit from something more powerful than AVG -- an actual enterprise antivirus. If your company won't spring for the cost of it, then they need to accept that situations may cause their fileservers to be down due to an infection.

With that said, you can remove the virus infected files from started easily enough by booting to safe mode or an alternate OS like Linux or a WinPE CD.

If you need to edit the registry, and you can not do it due to restrictions that have been enforced by the virus, there are two ways to do it.

The first way is to do a parallel installation of windows on the same machine. Once installed, you can run Regedit on this new installation and load the registry hives, make your changes, and then unload them.

A better way, but maybe more complex, is to create a Windows live CD using WinPE (check out BartPE if you're not familiar with WinPE). Using this live CD, you can boot to a windows environment and run regedit to do load, edit, and save the registry files.

Regardless of the method, you are going to experience downtime. Another thing to consider is that the virus probably enforced a windows policy. The only way to undo this is to undo the policy and that could take a long, long time to figure that one out.



On a side note, thats an impressive list of credentials you have in your sig....
 
Demon10000 said:
And you don't want to delete the registry files, that would be bad.

You can't always undo what a virus does, and you may indeed need to repair the workstation and the server by reinstalling the operating system. If the servers are as mission critical as you suggest, then you may benefit from something more powerful than AVG -- an actual enterprise antivirus. If your company won't spring for the cost of it, then they need to accept that situations may cause their fileservers to be down due to an infection.

With that said, you can remove the virus infected files from started easily enough by booting to safe mode or an alternate OS like Linux or a WinPE CD.

If you need to edit the registry, and you can not do it due to restrictions that have been enforced by the virus, there are two ways to do it.

The first way is to do a parallel installation of windows on the same machine. Once installed, you can run Regedit on this new installation and load the registry hives, make your changes, and then unload them.

A better way, but maybe more complex, is to create a Windows live CD using WinPE (check out BartPE if you're not familiar with WinPE). Using this live CD, you can boot to a windows environment and run regedit to do load, edit, and save the registry files.

Regardless of the method, you are going to experience downtime. Another thing to consider is that the virus probably enforced a windows policy. The only way to undo this is to undo the policy and that could take a long, long time to figure that one out.



On a side note, thats an impressive list of credentials you have in your sig....
Click to expand...

I have tried all things i know to do, besides formatting the machine, My Boss say's that is not a option to do. I have a running log of everything I've done i can post that if that will help. This bug disables booting into safe mode, disables the reg, and other things. It is one nasty piece of work.

When i get home I'll post everything I've done to combat this bug
The problem with formatting is when i do a full backup, the files will still be infected, and when i goto copy them back over, it will just reinfect the server's.
 
When this bug first started showing its ugly head, i am not even sure how my PC became infected. I run a tun of tools on it to keep it clean. I am always trying new software and working on something. So its vital for me to keep a clean working PC. Well last week I noticed my PC starting to acting very strange. First thing i had to do was ID the bug and learn more about it. I come to find it it was http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=52797 Win32.Sality.
Lets start the log of everything I've do to this point:
Downloaded Flash_Disinfector.exe by sUBs
Note: Flash_Disinfector will create a hidden folder named autorun.inf in each partition and every USB drive plugged in when you ran it. Don't delete this folder...it will help protect your drives from future infection.
Next
Downloaded ComboFix by sUBs
I Made sure any antivirus or protective software is disabled.

Go to -> Run -> copy/paste the following single line command in the runbox & click OK

"%userprofile%\desktop\combofix.exe" /killall

* ComboFix will automatically start. Any monitoring programs will be shut down like your antivirus, antispyware programs for example.
This log.
Notes:
When starting ComboFix will cause your computer's internal speakers to produce two beeps, and during the start process display two warnings. These are intended to discourage people who are not getting help in the forum from just experimenting with tools they do not understand. Just to inform you so you will understand that the procedures are expected, and okay.

ComboFix will also disable any screensaver settings made, so know that at some point when we complete repairs you will need to reset your screensaver

Do not mouse-click Combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Here is the combo fix log
 
ComboFix 08-09-10.04 - JohnBoy 2008-09-11 8:15:22.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.728 [GMT -4:00]
Running from: C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\autorun.inf
G:\autorun.inf
G:\vmoo.pif
.
---- Previous Run -------
.
G:\vmoo.pif

.
((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-11 08:09 . 2008-09-11 07:53 344,064 --a------ C:\WINDOWS\system32\rmsality.nt
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\CleanUp!
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 12:00 . 2008-09-10 12:00 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-09-10 11:59 . 2008-09-10 11:59 <DIR> d-------- C:\WINDOWS\ERUNT
2008-09-10 10:14 . 2008-09-10 12:42 <DIR> d-------- C:\SDFix
2008-09-09 15:48 . 2008-09-09 15:49 <DIR> d-------- C:\!KillBox
2008-09-09 14:52 . 2008-09-09 14:52 78 --a------ C:\WINDOWS\PCLOCK.INI
2008-09-09 14:51 . 2008-09-09 14:51 <DIR> d-------- C:\Program Files\PunchClock
2008-09-09 14:37 . 2008-09-09 14:37 <DIR> d-------- C:\Program Files\uTorrent
2008-09-09 14:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\uTorrent
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Program Files\NOS
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-09-09 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 13:06 . 2008-09-09 13:06 <DIR> d-------- C:\Program Files\Java
2008-09-09 13:06 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-09-09 13:03 . 2008-09-09 13:04 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-09 12:56 . 2008-09-09 12:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-09 12:52 . 2008-09-09 12:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-09 12:49 . 2008-09-09 12:50 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-09-09 12:49 . 2008-09-09 12:49 <DIR> d-------- C:\Program Files\Dell_HostCD
2008-09-09 12:49 . 2004-03-05 12:19 315,392 --a------ C:\WINDOWS\system32\lexlog.dll
2008-09-09 12:49 . 2008-09-09 12:49 1,502 --a------ C:\WINDOWS\system32\LexFiles.ulf
2008-09-09 12:49 . 2008-09-09 13:45 1,095 --a------ C:\WINDOWS\system32\LexFiles.usr
2008-09-09 12:49 . 2008-09-09 12:49 1,084 --a------ C:\WINDOWS\DKAAP2DD.ini
2008-09-09 12:47 . 2008-09-09 12:47 <DIR> d-------- C:\Program Files\Analog Devices
2008-09-09 12:46 . 2001-09-19 12:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-09-09 12:46 . 2004-09-17 09:02 732,928 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-09-09 12:46 . 2004-09-23 07:55 311,296 --a------ C:\WINDOWS\system32\Edcrypt.dll
2008-09-09 12:46 . 2005-01-27 15:31 260,352 --a------ C:\WINDOWS\system32\drivers\smwdm.sys
2008-09-09 12:46 . 2004-10-05 16:10 23,040 --a------ C:\WINDOWS\system32\PostProc.dll
2008-09-09 12:42 . 2008-09-09 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-09 12:41 . 2008-09-10 11:06 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-09 12:41 . 2008-09-09 12:41 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\SUPERAntiSpyware.com
2008-09-09 12:40 . 2008-09-10 13:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-09 12:40 . 2008-09-10 11:04 <DIR> d-------- C:\Program Files\CCleaner
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 12:39 . 2008-09-09 12:39 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-09 12:38 . 2008-09-09 12:41 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-09 12:37 . 2008-09-09 12:37 <DIR> d-------- C:\Program Files\AVG
2008-09-09 12:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-09-09 12:32 . 2008-09-09 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-09 12:31 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-09 12:31 . 2008-05-01 10:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-09 12:31 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-09 12:31 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-09 12:15 . 2008-09-09 12:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-09 12:00 . 2004-08-03 22:29 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-09 11:25 . 2008-09-09 13:04 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-09 11:25 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-09 11:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-09 11:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-09 11:16 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-09 10:13 . 2008-09-09 12:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-09-09 10:12 . 2008-09-09 10:12 <DIR> d-------- C:\Program Files\Broadcom
2008-09-09 10:12 . 2003-06-30 18:11 43,136 -ra------ C:\WINDOWS\system32\drivers\bcm4sbxp.sys
2008-09-09 10:07 . 2008-09-09 12:46 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-09-09 10:06 . 2008-04-13 20:12 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 13:43 --------- d-----w C:\Program Files\microsoft frontpage
.

------- Sigcheck -------

2008-04-13 20:12 1111552 1fa7b368adb41c82daeffa3ea6b39c88 C:\WINDOWS\explorer.exe
2004-08-12 09:19 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-10_ 9.43.01.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-09-10 15:59:41 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:41 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-09-10 15:59:40 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:40 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-04-14 00:12:32 146,432 ----a-w C:\WINDOWS\regedit.exe
+ 2008-04-14 00:12:32 224,256 ----a-w C:\WINDOWS\regedit.exe
- 2008-04-14 00:12:14 389,120 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:14 462,848 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:28 343,040 -c--a-w C:\WINDOWS\system32\dllcache\mspaint.exe
+ 2008-04-14 00:12:33 33,280 -c--a-w C:\WINDOWS\system32\dllcache\rundll32.exe
- 2008-04-14 00:12:21 39,424 ----a-w C:\WINDOWS\system32\grpconv.exe
+ 2008-04-14 00:12:21 113,152 ----a-w C:\WINDOWS\system32\grpconv.exe
- 2008-04-14 00:12:28 343,040 ----a-w C:\WINDOWS\system32\mspaint.exe
+ 2008-04-14 00:12:28 420,864 ----a-w C:\WINDOWS\system32\mspaint.exe
- 2008-04-14 00:12:33 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe
+ 2008-04-14 00:12:33 102,912 ----a-w C:\WINDOWS\system32\rundll32.exe
- 2008-04-14 00:12:05 438,272 ----a-w C:\WINDOWS\system32\shimgvw.dll
+ 2008-04-14 00:12:05 520,192 ----a-w C:\WINDOWS\system32\shimgvw.dll
- 2008-04-14 00:12:37 135,680 ----a-w C:\WINDOWS\system32\taskmgr.exe
+ 2008-04-14 00:12:37 209,408 ----a-w C:\WINDOWS\system32\taskmgr.exe
- 2008-04-14 00:12:11 338,432 ----a-w C:\WINDOWS\system32\zipfldr.dll
+ 2008-04-14 00:12:11 408,064 ----a-w C:\WINDOWS\system32\zipfldr.dll
+ 2008-09-11 12:17:57 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_c8.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 1213680]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-09 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-09 14:23 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"\\\\192.168.0.200\\Storage\\ueka.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"C:\\WINDOWS\\system32\\wuauclt.exe"=
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"=
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"=
"C:\\WINDOWS\\system32\\cmd.exe"=
"C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"C:\\SDFix\\apps\\Process.exe"=
"C:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=

R3 dac970nt;dac970nt;C:\WINDOWS\system32\drivers\ejeqdo.sys [ ]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
\Shell\AutoPlay\cOMmaND - Z:\ueka.exe
\Shell\AutoRun\command - Z:\ueka.exe
\Shell\exPLORe\CoMMAnd - Z:\ueka.exe
\Shell\oPEN\commanD - Z:\ueka.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
\ShELL\AutoPlAy\command - X:\hlhks.exe
\ShELL\AutoRun\command - X:\hlhks.exe
\ShELL\exPlorE\coMmand - X:\hlhks.exe
\ShELL\OpeN\CoMmAnD - X:\hlhks.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##websrv1#Storage]
\Shell\AutoPlay\cOMmaND - Z:\ueka.exe
\Shell\AutoRun\command - Z:\ueka.exe
\Shell\exPLORe\CoMMAnd - Z:\ueka.exe
\Shell\oPEN\commanD - Z:\ueka.exe
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Google Update - C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
HKLM-Run-Adobe Reader Speed Launcher - C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
HKLM-Run-SunJavaUpdateSched - C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\JohnBoy\Application Data\Mozilla\Firefox\Profiles\3gjuor2o.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE
FF -: plugin - C:\Documents and Settings\JohnBoy\Application Data\Mozilla\Firefox\Profiles\3gjuor2o.default\extensions\{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}\plugins\np_gp.dll
FF -: plugin - C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\np_gp.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2008-09-11 08:18:01
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\savedump.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\ComboFix\NirCmd.cfexe
C:\Documents and Settings\JohnBoy\My Documents\Dial-a-fix-v0.60.0.24\Dial-a-fix-v0.60.0.24\Dial-a-fix.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-09-11 8:20:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-11 12:20:30
ComboFix2.txt 2008-09-10 14:39:02
ComboFix3.txt 2008-09-10 13:53:55
ComboFix4.txt 2008-09-10 13:44:51

Pre-Run: 33,728,765,952 bytes free
Post-Run: 33,758,109,696 bytes free

241 --- E O F --- 2008-09-11 07:00:13
 
Next I ran SDFix

SDFix: Version 1.223
Run by JohnBoy on Wed 09/10/2008 at 12:07 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-10 12:10:43
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

scanning hidden files ...

C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb0004E.log 131072 bytes

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 1


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standard profile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:æTorrent"
"Z:\\ueka.exe"="Z:\\ueka.exe:*:Enabled:ipsec"
"\\\\192.168.0.200\\Storage\\ueka.exe"="\\\\192.168.0.200\\Storage\\ueka.exe:*:Enabled:ueka.exe"
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"="C:\\Program Files\\Mozilla Firefox\\firefox.exe:*:Enabled:ipsec"
"C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"="C:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe:*:Enabled:ipsec"
"C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe"="C:\\Program Files\\Java\\jre1.6.0_07\\bin\\jusched.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\wuauclt.exe"="C:\\WINDOWS\\system32\\wuauclt.exe:*:Enabled:ipsec"
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"="C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe:*:Enabled:ipsec"
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"="C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\CF18182.exe"="C:\\WINDOWS\\system32\\CF18182.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\efqbvc.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\efqbvc.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\system32\\cmd.exe"="C:\\WINDOWS\\system32\\cmd.exe:*:Enabled:ipsec"
"C:\\WINDOWS\\explorer.exe"="C:\\WINDOWS\\Explorer.EXE:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winyrnb.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winyrnb.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\khlbj.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\khlbj.exe:*:Enabled:ipsec"
"C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\fppd.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\fppd.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winrgiig.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winrgiig.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winroiaib.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winroiaib.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winirgd.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winirgd.exe:*:Enabled:ipsec"
"C:\\SDFix\\apps\\Process.exe"="C:\\SDFix\\apps\\Process.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winfmydl.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winfmydl.exe:*:Enabled:ipsec"
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winpmbxwy.exe"="C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winpmbxwy.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainpr ofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000"

Remaining Files :



Files with Hidden Attributes :

Tue 9 Sep 2008 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"

Finished!
 
Next:
Download VArestorepolicies
Then made a notepad with this info and moved it into combo fix
KillAll::
Driver::
dac970nt
File::
Z:\ueka.exe
X:\hlhks.exe
Folder::
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp
Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"\\\\192.168.0.200\\Storage\\ueka.exe"=-
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##websrv1#Storage]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standard profile\authorizedapplications\list]
"Z:\\ueka.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\efqbvc.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winyrnb.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\khlbj.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\fppd.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winrgiig.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winirgd.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winfmydl.exe"=-
"C:\\DOCUME~1\\JohnBoy\\LOCALS~1\\Temp\\winpmbxwy.exe"=-

Next, downloaded and ran OTViewIT ran that, then another round of ComboFix
ComboFix 08-09-10.04 - JohnBoy 2008-09-11 15:13:34.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.744 [GMT -4:00]
Running from: C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\JohnBoy\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\DOCUME~1\JohnBoy\LOCALS~1\Temp
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp\~DFBE26.tmp
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp\~DFBE31.tmp
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp\Av-test.txt
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp\Silverlight0.log
C:\DOCUME~1\JohnBoy\LOCALS~1\Temp\SilverlightMSI.log
F:\autorun.inf
F:\jquhl.pif
G:\autorun.inf
G:\dncl.pif

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Service_dac970nt


((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-11 09:09 . 2008-09-11 09:09 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-09-11 08:09 . 2008-09-11 07:53 344,064 --a------ C:\WINDOWS\system32\rmsality.nt
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\CleanUp!
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 12:00 . 2008-09-10 12:00 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-09-10 11:59 . 2008-09-10 11:59 <DIR> d-------- C:\WINDOWS\ERUNT
2008-09-10 10:14 . 2008-09-10 12:42 <DIR> d-------- C:\SDFix
2008-09-09 15:48 . 2008-09-09 15:49 <DIR> d-------- C:\!KillBox
2008-09-09 14:52 . 2008-09-09 14:52 78 --a------ C:\WINDOWS\PCLOCK.INI
2008-09-09 14:51 . 2008-09-09 14:51 <DIR> d-------- C:\Program Files\PunchClock
2008-09-09 14:37 . 2008-09-09 14:37 <DIR> d-------- C:\Program Files\uTorrent
2008-09-09 14:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\uTorrent
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Program Files\NOS
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-09-09 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 13:06 . 2008-09-09 13:06 <DIR> d-------- C:\Program Files\Java
2008-09-09 13:06 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-09-09 13:03 . 2008-09-09 13:04 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-09 12:56 . 2008-09-09 12:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-09 12:52 . 2008-09-09 12:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-09 12:49 . 2008-09-09 12:50 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-09-09 12:49 . 2008-09-09 12:49 <DIR> d-------- C:\Program Files\Dell_HostCD
2008-09-09 12:49 . 2004-03-05 12:19 315,392 --a------ C:\WINDOWS\system32\lexlog.dll
2008-09-09 12:49 . 2008-09-09 12:49 1,502 --a------ C:\WINDOWS\system32\LexFiles.ulf
2008-09-09 12:49 . 2008-09-09 13:45 1,095 --a------ C:\WINDOWS\system32\LexFiles.usr
2008-09-09 12:49 . 2008-09-09 12:49 1,084 --a------ C:\WINDOWS\DKAAP2DD.ini
2008-09-09 12:47 . 2008-09-09 12:47 <DIR> d-------- C:\Program Files\Analog Devices
2008-09-09 12:46 . 2001-09-19 12:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-09-09 12:46 . 2004-09-17 09:02 732,928 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-09-09 12:46 . 2004-09-23 07:55 311,296 --a------ C:\WINDOWS\system32\Edcrypt.dll
2008-09-09 12:46 . 2005-01-27 15:31 260,352 --a------ C:\WINDOWS\system32\drivers\smwdm.sys
2008-09-09 12:46 . 2004-10-05 16:10 23,040 --a------ C:\WINDOWS\system32\PostProc.dll
2008-09-09 12:42 . 2008-09-09 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-09 12:41 . 2008-09-10 11:06 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-09 12:41 . 2008-09-09 12:41 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\SUPERAntiSpyware.com
2008-09-09 12:40 . 2008-09-10 13:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-09 12:40 . 2008-09-10 11:04 <DIR> d-------- C:\Program Files\CCleaner
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 12:39 . 2008-09-09 12:39 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-09 12:38 . 2008-09-09 12:41 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-09 12:37 . 2008-09-09 12:37 <DIR> d-------- C:\Program Files\AVG
2008-09-09 12:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-09-09 12:32 . 2008-09-09 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-09 12:31 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-09 12:31 . 2008-05-01 10:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-09 12:31 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-09 12:31 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-09 12:15 . 2008-09-09 12:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-09 12:00 . 2004-08-03 22:29 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-09 11:25 . 2008-09-09 13:04 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-09 11:25 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-09 11:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-09 11:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-09 11:16 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-09 10:13 . 2008-09-09 12:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-09-09 10:12 . 2008-09-09 10:12 <DIR> d-------- C:\Program Files\Broadcom
2008-09-09 10:12 . 2003-06-30 18:11 43,136 -ra------ C:\WINDOWS\system32\drivers\bcm4sbxp.sys
2008-09-09 10:07 . 2008-09-09 12:46 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-09-09 10:06 . 2008-04-13 20:12 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 13:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2008-04-13 20:12 1111552 1fa7b368adb41c82daeffa3ea6b39c88 C:\WINDOWS\explorer.exe
2004-08-12 09:19 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-10_ 9.43.01.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-09-10 15:59:41 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:41 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-09-10 15:59:40 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:40 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-04-14 00:12:32 146,432 ----a-w C:\WINDOWS\regedit.exe
+ 2008-04-14 00:12:32 224,256 ----a-w C:\WINDOWS\regedit.exe
- 2008-04-14 00:12:14 389,120 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:14 462,848 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:28 343,040 -c--a-w C:\WINDOWS\system32\dllcache\mspaint.exe
+ 2008-04-14 00:12:33 33,280 -c--a-w C:\WINDOWS\system32\dllcache\rundll32.exe
- 2008-04-14 00:12:21 39,424 ----a-w C:\WINDOWS\system32\grpconv.exe
+ 2008-04-14 00:12:21 113,152 ----a-w C:\WINDOWS\system32\grpconv.exe
- 2008-04-14 00:12:28 343,040 ----a-w C:\WINDOWS\system32\mspaint.exe
+ 2008-04-14 00:12:28 420,864 ----a-w C:\WINDOWS\system32\mspaint.exe
- 2008-04-14 00:12:33 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe
+ 2008-04-14 00:12:33 102,912 ----a-w C:\WINDOWS\system32\rundll32.exe
- 2008-04-14 00:12:05 438,272 ----a-w C:\WINDOWS\system32\shimgvw.dll
+ 2008-04-14 00:12:05 520,192 ----a-w C:\WINDOWS\system32\shimgvw.dll
- 2008-04-14 00:12:37 135,680 ----a-w C:\WINDOWS\system32\taskmgr.exe
+ 2008-04-14 00:12:37 209,408 ----a-w C:\WINDOWS\system32\taskmgr.exe
- 2008-04-14 00:12:11 338,432 ----a-w C:\WINDOWS\system32\zipfldr.dll
+ 2008-04-14 00:12:11 408,064 ----a-w C:\WINDOWS\system32\zipfldr.dll
+ 2008-09-11 19:16:26 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_80.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 1213680]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-09 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-09 14:23 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"C:\\WINDOWS\\system32\\wuauclt.exe"=
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"=
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"=
"C:\\WINDOWS\\system32\\cmd.exe"=
"C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"C:\\SDFix\\apps\\Process.exe"=
"C:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=
"C:\\WINDOWS\\system32\\CF28740.exe"=
"C:\\ComboFix\\regt.cfexe"=

S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
\Shell\AutoPlay\cOMmaND - Z:\ueka.exe
\Shell\AutoRun\command - Z:\ueka.exe
\Shell\exPLORe\CoMMAnd - Z:\ueka.exe
\Shell\oPEN\commanD - Z:\ueka.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
\ShELL\AutoPlAy\command - X:\hlhks.exe
\ShELL\AutoRun\command - X:\hlhks.exe
\ShELL\exPlorE\coMmand - X:\hlhks.exe
\ShELL\OpeN\CoMmAnD - X:\hlhks.exe

*Newly Created Service* - DAC970NT
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-11 15:16:28
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac970nt]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\ejeqdo.sys"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\ComboFix\NirCmd.cfexe
.
**************************************************************************
.
Completion time: 2008-09-11 15:18:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-11 19:18:27
ComboFix2.txt 2008-09-11 12:20:34
ComboFix3.txt 2008-09-10 14:39:02
ComboFix4.txt 2008-09-10 13:53:55
ComboFix5.txt 2008-09-11 19:13:17

Pre-Run: 33,382,035,456 bytes free
Post-Run: 33,343,082,496 bytes free

239 --- E O F --- 2008-09-11 07:00:13
 
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:17:12 PM, on 9/11/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\TEMP\winkoekph.exe
C:\WINDOWS\TEMP\winybaex.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Windows Media Player Network Sharing Service (WMPNetworkSvc) - Unknown owner - C:\Program Files\Windows Media Player\WMPNetwk.exe (file missing)

--
End of file - 3041 bytes
 
OTViewIt logfile created on: 9/12/2008 7:59:56 AM - Run 1
OTViewIt by OldTimer - Version 1.0.3.1 Folder = C:\Documents and Settings\JohnBoy\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.00 Mb Total Physical Memory | 531.31 Mb Available Physical Memory | 52.35% Memory free
2.39 Gb Paging File | 1.93 Gb Available in Paging File | 80.93% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048;

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.24 Gb Total Space | 30.49 Gb Free Space | 81.86% Space Free | Partition Type: NTFS
Drive D: | 74.52 Gb Total Space | 64.32 Gb Free Space | 86.31% Space Free | Partition Type: NTFS
Drive E: | 595.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 1.86 Gb Total Space | 1.86 Gb Free Space | 99.98% Space Free | Partition Type: FAT32
Drive G: | 979.53 Mb Total Space | 253.44 Mb Free Space | 25.87% Space Free | Partition Type: FAT
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: TECH1
Current User Name: JohnBoy
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Whitelist: On

========== Processes - Non-Microsoft Only ==========

[07/07/2008 08:15 AM | 00,689,488 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
[09/11/2008 03:18 PM | 00,007,680 | ---- | M] () -- C:\WINDOWS\temp\winkoekph.exe
[09/11/2008 03:18 PM | 00,007,680 | ---- | M] () -- C:\WINDOWS\temp\winybaex.exe
[09/09/2008 02:23 PM | 01,645,808 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
[09/12/2008 07:59 AM | 00,379,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\JohnBoy\Desktop\OTViewIt.exe

========== Win32 Services - Non-Microsoft Only ==========

[07/07/2008 08:15 AM | 00,689,488 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice [Auto | Running])
[08/29/2008 10:01 AM | 00,033,752 | ---- | M] (NOS Microsystems Ltd.) -- C:\Program Files\NOS\bin\getPlus_HelperSvc.exe -- (getPlus(R) Helper [On_Demand | Stopped])
File not found -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services - Non-Microsoft Only ==========

File not found -- C:\ComboFix\catchme.sys -- (catchme [On_Demand | Running])
[09/09/2008 02:23 PM | 00,008,944 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV [System | Running])
[02/16/2006 04:51 PM | 00,004,096 | R--- | M] (SuperAdBlocker, Inc.) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM [On_Demand | Running])
[09/09/2008 02:23 PM | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL [System | Running])
File not found -- -- (dac970nt [Unknown | Running])


========== Run Keys ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner" = "C:\Program Files\CCleaner\CCleaner.exe" /AUTO (Piriform Ltd)

[HKEY_USERS\S-1-5-21-861567501-343818398-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner" = "C:\Program Files\CCleaner\CCleaner.exe" /AUTO (Piriform Ltd)

========== Startup Folders ==========


========== Internet Explorer ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main]
"Default_Page_URL" = http://go.microsoft.com/fwlink/?LinkId=69157
"Default_Search_URL" = http://go.microsoft.com/fwlink/?LinkId=54896
"Local Page" = %SystemRoot%\system32\blank.htm
"Search Page" = http://go.microsoft.com/fwlink/?LinkId=54896
"Start Page" = about:blank

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Search]
"CustomizeSearch" = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
"SearchAssistant" = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main]
"Local Page" = C:\WINDOWS\system32\blank.htm
"Search Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main]
"Search Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome

[HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

[HKEY_USERS\S-1-5-21-861567501-343818398-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main]
"Local Page" = C:\WINDOWS\system32\blank.htm
"Search Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
"Start Page" = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome

[HKEY_USERS\S-1-5-21-861567501-343818398-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable" = 0

========== BHO's ==========

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\]
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} (HKLM) -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
{53707962-6F74-2D53-2644-206D7942484F} (HKLM) -- C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} (HKLM) -- C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)

========== Shell Execute Hooks ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}" (HKLM) -- C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

========== Winlogon Notify Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\]
!SASWinLogon: "DllName" = C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL -- C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

========== Safeboot Options ==========

"AlternateShell" = cmd.exe

========== CDRom AutoRun Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom]
"AutoRun" = 1

========== Autorun Files on Drives ==========

AUTOEXEC.BAT []
[09/09/2008 09:43 AM | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT -- [ NTFS ]

autorun.inf []
[09/09/2008 04:29 PM | RHSD | M] -- C:\autorun.inf -- [ NTFS ]

autorun.inf []
[09/09/2008 07:54 AM | RHSD | M] -- D:\autorun.inf -- [ NTFS ]

AUTORUN.INF [[AutoRun] | open=setup.exe | icon=setup.exe,0 | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | |  | ]
[04/14/2008 08:00 AM | 00,000,110 | R--- | M] () -- E:\AUTORUN.INF -- [ CDFS ]

autorun.inf [;kpefiFgKXx ofBKDTcakKsEcbARuApvF | [AutoRun] | ;mvlj bpuhatheVgp | open=aqtimd.cmd | ;hsWxpXseCtoakN | SHelL\opEn\Command =aqtimd.cmd | ;uvusgRyMuUju | sHell\opEn\DefaUlt=1 | ;SDtARI JwWxUGldiHxcj AwllBnyclQgqfjjjQyQnPycuc | SheLl\eXPLOrE\CoMmaNd = aqtimd.cmd | ;dutxPhXlno | sHelL\AutOplAy\COmmand= aqtimd.cmd | ]
[04/13/2008 08:12 PM | 00,000,304 | -H-- | M] () -- F:\autorun.inf -- [ FAT32 ]

autorun.inf [[AutoRun] | | ; | ;kfqIEpgp YNia | opEn =fnnvuc.exe | ;uGjYDxiuuhlRTPF dKmBvtfmVVtoT LCoSn jCCAd | ShELl\oPen\CoMmAnD=fnnvuc.exe | ;qLrRjf | shELL\explorE\coMmaNd=fnnvuc.exe | ;gSoqlfngAMaIudtDbpVmknFbo | sHelL\oPen\Default=1 | ; | SheLl\AUTOplAY\coMmand =fnnvuc.exe | ; | ]
[04/13/2008 08:12 PM | 00,000,262 | -H-- | M] () -- G:\autorun.inf -- [ FAT ]

========== MountPoints2 ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell]
"" = AutoRun


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell\AutoPlay\cOMmaND]
"" = Z:\ueka.exe -- File not found

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell\AutoRun]
"" = Auto&Play


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell\AutoRun\command]
"" = Z:\ueka.exe -- File not found


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell\exPLORe\CoMMAnd]
"" = Z:\ueka.exe -- File not found


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.200#St orage\Shell\oPEN\commanD]
"" = Z:\ueka.exe -- File not found

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell]
"" = AutoRun


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell\AutoPlAy\command]
"" = X:\hlhks.exe -- File not found

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell\AutoRun]
"" = Auto&Play


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell\AutoRun\command]
"" = X:\hlhks.exe -- File not found


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell\exPlorE\coMmand]
"" = X:\hlhks.exe -- File not found


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\##192.168.0.201#Da ta\Shell\OpeN\CoMmAnD]
"" = X:\hlhks.exe -- File not found

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5dcc069a-7e8c-11dd-ba8f-806d6172696f}\Shell]
"" = AutoRun

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5dcc069a-7e8c-11dd-ba8f-806d6172696f}\Shell\AutoRun]
"" = Auto&Play


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5dcc069a-7e8c-11dd-ba8f-806d6172696f}\Shell\AutoRun\command]
"" = E:\setup.exe -- [04/14/2008 08:00 AM | 01,314,816 | R--- | M] (Microsoft Corporation)

========== DNS Name Servers ==========

{3B63C0CC-AF89-4C5E-8533-FBEBFF43783D} (Servers: | Description: Broadcom 440x 10/100 Integrated Controller)

========== Hosts File ==========

HOSTS File = (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
First 25 entries...
127.0.0.1 localhost



========== Files/Folders - Created Within 30 days ==========

[09/09/2008 03:48 PM | ---D | C] -- C:\!KillBox
[09/09/2008 04:29 PM | ---D | C] -- C:\QooBox
[09/09/2008 04:29 PM | RHSD | C] -- C:\autorun.inf
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS
[09/09/2008 05:15 AM | -HSD | C] -- C:\System Volume Information
[09/09/2008 05:21 AM | 00,000,211 | -HS- | C] () -- C:\boot.ini
[09/09/2008 05:22 AM | ---D | C] -- C:\Documents and Settings
[09/09/2008 05:23 AM | R--D | C] -- C:\Program Files
[09/09/2008 09:43 AM | 00,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[09/09/2008 09:43 AM | 00,000,000 | ---- | C] () -- C:\CONFIG.SYS
[09/09/2008 09:43 AM | 00,000,000 | RHS- | C] () -- C:\IO.SYS
[09/09/2008 09:43 AM | 00,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[09/09/2008 09:43 AM | ---D | C] -- C:\DELL
[09/09/2008 09:57 AM | ---D | C] -- C:\drvrtmp
[09/10/2008 10:14 AM | ---D | C] -- C:\SDFix
[09/11/2008 03:41 PM | -HSD | C] -- C:\RECYCLER
[09/09/2008 05:22 AM | 00,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[09/09/2008 05:22 AM | 00,007,710 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[09/09/2008 05:22 AM | 00,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[09/09/2008 05:22 AM | 00,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[09/09/2008 05:22 AM | 00,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[09/09/2008 05:22 AM | 00,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[09/09/2008 05:22 AM | 01,042,903 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP2.CAT
[09/09/2008 05:23 AM | 00,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[09/09/2008 05:23 AM | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\dllcache\spxcoins.dll
[09/09/2008 05:23 AM | 00,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[09/09/2008 05:23 AM | 00,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[09/09/2008 05:23 AM | 01,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[09/09/2008 09:37 AM | 00,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[09/09/2008 09:40 AM | 00,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[09/09/2008 09:41 AM | 04,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[09/09/2008 09:44 AM | 00,031,744 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esucmd.dll
[09/09/2008 09:44 AM | 00,045,056 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esunid.dll
[09/09/2008 09:44 AM | 00,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[09/09/2008 09:44 AM | 00,057,856 | ---- | C] (SEIKO EPSON CORP.) -- C:\WINDOWS\System32\dllcache\esuimgd.dll
[09/09/2008 09:44 AM | 00,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[09/09/2008 09:44 AM | 00,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[09/09/2008 09:44 AM | 00,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[09/09/2008 09:44 AM | 00,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[09/09/2008 09:44 AM | 00,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[09/09/2008 09:44 AM | 01,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[09/09/2008 09:44 AM | 13,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[09/09/2008 09:45 AM | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[09/09/2008 09:45 AM | 00,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[09/09/2008 09:45 AM | 00,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[09/09/2008 12:01 PM | 00,000,403 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npdrmv2.zip
[09/09/2008 12:01 PM | 00,000,420 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmploc.js
[09/09/2008 12:01 PM | 00,000,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapp.gif
[09/09/2008 12:01 PM | 00,000,760 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cloapph.gif
[09/09/2008 12:01 PM | 00,000,772 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cntd.gif
[09/09/2008 12:01 PM | 00,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnt.gif
[09/09/2008 12:01 PM | 00,000,773 | ---- | C] () -- C:\WINDOWS\System32\dllcache\cnth.gif
[09/09/2008 12:01 PM | 00,000,855 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpocm.inf
[09/09/2008 12:01 PM | 00,000,908 | ---- | C] () -- C:\WINDOWS\System32\dllcache\skins.inf
[09/09/2008 12:01 PM | 00,000,999 | ---- | C] () -- C:\WINDOWS\System32\dllcache\bktrh.gif
[09/09/2008 12:01 PM | 00,001,148 | ---- | C] () -- C:\WINDOWS\System32\dllcache\snd.htm
[09/09/2008 12:01 PM | 00,001,367 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoffh.gif
[09/09/2008 12:01 PM | 00,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taoff.gif
[09/09/2008 12:01 PM | 00,001,380 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taonh.gif
[09/09/2008 12:01 PM | 00,001,398 | ---- | C] () -- C:\WINDOWS\System32\dllcache\taon.gif
[09/09/2008 12:01 PM | 00,001,771 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.css
[09/09/2008 12:01 PM | 00,001,885 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.cnt
[09/09/2008 12:01 PM | 00,002,371 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpauseh.gif
[09/09/2008 12:01 PM | 00,002,375 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplayh.gif
[09/09/2008 12:01 PM | 00,002,450 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tpause.gif
[09/09/2008 12:01 PM | 00,002,469 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tplay.gif
[09/09/2008 12:01 PM | 00,002,477 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm5.gif
[09/09/2008 12:01 PM | 00,002,545 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogo.gif
[09/09/2008 12:01 PM | 00,002,778 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplogoh.gif
[09/09/2008 12:01 PM | 00,003,187 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tour.js
[09/09/2008 12:01 PM | 00,004,193 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm8.gif
[09/09/2008 12:01 PM | 00,005,290 | ---- | C] () -- C:\WINDOWS\System32\dllcache\vidsamp.gif
[09/09/2008 12:01 PM | 00,005,789 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm1.gif
[09/09/2008 12:01 PM | 00,005,971 | ---- | C] () -- C:\WINDOWS\System32\dllcache\events.js
[09/09/2008 12:01 PM | 00,006,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm6.gif
[09/09/2008 12:01 PM | 00,006,241 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm3.gif
[09/09/2008 12:01 PM | 00,006,769 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmfsdk.inf
[09/09/2008 12:01 PM | 00,006,878 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.js
[09/09/2008 12:01 PM | 00,007,369 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm4.gif
[09/09/2008 12:01 PM | 00,007,636 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm2.gif
[09/09/2008 12:01 PM | 00,007,892 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm9.gif
[09/09/2008 12:01 PM | 00,008,298 | ---- | C] () -- C:\WINDOWS\System32\dllcache\contents.htm
[09/09/2008 12:01 PM | 00,008,677 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wm7.gif
[09/09/2008 12:01 PM | 00,009,585 | ---- | C] () -- C:\WINDOWS\System32\dllcache\controls.css
[09/09/2008 12:01 PM | 00,010,457 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmptour.hta
[09/09/2008 12:01 PM | 00,017,272 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmdm.inf
[09/09/2008 12:01 PM | 00,017,489 | ---- | C] () -- C:\WINDOWS\System32\dllcache\videobg.gif
[09/09/2008 12:01 PM | 00,018,286 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.inf
[09/09/2008 12:01 PM | 00,022,060 | ---- | C] () -- C:\WINDOWS\System32\dllcache\npds.zip
[09/09/2008 12:01 PM | 00,023,195 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplay.chm
[09/09/2008 12:01 PM | 00,023,829 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tourbg.gif
[09/09/2008 12:01 PM | 00,069,612 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.adm
[09/09/2008 12:01 PM | 00,077,307 | ---- | C] () -- C:\WINDOWS\System32\dllcache\plyr_err.chm
[09/09/2008 12:01 PM | 00,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud2.wav
[09/09/2008 12:01 PM | 00,086,180 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud4.wav
[09/09/2008 12:01 PM | 00,086,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud5.wav
[09/09/2008 12:01 PM | 00,097,117 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mplayer2.hlp
[09/09/2008 12:01 PM | 00,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud3.wav
[09/09/2008 12:01 PM | 00,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud8.wav
[09/09/2008 12:01 PM | 00,172,196 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud9.wav
[09/09/2008 12:01 PM | 00,300,969 | ---- | C] () --
 
C:\WINDOWS\System32\dllcache\viz.wmv
[09/09/2008 12:01 PM | 00,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud6.wav
[09/09/2008 12:01 PM | 00,343,204 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud7.wav
[09/09/2008 12:01 PM | 00,354,468 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmpaud1.wav
[09/09/2008 12:01 PM | 00,375,519 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nuskin.wmv
[09/09/2008 12:01 PM | 00,381,425 | ---- | C] () -- C:\WINDOWS\System32\dllcache\copycd.wmv
[09/09/2008 12:01 PM | 00,457,607 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mdlib.wmv
[09/09/2008 12:01 PM | 00,572,557 | ---- | C] () -- C:\WINDOWS\System32\dllcache\rtuner.wmv
[09/09/2008 12:01 PM | 00,613,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmplayer.chm
[09/09/2008 12:55 PM | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[09/09/2008 01:13 PM | 00,038,528 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[09/09/2008 12:00 PM | 00,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod
[09/09/2008 12:01 PM | 00,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img
[09/09/2008 12:01 PM | 00,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty
[09/09/2008 12:40 PM | 00,017,200 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[09/09/2008 12:55 PM | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[09/09/2008 02:53 PM | ---D | C] -- C:\WINDOWS\System32\appmgmt
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1025
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1028
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1031
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1033
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1037
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1041
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1042
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\1054
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\2052
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\3076
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\config
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\dhcp
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\drivers
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\export
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\ias
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\icsxml
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\IME
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\inetsrv
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\mui
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\npp
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\oobe
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\ras
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\Setup
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\ShellExt
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\spool
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\usmt
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\wbem
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\System32\wins
[09/09/2008 05:14 AM | RHSD | C] -- C:\WINDOWS\System32\dllcache
[09/09/2008 05:21 AM | 00,000,261 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf
[09/09/2008 05:21 AM | 00,091,888 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[09/09/2008 05:22 AM | 00,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[09/09/2008 05:22 AM | ---D | C] -- C:\WINDOWS\System32\CatRoot
[09/09/2008 05:22 AM | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[09/09/2008 05:23 AM | 00,024,661 | ---- | C] (Perle Systems Ltd.) -- C:\WINDOWS\System32\spxcoins.dll
[09/09/2008 05:23 AM | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28594.NLS
[09/09/2008 05:23 AM | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28595.NLS
[09/09/2008 05:23 AM | 00,066,082 | ---- | C] () -- C:\WINDOWS\System32\C_28597.NLS
[09/09/2008 05:23 AM | 00,468,820 | ---- | C] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[09/09/2008 09:37 AM | 00,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[09/09/2008 09:37 AM | ---D | C] -- C:\WINDOWS\System32\Com
[09/09/2008 09:37 AM | ---D | C] -- C:\WINDOWS\System32\MsDtc
[09/09/2008 09:38 AM | 00,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[09/09/2008 09:38 AM | 00,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[09/09/2008 09:38 AM | 00,001,931 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.ini
[09/09/2008 09:38 AM | 00,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[09/09/2008 09:38 AM | 00,013,223 | ---- | C] () -- C:\WINDOWS\System32\tslabels.ini
[09/09/2008 09:39 AM | 00,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[09/09/2008 09:39 AM | ---D | C] -- C:\WINDOWS\System32\Restore
[09/09/2008 09:40 AM | 00,000,002 | ---- | C] () -- C:\WINDOWS\System32\desktop.ini
[09/09/2008 09:40 AM | ---D | C] -- C:\WINDOWS\System32\Macromed
[09/09/2008 09:41 AM | ---D | C] -- C:\WINDOWS\System32\DirectX
[09/09/2008 09:42 AM | 00,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[09/09/2008 09:42 AM | 00,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[09/09/2008 09:43 AM | 00,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[09/09/2008 09:43 AM | ---D | C] -- C:\WINDOWS\System32\xircom
[09/09/2008 09:47 AM | --SD | C] -- C:\WINDOWS\System32\Microsoft
[09/09/2008 11:16 AM | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[09/09/2008 11:25 AM | ---D | C] -- C:\WINDOWS\System32\PreInstall
[09/09/2008 12:12 PM | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[09/09/2008 12:16 PM | ---D | C] -- C:\WINDOWS\System32\bits
[09/09/2008 12:16 PM | ---D | C] -- C:\WINDOWS\System32\en
[09/09/2008 12:16 PM | ---D | C] -- C:\WINDOWS\System32\en-us
[09/09/2008 12:16 PM | ---D | C] -- C:\WINDOWS\System32\scripting
[09/09/2008 12:46 PM | 00,311,296 | ---- | C] (Analog Devices Incorporated) -- C:\WINDOWS\System32\Edcrypt.dll
[09/09/2008 12:47 PM | 00,045,056 | ---- | C] (adi) -- C:\WINDOWS\System32\CleanUp.exe
[09/09/2008 12:47 PM | 00,049,152 | ---- | C] (Analog Devices Inc.) -- C:\WINDOWS\System32\DSndUp.exe
[09/09/2008 12:47 PM | 00,991,232 | ---- | C] (Sensaura) -- C:\WINDOWS\System32\virtear.dll
[09/09/2008 12:49 PM | 00,001,095 | ---- | C] () -- C:\WINDOWS\System32\LexFiles.usr
[09/09/2008 12:49 PM | 00,001,502 | ---- | C] () -- C:\WINDOWS\System32\LexFiles.ulf
[09/09/2008 12:49 PM | ---D | C] -- C:\WINDOWS\System32\URTTemp
[09/09/2008 12:55 PM | ---D | C] -- C:\WINDOWS\System32\LogFiles
[09/11/2008 08:09 AM | 00,344,064 | ---- | C] () -- C:\WINDOWS\System32\rmsality.nt
[09/09/2008 01:00 PM | ---D | C] -- C:\WINDOWS\ie7updates
[09/09/2008 01:00 PM | ---D | C] -- C:\WINDOWS\WBEM
[09/09/2008 02:52 PM | 00,000,078 | ---- | C] () -- C:\WINDOWS\PCLOCK.INI
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\addins
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\AppPatch
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Config
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Connection Wizard
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Cursors
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Debug
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\dell
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Driver Cache
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\ehome
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Help
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\ime
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\java
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Media
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\msagent
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\msapps
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\mui
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\pchealth
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\PeerNet
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Provisioning
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\repair
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\Resources
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\security
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\system
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\system32
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\twain_32
[09/09/2008 05:14 AM | ---D | C] -- C:\WINDOWS\WinSxS
[09/09/2008 05:14 AM | -H-D | C] -- C:\WINDOWS\inf
[09/09/2008 05:14 AM | R--D | C] -- C:\WINDOWS\Web
[09/09/2008 05:14 AM | R-SD | C] -- C:\WINDOWS\Fonts
[09/09/2008 05:23 AM | 00,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[09/09/2008 05:23 AM | -HSD | C] -- C:\WINDOWS\Installer
[09/09/2008 09:38 AM | 00,000,036 | ---- | C] () -- C:\WINDOWS\vb.ini
[09/09/2008 09:38 AM | 00,000,037 | ---- | C] () -- C:\WINDOWS\vbaddin.ini
[09/09/2008 09:38 AM | 00,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[09/09/2008 09:38 AM | 00,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[09/09/2008 09:38 AM | 00,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[09/09/2008 09:38 AM | 00,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[09/09/2008 09:38 AM | 00,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[09/09/2008 09:38 AM | 00,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[09/09/2008 09:38 AM | 00,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[09/09/2008 09:38 AM | 00,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[09/09/2008 09:38 AM | 00,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[09/09/2008 09:38 AM | 00,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[09/09/2008 09:38 AM | 00,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[09/09/2008 09:38 AM | ---D | C] -- C:\WINDOWS\Registration
[09/09/2008 09:40 AM | 00,000,002 | ---- | C] () -- C:\WINDOWS\desktop.ini
[09/09/2008 09:40 AM | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[09/09/2008 09:40 AM | 00,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[09/09/2008 09:40 AM | ---D | C] -- C:\WINDOWS\srchasst
[09/09/2008 09:40 AM | --SD | C] -- C:\WINDOWS\Tasks
[09/09/2008 09:41 AM | 00,000,749 | RH-- | C] () -- C:\WINDOWS\WindowsShell.Manifest
[09/09/2008 09:41 AM | R--D | C] -- C:\WINDOWS\Offline Web Pages
[09/09/2008 09:41 AM | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[09/09/2008 09:42 AM | 00,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[09/09/2008 09:43 AM | 00,000,000 | ---- | C] () -- C:\WINDOWS\control.ini
[09/09/2008 09:46 AM | 00,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[09/09/2008 09:46 AM | 00,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[09/09/2008 09:47 AM | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[09/09/2008 11:25 AM | -H-D | C] -- C:\WINDOWS\$hf_mig$
[09/09/2008 12:09 PM | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$
[09/09/2008 12:13 PM | ---D | C] -- C:\WINDOWS\network diagnostic
[09/09/2008 12:15 PM | ---D | C] -- C:\WINDOWS\ServicePackFiles
[09/09/2008 12:16 PM | ---D | C] -- C:\WINDOWS\l2schemas
[09/09/2008 12:29 PM | ---D | C] -- C:\WINDOWS\Prefetch
[09/09/2008 12:47 PM | ---D | C] -- C:\WINDOWS\VirtualEar
[09/09/2008 12:49 PM | 00,001,084 | ---- | C] () -- C:\WINDOWS\DKAAP2DD.ini
[09/09/2008 12:49 PM | ---D | C] -- C:\WINDOWS\Microsoft.NET
[09/09/2008 12:49 PM | R-SD | C] -- C:\WINDOWS\assembly
[09/09/2008 12:52 PM | 00,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[09/09/2008 12:58 PM | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
[09/09/2008 12:58 PM | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
[09/09/2008 12:58 PM | -H-D | C] -- C:\WINDOWS\ie7
[09/10/2008 02:31 PM | ---D | C] -- C:\WINDOWS\temp
[09/10/2008 09:41 AM | 00,028,672 | ---- | C] (NirSoft) -- C:\WINDOWS\Nircmd.exe
[09/10/2008 09:41 AM | 00,049,152 | ---- | C] () -- C:\WINDOWS\VFind.exe
[09/10/2008 09:41 AM | 00,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[09/10/2008 09:41 AM | 00,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[09/10/2008 09:41 AM | 00,089,504 | ---- | C] (Smallfrogs Studio) -- C:\WINDOWS\fdsv.exe
[09/10/2008 09:41 AM | 00,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[09/10/2008 09:41 AM | 00,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\swsc.exe
[09/10/2008 09:41 AM | 00,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\swreg.exe
[09/10/2008 09:41 AM | 00,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\swxcacls.exe
[09/10/2008 09:41 AM | ---D | C] -- C:\WINDOWS\erdnt
[09/10/2008 10:04 AM | ---D | C] -- C:\WINDOWS\Minidump
[09/10/2008 10:25 AM | -HSD | C] -- C:\WINDOWS\CSC
[09/10/2008 11:59 AM | ---D | C] -- C:\WINDOWS\ERUNT
[09/09/2008 09:40 AM | 00,000,065 | RH-- | C] () -- C:\WINDOWS\tasks\desktop.ini
[09/09/2008 09:47 AM | 00,000,006 | -H-- | C] () -- C:\WINDOWS\tasks\SA.DAT
[09/09/2008 01:04 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[09/09/2008 02:26 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\NOS
[09/09/2008 05:22 AM | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[09/09/2008 05:22 AM | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[09/09/2008 11:53 AM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[09/09/2008 12:32 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Lavasoft
[09/09/2008 12:37 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg8
[09/09/2008 12:40 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[09/09/2008 12:42 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[09/10/2008 02:41 PM | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[09/09/2008 01:05 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\Adobe
[09/09/2008 01:05 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\Macromedia
[09/09/2008 02:37 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\uTorrent
[09/09/2008 09:53 AM | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\JohnBoy\Application Data\desktop.ini
[09/09/2008 09:53 AM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\Identities
[09/09/2008 09:53 AM | --SD | C] -- C:\Documents and Settings\JohnBoy\Application Data\Microsoft
[09/09/2008 12:40 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\Malwarebytes
[09/09/2008 12:41 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\SUPERAntiSpyware.com
[09/09/2008 12:52 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Application Data\Mozilla
[09/09/2008 03:37 PM | 00,013,104 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[09/09/2008 03:40 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Adobe
[09/09/2008 09:53 AM | ---D | C] -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Microsoft
[09/09/2008 10:05 AM | 04,810,788 | -H-- | C] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\IconCache.db
[09/09/2008 12:43 PM | 00,005,120 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[09/09/2008 12:52 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Mozilla
[09/10/2008 03:55 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\Identities
[09/09/2008 05:22 AM | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[09/09/2008 09:37 AM | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[09/09/2008 09:38 AM | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[09/09/2008 09:39 AM | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[09/09/2008 02:31 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\My Documents\Downloads
[09/09/2008 03:41 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\My Documents\backups
[09/09/2008 09:53 AM | 00,000,078 | -HS- | C] () -- C:\Documents and Settings\JohnBoy\My Documents\desktop.ini
[09/09/2008 09:53 AM | R--D | C] -- C:\Documents and Settings\JohnBoy\My Documents\My Music
[09/09/2008 09:53 AM | R--D | C] -- C:\Documents and Settings\JohnBoy\My Documents\My Pictures
[09/09/2008 12:41 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\My Documents\ATF
[09/09/2008 12:41 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\My Documents\Dial-a-fix-v0.60.0.24
[09/09/2008 01:04 PM | 00,001,736 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[09/09/2008 12:39 PM | 00,000,800 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[09/09/2008 12:40 PM | 00,000,703 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[09/09/2008 12:41 PM | 00,000,787 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[09/09/2008 12:52 PM | 00,001,609 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[09/09/2008 02:27 PM | 00,000,822 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\Internet Explorer.lnk
[09/09/2008 02:37 PM | 00,000,637 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\µTorrent.lnk
[09/09/2008 03:45 PM | 00,078,686 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\bfu.zip
[09/09/2008 03:45 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Desktop\bfu
[09/09/2008 12:40 PM | 00,001,555 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\CCleaner.lnk
[09/10/2008 01:59 PM | 00,214,517 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\Flash_Disinfector.exe
[09/10/2008 02:29 PM | 02,917,974 | R--- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe
[09/10/2008 02:40 PM | 15,083,520 | ---- | C] (Safer Networking Limited ) -- C:\Documents and Settings\JohnBoy\Desktop\spybotsd160.exe
[09/10/2008 02:41 PM | 00,000,940 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\Spybot - Search & Destroy.lnk
[09/10/2008 09:27 AM | 00,001,432 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\WinHelp200's DelDomains.inf
[09/10/2008 09:37 AM | ---D | C] -- C:\Documents and Settings\JohnBoy\Desktop\SysScan
[09/10/2008 10:12 AM | 00,318,775 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\CleanUp40.exe
[09/10/2008 10:12 AM | 00,724,952 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\avenger.zip
[09/10/2008 10:13 AM | 00,002,026 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\varestorepolicies.inf
[09/10/2008 10:15 AM | ---D | C] -- C:\Documents and Settings\JohnBoy\Desktop\avenger
[09/11/2008 05:16 PM | 00,001,741 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\HijackThis.lnk
[09/11/2008 07:53 AM | ---D | C] -- C:\Documents and Settings\JohnBoy\Desktop\avg sality tool
[09/11/2008 12:29 PM | 00,000,570 | ---- | C] () -- C:\Documents and Settings\JohnBoy\Desktop\VArestorepolicies.zip
[09/11/2008 12:49 PM | ---D | C] -- C:\Documents and Settings\JohnBoy\Desktop\VArestorepolicy
[09/12/2008 07:59 AM | 00,379,904 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\JohnBoy\Desktop\OTViewIt.exe
[09/09/2008 05:22 AM | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
 
[09/09/2008 09:53 AM | 00,000,084 | -HS- | C] () -- C:\Documents and Settings\JohnBoy\Start Menu\Programs\Startup\desktop.ini
[09/09/2008 01:03 PM | ---D | C] -- C:\Program Files\Common Files\Adobe
[09/09/2008 01:05 PM | ---D | C] -- C:\Program Files\Common Files\Adobe AIR
[09/09/2008 01:05 PM | ---D | C] -- C:\Program Files\Common Files\Java
[09/09/2008 05:23 AM | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[09/09/2008 05:23 AM | ---D | C] -- C:\Program Files\Common Files\ODBC
[09/09/2008 05:23 AM | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[09/09/2008 09:39 AM | ---D | C] -- C:\Program Files\Common Files\System
[09/09/2008 09:40 AM | ---D | C] -- C:\Program Files\Common Files\MSSoap
[09/09/2008 09:40 AM | ---D | C] -- C:\Program Files\Common Files\Services
[09/09/2008 10:07 AM | ---D | C] -- C:\Program Files\Common Files\InstallShield
[09/09/2008 12:38 PM | ---D | C] -- C:\Program Files\Common Files\Wise Installation
Wizard
[09/09/2008 01:03 PM | ---D | C] -- C:\Program Files\Adobe
[09/09/2008 01:06 PM | ---D | C] -- C:\Program Files\Java
[09/09/2008 02:26 PM | ---D | C] -- C:\Program Files\NOS
[09/09/2008 02:37 PM | ---D | C] -- C:\Program Files\uTorrent
[09/09/2008 02:51 PM | ---D | C] -- C:\Program Files\PunchClock
[09/09/2008 05:23 AM | ---D | C] -- C:\Program Files\Common Files
[09/09/2008 09:37 AM | ---D | C] -- C:\Program Files\MSN
[09/09/2008 09:37 AM | ---D | C] -- C:\Program Files\Windows NT
[09/09/2008 09:38 AM | ---D | C] -- C:\Program Files\ComPlus Applications
[09/09/2008 09:38 AM | ---D | C] -- C:\Program Files\Messenger
[09/09/2008 09:38 AM | ---D | C] -- C:\Program Files\MSN Gaming Zone
[09/09/2008 09:38 AM | ---D | C] -- C:\Program Files\Online Services
[09/09/2008 09:38 AM | ---D | C] -- C:\Program Files\Windows Media Player
[09/09/2008 09:39 AM | ---D | C] -- C:\Program Files\Internet Explorer
[09/09/2008 09:39 AM | ---D | C] -- C:\Program Files\NetMeeting
[09/09/2008 09:39 AM | ---D | C] -- C:\Program Files\Outlook Express
[09/09/2008 09:40 AM | ---D | C] -- C:\Program Files\Movie Maker
[09/09/2008 09:41 AM | -H-D | C] -- C:\Program Files\WindowsUpdate
[09/09/2008 09:43 AM | ---D | C] -- C:\Program Files\microsoft frontpage
[09/09/2008 09:43 AM | ---D | C] -- C:\Program Files\xerox
[09/09/2008 09:47 AM | -H-D | C] -- C:\Program Files\Uninstall Information
[09/09/2008 10:12 AM | ---D | C] -- C:\Program Files\Broadcom
[09/09/2008 10:13 AM | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[09/09/2008 12:37 PM | ---D | C] -- C:\Program Files\AVG
[09/09/2008 12:39 PM | ---D | C] -- C:\Program Files\Lavasoft
[09/09/2008 12:40 PM | ---D | C] -- C:\Program Files\CCleaner
[09/09/2008 12:40 PM | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[09/09/2008 12:41 PM | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[09/09/2008 12:47 PM | ---D | C] -- C:\Program Files\Analog Devices
[09/09/2008 12:49 PM | ---D | C] -- C:\Program Files\Dell_HostCD
[09/09/2008 12:51 PM | ---D | C] -- C:\Program Files\Mozilla Firefox
[09/09/2008 12:56 PM | ---D | C] -- C:\Program Files\Windows Media Connect 2
[09/10/2008 02:41 PM | ---D | C] -- C:\Program Files\CleanUp!
[09/10/2008 02:41 PM | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[09/11/2008 05:16 PM | ---D | C] -- C:\Program Files\Trend Micro
[09/11/2008 09:09 AM | ---D | C] -- C:\Program Files\Microsoft Silverlight

========== Files - Modified Within 30 days ==========

[09/09/2008 09:36 AM | 00,000,211 | -HS- | M] () -- C:\boot.ini
[09/09/2008 09:43 AM | 00,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[09/09/2008 09:43 AM | 00,000,000 | ---- | M] () -- C:\CONFIG.SYS
[09/09/2008 09:43 AM | 00,000,000 | RHS- | M] () -- C:\IO.SYS
[09/09/2008 09:43 AM | 00,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[09/09/2008 12:13 PM | 00,250,048 | RHS- | M] () -- C:\ntldr
[09/11/2008 03:16 PM | 00,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[09/09/2008 12:55 PM | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[09/10/2008 12:03 AM | 00,017,200 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[09/10/2008 12:04 AM | 00,038,528 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[09/09/2008 01:45 PM | 00,001,095 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.usr
[09/09/2008 01:46 PM | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[09/09/2008 09:39 AM | 00,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[09/09/2008 09:43 AM | 00,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[09/09/2008 09:46 AM | 00,000,261 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[09/09/2008 12:28 PM | 00,091,888 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[09/09/2008 12:49 PM | 00,001,502 | ---- | M] () -- C:\WINDOWS\System32\LexFiles.ulf
[09/09/2008 12:54 PM | 00,062,344 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[09/09/2008 12:54 PM | 00,401,064 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[09/09/2008 12:54 PM | 00,468,820 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[09/09/2008 12:56 PM | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[09/09/2008 12:56 PM | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[09/11/2008 07:53 AM | 00,344,064 | ---- | M] () -- C:\WINDOWS\System32\rmsality.nt
[09/09/2008 02:52 PM | 00,000,078 | ---- | M] () -- C:\WINDOWS\PCLOCK.INI
[09/09/2008 09:38 AM | 00,000,036 | ---- | M] () -- C:\WINDOWS\vb.ini
[09/09/2008 09:38 AM | 00,000,037 | ---- | M] () -- C:\WINDOWS\vbaddin.ini
[09/09/2008 09:41 AM | 00,000,749 | RH-- | M] () -- C:\WINDOWS\WindowsShell.Manifest
[09/09/2008 09:42 AM | 00,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[09/09/2008 09:43 AM | 00,000,000 | ---- | M] () -- C:\WINDOWS\control.ini
[09/09/2008 09:46 AM | 00,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[09/09/2008 12:49 PM | 00,001,084 | ---- | M] () -- C:\WINDOWS\DKAAP2DD.ini
[09/09/2008 12:52 PM | 00,000,000 | ---- | M] () -- C:\WINDOWS\nsreg.dat
[09/09/2008 12:55 PM | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[09/09/2008 12:56 PM | 00,000,507 | ---- | M] () -- C:\WINDOWS\win.ini
[09/11/2008 03:15 PM | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[09/11/2008 03:16 PM | 00,000,264 | ---- | M] () -- C:\WINDOWS\system.ini
[09/11/2008 03:15 PM | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[09/09/2008 05:22 AM | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\desktop.ini
[09/09/2008 05:22 AM | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\JohnBoy\Application Data\desktop.ini
[09/09/2008 03:37 PM | 00,013,104 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[09/09/2008 12:43 PM | 00,005,120 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[09/11/2008 08:09 AM | 04,810,788 | -H-- | M] () -- C:\Documents and Settings\JohnBoy\Local Settings\Application Data\IconCache.db
[09/09/2008 05:22 AM | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\All Users\Documents\desktop.ini
[09/09/2008 01:40 PM | 00,000,078 | -HS- | M] () -- C:\Documents and Settings\JohnBoy\My Documents\desktop.ini
[09/09/2008 01:04 PM | 00,001,736 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader 9.lnk
[09/09/2008 12:39 PM | 00,000,800 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[09/09/2008 12:41 PM | 00,000,787 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[09/09/2008 12:52 PM | 00,001,609 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[09/10/2008 01:14 PM | 00,000,703 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[09/09/2008 01:40 PM | 00,000,822 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\Internet Explorer.lnk
[09/09/2008 02:37 PM | 00,000,637 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\µTorrent.lnk
[09/09/2008 03:45 PM | 00,078,686 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\bfu.zip
[09/09/2008 12:40 PM | 00,001,555 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\CCleaner.lnk
[09/10/2008 01:59 PM | 00,214,517 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\Flash_Disinfector.exe
[09/10/2008 02:40 PM | 15,083,520 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\JohnBoy\Desktop\spybotsd160.exe
[09/10/2008 02:41 PM | 00,000,940 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\Spybot - Search & Destroy.lnk
[09/10/2008 09:27 AM | 00,001,432 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\WinHelp200's DelDomains.inf
[09/10/2008 10:12 AM | 00,318,775 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\CleanUp40.exe
[09/10/2008 10:12 AM | 00,724,952 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\avenger.zip
[09/10/2008 10:13 AM | 00,002,026 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\varestorepolicies.inf
[09/11/2008 05:16 PM | 00,001,741 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\HijackThis.lnk
[09/11/2008 08:14 AM | 02,917,974 | R--- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe
[09/11/2008 12:29 PM | 00,000,570 | ---- | M] () -- C:\Documents and Settings\JohnBoy\Desktop\VArestorepolicies.zip
[09/12/2008 07:59 AM | 00,379,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\JohnBoy\Desktop\OTViewIt.exe
[09/09/2008 09:43 AM | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\desktop.ini
[09/09/2008 09:43 AM | 00,000,084 | -HS- | M] () -- C:\Documents and Settings\JohnBoy\Start Menu\Programs\Startup\desktop.ini

< End of report >
 
Folder::
C:\WINDOWS\TEMP
Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.200#St orage]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\##192.168.0.201#Da ta]
Driver::
DAC970NT
Service::
DAC970NT
File::
C:\WINDOWS\system32\drivers\ejeqdo.sys
C:\WINDOWS\system32\rmsality.nt

That is from the AVG sality removal tool, it did nothing.....

Then i ran ComboFix with the Script Again
omboFix 08-09-12.02 - JohnBoy 2008-09-12 18:35:17.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.774 [GMT -4:00]
Running from: C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\JohnBoy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

F:\aqtimd.cmd
F:\autorun.inf
.
---- Previous Run -------
.
C:\WINDOWS\system32\rmsality.nt
C:\WINDOWS\TEMP
C:\WINDOWS\TEMP\winkoekph.exe
C:\WINDOWS\TEMP\winybaex.exe
F:\aqtimd.cmd

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_DAC970NT
-------\Legacy_DAC970NT
-------\Service_dac970nt


((((((((((((((((((((((((( Files Created from 2008-08-12 to 2008-09-12 )))))))))))))))))))))))))))))))
.

2008-09-12 12:10 . 2008-09-11 07:53 344,064 --a------ C:\WINDOWS\system32\rmsality.nt
2008-09-11 17:16 . 2008-09-11 17:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-11 09:09 . 2008-09-11 09:09 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\CleanUp!
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 12:00 . 2008-09-10 12:00 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-09-10 11:59 . 2008-09-10 11:59 <DIR> d-------- C:\WINDOWS\ERUNT
2008-09-10 10:14 . 2008-09-10 12:42 <DIR> d-------- C:\SDFix
2008-09-09 15:48 . 2008-09-09 15:49 <DIR> d-------- C:\!KillBox
2008-09-09 14:52 . 2008-09-09 14:52 78 --a------ C:\WINDOWS\PCLOCK.INI
2008-09-09 14:51 . 2008-09-09 14:51 <DIR> d-------- C:\Program Files\PunchClock
2008-09-09 14:37 . 2008-09-09 14:37 <DIR> d-------- C:\Program Files\uTorrent
2008-09-09 14:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\uTorrent
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Program Files\NOS
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-09-09 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 13:06 . 2008-09-09 13:06 <DIR> d-------- C:\Program Files\Java
2008-09-09 13:06 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-09-09 13:03 . 2008-09-09 13:04 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-09 12:56 . 2008-09-09 12:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-09 12:52 . 2008-09-09 12:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-09 12:49 . 2008-09-09 12:50 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-09-09 12:49 . 2008-09-09 12:49 <DIR> d-------- C:\Program Files\Dell_HostCD
2008-09-09 12:49 . 2004-03-05 12:19 315,392 --a------ C:\WINDOWS\system32\lexlog.dll
2008-09-09 12:49 . 2008-09-09 12:49 1,502 --a------ C:\WINDOWS\system32\LexFiles.ulf
2008-09-09 12:49 . 2008-09-09 13:45 1,095 --a------ C:\WINDOWS\system32\LexFiles.usr
2008-09-09 12:49 . 2008-09-09 12:49 1,084 --a------ C:\WINDOWS\DKAAP2DD.ini
2008-09-09 12:47 . 2008-09-09 12:47 <DIR> d-------- C:\Program Files\Analog Devices
2008-09-09 12:46 . 2001-09-19 12:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-09-09 12:46 . 2004-09-17 09:02 732,928 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-09-09 12:46 . 2004-09-23 07:55 311,296 --a------ C:\WINDOWS\system32\Edcrypt.dll
2008-09-09 12:46 . 2005-01-27 15:31 260,352 --a------ C:\WINDOWS\system32\drivers\smwdm.sys
2008-09-09 12:46 . 2004-10-05 16:10 23,040 --a------ C:\WINDOWS\system32\PostProc.dll
2008-09-09 12:42 . 2008-09-09 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-09 12:41 . 2008-09-10 11:06 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-09 12:41 . 2008-09-09 12:41 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\SUPERAntiSpyware.com
2008-09-09 12:40 . 2008-09-10 13:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-09 12:40 . 2008-09-10 11:04 <DIR> d-------- C:\Program Files\CCleaner
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 12:39 . 2008-09-09 12:39 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-09 12:38 . 2008-09-09 12:41 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-09 12:37 . 2008-09-09 12:37 <DIR> d-------- C:\Program Files\AVG
2008-09-09 12:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-09-09 12:32 . 2008-09-09 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-09 12:31 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-09 12:31 . 2008-05-01 10:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-09 12:31 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-09 12:31 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-09 12:15 . 2008-09-09 12:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-09 12:00 . 2004-08-03 22:29 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-09 11:25 . 2008-09-09 13:04 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-09 11:25 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-09 11:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-09 11:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-09 11:16 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-09 10:13 . 2008-09-09 12:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-09-09 10:12 . 2008-09-09 10:12 <DIR> d-------- C:\Program Files\Broadcom
2008-09-09 10:12 . 2003-06-30 18:11 43,136 -ra------ C:\WINDOWS\system32\drivers\bcm4sbxp.sys
2008-09-09 10:07 . 2008-09-09 12:46 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-09-09 10:06 . 2008-04-13 20:12 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 13:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2008-04-13 20:12 1111552 1fa7b368adb41c82daeffa3ea6b39c88 C:\WINDOWS\explorer.exe
2004-08-12 09:19 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-10_ 9.43.01.96 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 00:02:28 163,328 ----a-w C:\WINDOWS\erdnt\subs\ERDNT.EXE
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
+ 2008-09-10 15:59:41 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:41 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-08-07 20:27:04 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
+ 2008-09-10 15:59:40 1,376,256 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\NTUSER.DAT
+ 2008-09-10 15:59:40 372,736 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-09-12 22:29:30 2,200 ----a-w C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
- 2008-04-14 00:12:32 146,432 ----a-w C:\WINDOWS\regedit.exe
+ 2008-04-14 00:12:32 224,256 ----a-w C:\WINDOWS\regedit.exe
- 2008-04-14 00:12:14 389,120 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:14 462,848 ----a-w C:\WINDOWS\system32\cmd.exe
+ 2008-04-14 00:12:28 343,040 -c--a-w C:\WINDOWS\system32\dllcache\mspaint.exe
+ 2008-04-14 00:12:33 33,280 -c--a-w C:\WINDOWS\system32\dllcache\rundll32.exe
- 2006-11-01 22:31:38 1,669,120 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe
+ 2008-04-14 12:00:00 774,144 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe
- 2008-04-14 00:12:21 39,424 ----a-w C:\WINDOWS\system32\grpconv.exe
+ 2008-04-14 00:12:21 113,152 ----a-w C:\WINDOWS\system32\grpconv.exe
- 2008-04-14 00:12:28 343,040 ----a-w C:\WINDOWS\system32\mspaint.exe
+ 2008-04-14 00:12:28 420,864 ----a-w C:\WINDOWS\system32\mspaint.exe
- 2008-04-14 00:12:33 33,280 ----a-w C:\WINDOWS\system32\rundll32.exe
+ 2008-04-14 00:12:33 102,912 ----a-w C:\WINDOWS\system32\rundll32.exe
- 2008-04-14 00:12:05 438,272 ----a-w C:\WINDOWS\system32\shimgvw.dll
+ 2008-04-14 00:12:05 520,192 ----a-w C:\WINDOWS\system32\shimgvw.dll
- 2008-04-14 00:12:37 135,680 ----a-w C:\WINDOWS\system32\taskmgr.exe
+ 2008-04-14 00:12:37 209,408 ----a-w C:\WINDOWS\system32\taskmgr.exe
- 2008-04-14 00:12:11 338,432 ----a-w C:\WINDOWS\system32\zipfldr.dll
+ 2008-04-14 00:12:11 408,064 ----a-w C:\WINDOWS\system32\zipfldr.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 1213680]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-09 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-09 14:23 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"C:\\WINDOWS\\system32\\wuauclt.exe"=
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"=
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"=
"C:\\WINDOWS\\system32\\cmd.exe"=
"C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"C:\\SDFix\\apps\\Process.exe"=
"C:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=
"C:\\ComboFix\\regt.cfexe"=

S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]

*Newly Created Service* - DAC970NT
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-12 18:37:50
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac970nt]
"ImagePath"="\??\C:\WINDOWS\system32\drivers\ejeqdo.sys"
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\ComboFix\NirCmd.cfexe
.
**************************************************************************
.
Completion time: 2008-09-12 18:39:54 - machine was rebooted [JohnBoy]
ComboFix-quarantined-files.txt 2008-09-12 22:39:51
ComboFix2.txt 2008-09-11 19:18:31
ComboFix3.txt 2008-09-11 12:20:34
ComboFix4.txt 2008-09-10 14:39:02
ComboFix5.txt 2008-09-12 12:07:10

Pre-Run: 33,702,137,856 bytes free
Post-Run: 33,680,560,128 bytes free

231 --- E O F --- 2008-09-12 07:00:16
 
This did nothing, so i editied the script to this
Registry::
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac970nt]
"ImagePath"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\dac970nt]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\uTorrent.exe"=-
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"=-
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"=-
"C:\\SDFix\\apps\\Process.exe"=-
"C:\\ComboFix\\regt.cfexe"=-
File::
C:\WINDOWS\system32\drivers\ejeqdo.sys
Folder::
C:\SDFix
C:\!KillBox

ComboFix 08-09-12.02 - JohnBoy 2008-09-13 8:42:59.8 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.735 [GMT -4:00]
Running from: C:\Documents and Settings\JohnBoy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\JohnBoy\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-13 to 2008-09-13 )))))))))))))))))))))))))))))))
.

2008-09-12 18:46 . 2008-09-12 18:46 <DIR> d-------- C:\rsit
2008-09-12 12:10 . 2008-09-11 07:53 344,064 --a------ C:\WINDOWS\system32\rmsality.nt
2008-09-11 17:16 . 2008-09-11 17:16 <DIR> d-------- C:\Program Files\Trend Micro
2008-09-11 09:09 . 2008-09-11 09:09 <DIR> d-------- C:\Program Files\Microsoft Silverlight
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Program Files\CleanUp!
2008-09-10 14:41 . 2008-09-10 14:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-09-10 12:00 . 2008-09-10 12:00 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-09-10 11:59 . 2008-09-10 11:59 <DIR> d-------- C:\WINDOWS\ERUNT
2008-09-10 10:14 . 2008-09-10 12:42 <DIR> d-------- C:\SDFix
2008-09-09 15:48 . 2008-09-09 15:49 <DIR> d-------- C:\!KillBox
2008-09-09 14:52 . 2008-09-09 14:52 78 --a------ C:\WINDOWS\PCLOCK.INI
2008-09-09 14:51 . 2008-09-09 14:51 <DIR> d-------- C:\Program Files\PunchClock
2008-09-09 14:37 . 2008-09-09 14:37 <DIR> d-------- C:\Program Files\uTorrent
2008-09-09 14:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\uTorrent
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Program Files\NOS
2008-09-09 14:26 . 2008-09-09 14:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NOS
2008-09-09 13:13 . 2008-09-10 00:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-09 13:06 . 2008-09-09 13:06 <DIR> d-------- C:\Program Files\Java
2008-09-09 13:06 . 2008-06-10 02:32 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Java
2008-09-09 13:05 . 2008-09-09 13:05 <DIR> d-------- C:\Program Files\Common Files\Adobe AIR
2008-09-09 13:03 . 2008-09-09 13:04 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-09-09 12:56 . 2008-09-09 12:56 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-09-09 12:55 . 2008-09-09 12:55 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2008-09-09 12:52 . 2008-09-09 12:52 0 --a------ C:\WINDOWS\nsreg.dat
2008-09-09 12:49 . 2008-09-09 12:50 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-09-09 12:49 . 2008-09-09 12:49 <DIR> d-------- C:\Program Files\Dell_HostCD
2008-09-09 12:49 . 2004-03-05 12:19 315,392 --a------ C:\WINDOWS\system32\lexlog.dll
2008-09-09 12:49 . 2008-09-09 12:49 1,502 --a------ C:\WINDOWS\system32\LexFiles.ulf
2008-09-09 12:49 . 2008-09-09 13:45 1,095 --a------ C:\WINDOWS\system32\LexFiles.usr
2008-09-09 12:49 . 2008-09-09 12:49 1,084 --a------ C:\WINDOWS\DKAAP2DD.ini
2008-09-09 12:47 . 2008-09-09 12:47 <DIR> d-------- C:\Program Files\Analog Devices
2008-09-09 12:46 . 2001-09-19 12:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-09-09 12:46 . 2004-09-17 09:02 732,928 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-09-09 12:46 . 2004-09-23 07:55 311,296 --a------ C:\WINDOWS\system32\Edcrypt.dll
2008-09-09 12:46 . 2005-01-27 15:31 260,352 --a------ C:\WINDOWS\system32\drivers\smwdm.sys
2008-09-09 12:46 . 2004-10-05 16:10 23,040 --a------ C:\WINDOWS\system32\PostProc.dll
2008-09-09 12:42 . 2008-09-09 12:42 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-09 12:41 . 2008-09-10 11:06 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-09-09 12:41 . 2008-09-09 12:41 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\SUPERAntiSpyware.com
2008-09-09 12:40 . 2008-09-10 13:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-09 12:40 . 2008-09-10 11:04 <DIR> d-------- C:\Program Files\CCleaner
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\JohnBoy\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-09 12:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-09 12:40 . 2008-09-10 00:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-09 12:39 . 2008-09-09 12:39 <DIR> d-------- C:\Program Files\Lavasoft
2008-09-09 12:38 . 2008-09-09 12:41 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-09-09 12:37 . 2008-09-09 12:37 <DIR> d-------- C:\Program Files\AVG
2008-09-09 12:37 . 2008-09-09 15:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-09-09 12:32 . 2008-09-09 12:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-09-09 12:31 . 2008-04-11 15:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-09-09 12:31 . 2008-05-01 10:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-09-09 12:31 . 2008-06-13 07:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-09-09 12:31 . 2008-05-08 10:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-09 12:30 . 2008-04-13 14:47 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2008-09-09 12:30 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
2008-09-09 12:30 . 2008-04-13 14:45 10,368 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\en
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\system32\bits
2008-09-09 12:16 . 2008-09-09 12:16 <DIR> d-------- C:\WINDOWS\l2schemas
2008-09-09 12:15 . 2008-09-09 12:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-09-09 12:00 . 2004-08-03 22:29 701,440 --------- C:\WINDOWS\system32\drivers\ati2mtag.sys
2008-09-09 11:25 . 2008-09-09 13:04 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-09-09 11:25 . 2007-08-10 20:46 26,488 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-09-09 11:16 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\system32\wups2.dll
2008-09-09 11:16 . 2007-07-30 19:18 34,136 --a------ C:\WINDOWS\system32\wucltui.dll.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuaucpl.cpl.mui
2008-09-09 11:16 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui
2008-09-09 11:16 . 2007-07-30 19:18 20,312 --a------ C:\WINDOWS\system32\wuaueng.dll.mui
2008-09-09 10:13 . 2008-09-09 12:47 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-09-09 10:12 . 2008-09-09 10:12 <DIR> d-------- C:\Program Files\Broadcom
2008-09-09 10:12 . 2003-06-30 18:11 43,136 -ra------ C:\WINDOWS\system32\drivers\bcm4sbxp.sys
2008-09-09 10:07 . 2008-09-09 12:46 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-09-09 10:06 . 2008-04-13 20:12 4,274,816 --a------ C:\WINDOWS\system32\nv4_disp.dll
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2008-09-09 10:06 . 2004-08-03 22:29 1,897,408 --a--c--- C:\WINDOWS\system32\dllcache\nv4_mini.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-09 13:43 --------- d-----w C:\Program Files\microsoft frontpage
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 16:57 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2008-04-13 20:12 1111552 1fa7b368adb41c82daeffa3ea6b39c88 C:\WINDOWS\explorer.exe
2004-08-12 09:19 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\explorer.exe
2008-04-13 20:12 1033728 12896823fb95bfb3dc9b46bcaedc9923 C:\WINDOWS\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2008-07-29 1213680]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-09-09 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-09-09 14:23 352256 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\ctfmon.exe"=
"C:\\WINDOWS\\system32\\wuauclt.exe"=
"C:\\Documents and Settings\\JohnBoy\\My Documents\\Dial-a-fix-v0.60.0.24\\Dial-a-fix-v0.60.0.24\\Dial-a-fix.exe"=
"C:\\Documents and Settings\\JohnBoy\\Desktop\\ComboFix.exe"=
"C:\\WINDOWS\\system32\\cmd.exe"=
"C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"C:\\SDFix\\apps\\Process.exe"=
"C:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=
"C:\\ComboFix\\regt.cfexe"=

R3 dac970nt;dac970nt;C:\WINDOWS\system32\drivers\ejeqdo.sys [ ]
S3 getPlus(R) Helper;getPlus(R) Helper;C:\Program Files\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-13 08:43:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-13 8:45:30
ComboFix-quarantined-files.txt 2008-09-13 12:45:26
ComboFix2.txt 2008-09-12 22:39:55
ComboFix3.txt 2008-09-11 19:18:31
ComboFix4.txt 2008-09-11 12:20:34
ComboFix5.txt 2008-09-13 12:42:42

Pre-Run: 33,214,754,816 bytes free
Post-Run: 33,218,068,480 bytes free

172 --- E O F --- 2008-09-13 07:00:16
 
At this point, i gave up on the XP machine, and started to work on the servers
 
Today i am going to try to install firefox on the server so i can run a online virus scan to see what it picks up.
 
If the servers are infected...how many of the other computers on the network are infected?

If the IT guys stuff got infected, what about average Joe User?
 
Fuck, taking alook at the mess your in and also readin up on said virus, I really think it would be easier to flatten and reload yourservers, the virus disables a shit ton of AntiVirus apps, so I dont think you can ever be really sure that you will have a clean machine unless you reinstall.

It disables AVG, Kaspersky, Norton, Mcafee and NOD32, I think avast is ok, but here is a list from that site that you listed of the security apps that it disables, so try and not use those apps to scan your rigs.

Terminates Processes

Sality searches for and terminates any processes which match a list contained in its code; the following is an example of such a list:

AVXQUAR
ICSUPP
ICSSUPPNT
ESCANH
AVLTMAIN
VSMAIN
TRJSCAN
PROTECTX
PORTDETECTIVE
PINGSCAN
PERISCOPE
NPFMESSENGER
MCAGENT
LOCKDOWN
DRWTSN32
DRWATSON
CLEANER
BLACKICE
BIPCP
BIDSERVER
BIDEF
AVPROTECT
AVGSERV
ATGUARD
AVSYNMGR
AUTOTRACE
SAVSCAN
RTVSCAN
NUPGRADE
NPROTECT
MGUI
MCUPDATE
NMAIN
ANTI
NOD32
ZONEALARM
OUTPOST
DRWEB
KAV
AVP
NAV



It also overwrites exe's with its own code, so you would have to replace all of those exe's with uninfected ones.

Also since its your works servers and since said virus steals passwords and user info etc, you should tell your boss that IT has to be formatted otherwise he runs the risk of personal info whatever that maybe ending up in some dickheads hands and if that info is customers info then maybe that could lead to a law suit of sometype ?

Whatever, that virus does seem to be a bastard to deal with, its destructiveness is rated as HIGH, the dicks who make these things need a good kicking.

I would try AVAST as that is missing from the list of terminated services, so try that and see what avast will pick up, although the verison of the virus you have may have been updated to include avast in its disable process.

EDIT:
Ahwell, forget about avast, as over at the nod32 website, that terminate list also shows avast and a few other AV apps that get disabled by win32 sality.

http://www.eset.cz/buxus/generate_page.php?page_id=20616

^
has more helpful info about what the virus does and where it goes on your pc than CA's website shows.

Fuck, I dont think anything can stop this thing once the infection takes hold, as it seems capable of disabling every AV and antispyware etc app out there :eek:
 
dbwillis said:
If the servers are infected...how many of the other computers on the network are infected?

If the IT guys stuff got infected, what about average Joe User?
Click to expand...

This hole mess started because i plugged a infected drive into my machine to clean. I had Mapped drives back to the server's. The infected spread like wildfire.
I have everything cleaned and reloaded but the server's
 
EVIL-SCOTSMAN said:
Fuck, taking alook at the mess your in and also readin up on said virus, I really think it would be easier to flatten and reload yourservers, the virus disables a shit ton of AntiVirus apps, so I dont think you can ever be really sure that you will have a clean machine unless you reinstall.

It disables AVG, Kaspersky, Norton, Mcafee and NOD32, I think avast is ok, but here is a list from that site that you listed of the security apps that it disables, so try and not use those apps to scan your rigs.

Terminates Processes

Sality searches for and terminates any processes which match a list contained in its code; the following is an example of such a list:

AVXQUAR
ICSUPP
ICSSUPPNT
ESCANH
AVLTMAIN
VSMAIN
TRJSCAN
PROTECTX
PORTDETECTIVE
PINGSCAN
PERISCOPE
NPFMESSENGER
MCAGENT
LOCKDOWN
DRWTSN32
DRWATSON
CLEANER
BLACKICE
BIPCP
BIDSERVER
BIDEF
AVPROTECT
AVGSERV
ATGUARD
AVSYNMGR
AUTOTRACE
SAVSCAN
RTVSCAN
NUPGRADE
NPROTECT
MGUI
MCUPDATE
NMAIN
ANTI
NOD32
ZONEALARM
OUTPOST
DRWEB
KAV
AVP
NAV



It also overwrites exe's with its own code, so you would have to replace all of those exe's with uninfected ones.

Also since its your works servers and since said virus steals passwords and user info etc, you should tell your boss that IT has to be formatted otherwise he runs the risk of personal info whatever that maybe ending up in some dickheads hands and if that info is customers info then maybe that could lead to a law suit of sometype ?

Whatever, that virus does seem to be a bastard to deal with, its destructiveness is rated as HIGH, the dicks who make these things need a good kicking.

I would try AVAST as that is missing from the list of terminated services, so try that and see what avast will pick up, although the verison of the virus you have may have been updated to include avast in its disable process.

EDIT:
Ahwell, forget about avast, as over at the nod32 website, that terminate list also shows avast and a few other AV apps that get disabled by win32 sality.

http://www.eset.cz/buxus/generate_page.php?page_id=20616

^
has more helpful info about what the virus does and where it goes on your pc than CA's website shows.

Fuck, I dont think anything can stop this thing once the infection takes hold, as it seems capable of disabling every AV and antispyware etc app out there :eek:
Click to expand...

I can run CureIt, but like stated, all the exe files are infected. And sadly some of those we dont have on CD's. Why i dont know... But the fact remains is yes our server's are totally hosed. Thankfully one is only internal DNS server, i can reload that thing in a hour and have it fixed. Its the other server that worries me. It is our QuickBooks and Emerald server that we do all our billing on.
 
-(Xyphox)- said:
I can run CureIt, but like stated, all the exe files are infected. And sadly some of those we dont have on CD's. Why i dont know... But the fact remains is yes our server's are totally hosed. Thankfully one is only internal DNS server, i can reload that thing in a hour and have it fixed. Its the other server that worries me. It is our QuickBooks and Emerald server that we do all our billing on.
Click to expand...

Backup all the QBW and ND files, format, reload.

We just moved our entire Quickbooks directory to a new server and it was a pretty simple process. Can't speak for Emerald though.

Honestly you're going to spend far more man hour trying to fix something that likely will leave you in a worse-off position than you would just coming up with a recovery plan.
 
The Donut said:
Backup all the QBW and ND files, format, reload.

We just moved our entire Quickbooks directory to a new server and it was a pretty simple process. Can't speak for Emerald though.

Honestly you're going to spend far more man hour trying to fix something that likely will leave you in a worse-off position than you would just coming up with a recovery plan.
Click to expand...

Emerald we can backup from within the program it's self
 
I told the boss we need to reload the 2 server's and he just walked away. So guessing he does not like this idea
 
I got lost in the wall of text Johnboy. Is that the official AD name you use for your domain logins? Maybe the admin account?

Downtime is frowned upon but a necessary evil espcially if the files keep getting re-infected. There is also wasted time too. Too bad managment doesn't understand you can't always have your cake and eat it too. Have the downtime on a friday afternoon. Everyone goes home early if it's that mission critical. The hourly guys will get mad, the salary guys cheer. You are the only one who has to stay the whole weekend fixing the messed up server.
 
Bleh, I hate forums sometimes. Had a nice post all typed out that just disappeared when I clicked Submit, dammit.

The basic gist of the post was:

Been there, done that, a few hundred times, with clients and thousands of workstations and 50+ servers all serving the same in-house infrastructure. Sometimes, there simply is no other choice. I know the "boss" doesn't like it, but honestly you simply can't sit around hoping to happen upon a solution that'll magically make it all better like a Band-Aid or something.

The infections/infestations are too severe, affecting too many systems, and all the certs in the world behind your name or job title aren't going to help. The prudent solution - given the amount of effort and time already expended on this - is to get it done and that means a reload, unfortunately. I've encountered resistance from management over the past 2 decades when I was "in" the field we now label as "I.T." before people ever considered it information technology, just "the computer department." Whenever I encountered resistance, all I had to do was put it in terms they can always understand:

"Leave it the way it is, lose money every minute. Give me the authorization to get it done and we'll be up and running at full steam (or whatever terms you choose to say here) and back to making money..." or words to that effect.

When you can present it from a cost perspective and how much it's costing not to resolve it once and for all, if they're management with half a brain they'll OK the reload and then someone will get it done.

I'm not meaning to belittle your knowledge and experience, Xyphox, but your knowledge and experience can only get you so far in such a situation. You're behind, the infections/infestations have won, it's time to toss in the towel and wipe home plate clean for the next pitch.

Batter up...
 
calikool said:
I got lost in the wall of text Johnboy. Is that the official AD name you use for your domain logins? Maybe the admin account?

Downtime is frowned upon but a necessary evil espcially if the files keep getting re-infected. There is also wasted time too. Too bad managment doesn't understand you can't always have your cake and eat it too. Have the downtime on a friday afternoon. Everyone goes home early if it's that mission critical. The hourly guys will get mad, the salary guys cheer. You are the only one who has to stay the whole weekend fixing the messed up server.
Click to expand...

All those logs were of the attempted cleanup of my workstation. Johnboy is the name of my workstation, my name is John, everyone at work calls me JohnBoy....
 
I am still trying to research a solution that does not involve formatting the server's. With all the different programs out there, one would think there is a formula for removal of this virus.
 
Based on what you've done so far, I'd say it ain't gonna happen.

But good luck with your efforts, regardless.
 
Cut your losses- reinstall server.

Tell your boss either it's 1 day re-installing the server and getting all the apps back on, or another week (or more) trying to find fixes.

Just be sure to copy the data off of it first, obviously, and before restoring it anywhere- SCAN THE DATA ITSELF to make sure there's nothing in it.

If you're in charge of IT- reinstall the server. Your boss doesn't have any clue what's going on, most likely.
 
I would have said that the only way to ensure you can remove infections this serious without reinstalling is to turn the machine off and fix the files on the hard drive using a different clean machine/partition/OS..but of course this probably has no advantages over reinstalling. (As was said higher up, a BartPE boot could load those registry hives for fixing but thats probably only a fraction of a solution).

Could you find a temporary server to setup using all important data from the original server and then make the switch?

In future perhaps new software could be tested in virtual machines? If not, then it could be tested in a sandbox using "sandboxie" or something similar (although this will not be safe for programs that install drivers).

Good luck!
 
TechieSooner said:
Cut your losses- reinstall server.

Tell your boss either it's 1 day re-installing the server and getting all the apps back on, or another week (or more) trying to find fixes.

Just be sure to copy the data off of it first, obviously, and before restoring it anywhere- SCAN THE DATA ITSELF to make sure there's nothing in it.

If you're in charge of IT- reinstall the server. Your boss doesn't have any clue what's going on, most likely.
Click to expand...

I am in charge of IT, but my boss does know what i am doing is the hard part. After a very long weekend my goal this morning is to get working CLEAN backup's of everything on the two server's and go from there.
 
You must log in or register to reply here.
Back
Top