msn link virus..

Deetech · 07-01-2009, 10:39 AM

Hai osiris, I need you help to analyse my hijackthis log, see if there's anything wrong with it. I know msn viruses are common nowadays.but its just that its annoying. I accidentally click which I am not supposed to. I did un-installed and re-installed back msn, but the problem presists. i tried to run my anti-virus Nod32 and spybot.but it didnt detect anything. I download 2 of the best msnvirus removal but still the same.

Thank you for your time..
__________________________________________________ _____________________________________

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:33:55 PM, on 7/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dlcgcoms.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gigabyte\Gigabyte GN-WIKG Wireless Mini PCI Adapter\GbConfig.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\sw g.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Menu] F:\Autorun.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtim e.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\dina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GN-WIKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WIKG Wireless Mini PCI Adapter\GbConfig.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 9080 bytes

patonb · 07-01-2009, 11:24 AM

Which virus is it?

If its the one where youre spamming randomly, just change your password.

Osiris · 07-01-2009, 11:47 AM

Remove

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)

Run malwarebytes and post a new hijackthis log

Deetech · 07-01-2009, 11:54 AM

Quote:

Originally Posted by patonb

Which virus is it?

If its the one where youre spamming randomly, just change your password.

I was chatting with my colleague and then suddenly he sent me a link. we are aware of not clicking any link like "I FOUND YOUR PICTURE AT IMAGESHACK bla...bla..". but he directly sent me a link so i stupidly clicked it, because he seldom send me any link, unless we want to share some info. then I asked him if he did sent me any, he said he didn't..oh well.....too late..

BELOW is the link i clicked.P/S DON'T CLICK IT.I JUST WANT TO LET YOU SEE THE LINK
-------> :// imgutm.lmageshack.net /imglaqis .jpg<--------------

patonb · 07-01-2009, 11:58 AM

Okay... thats not the one my mom got....

Deetech · 07-01-2009, 12:11 PM

Thank You osiris. I will run full scan tonight and I will post new hijackthis log again tomorow morning

Deetech · 07-01-2009, 08:12 PM

malwarebytes detected one backdoor in my registry as shown below:

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\taskman (Backdoor.Bot) -> Quarantined and deleted successfully.

__________________________________________________ ______________________________
below are my new hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:11:31 AM, on 7/2/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\dlcgcoms.exe
C:\Program Files\ESET\ESET Smart Security\ekrn.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\Program Files\Dell AIO 810\dlcgmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Free Download Manager\FUM\fumoei.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gigabyte\Gigabyte GN-WIKG Wireless Mini PCI Adapter\GbConfig.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\dina\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = MSN.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = Bing
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = Bing
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = MSN.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\sw g.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Menu] F:\Autorun.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [CameraFixer] C:\WINDOWS\CameraFixer.exe
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtim e.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [dlcgmon.exe] "C:\Program Files\Dell AIO 810\dlcgmon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\dina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [Free Uploader Oe Integration] C:\Program Files\Free Download Manager\FUM\fumoei.exe
O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: GN-WIKG Utility.lnk = C:\Program Files\Gigabyte\Gigabyte GN-WIKG Wireless Mini PCI Adapter\GbConfig.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\FUM\fumiebtn.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 8678 bytes

Osiris · 07-02-2009, 08:26 AM

Log looks good.

Go ahead and run combofix and post its log as well and then run malwarebytes one more time after combofix to see if the infection returned.

Reinstall MSN messenger as well.

Deetech · 07-02-2009, 10:35 PM

Here are the combofix log file

__________________________________________________ ___________________________________
ComboFix 09-07-01.04 - dina 07/03/2009 10:23.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.991.680 [GMT 8:00]
Running from: c:\documents and settings\dina\My Documents\Downloads\ComboFix.exe
AV: ESET Smart Security 3.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
FW: ESET Personal firewall *enabled* {E5E70D32-0101-4340-86A3-A7B0F1C8FFE0}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycler\S-1-5-21-5385664339-5764854189-566910044-8174\rundll32.exe

.
((((((((((((((((((((((((( Files Created from 2009-06-03 to 2009-07-03 )))))))))))))))))))))))))))))))
.

2009-07-02 13:06 . 2009-07-02 13:06 -------- d-----w- c:\documents and settings\dina\Application Data\vlc
2009-07-01 16:05 . 2009-07-01 16:05 -------- d-----w- c:\documents and settings\dina\Application Data\Malwarebytes
2009-07-01 16:05 . 2009-06-17 03:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-01 16:05 . 2009-07-01 16:05 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-01 16:05 . 2009-06-17 03:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-01 16:05 . 2009-07-01 16:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-01 14:33 . 2009-07-01 14:33 -------- d-----w- c:\program files\Trend Micro
2009-06-30 12:26 . 2009-06-30 12:26 -------- d-----w- c:\documents and settings\dina\Application Data\Media Player Classic
2009-06-30 07:22 . 2009-06-30 07:22 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-29 14:08 . 2001-08-17 14:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2009-06-29 14:08 . 2008-04-13 21:42 159232 ----a-w- c:\windows\system32\ptpusd.dll
2009-06-29 12:53 . 2009-06-29 12:53 -------- d-----w- c:\documents and settings\dina\Application Data\DellFaxCtr
2009-06-29 04:21 . 2009-06-29 04:21 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallShield
2009-06-29 04:19 . 2006-04-24 19:58 98345 ----a-w- c:\windows\system32\IMHOST32.DLL
2009-06-29 04:19 . 2006-04-24 19:58 339968 ----a-w- c:\windows\system32\IMGMAN32.DLL
2009-06-29 04:19 . 2009-06-29 04:19 -------- d-----w- c:\documents and settings\All Users\Application Data\DellFaxCtr
2009-06-29 04:17 . 2009-06-30 12:17 -------- d-----w- c:\program files\Dell Fax Solutions
2009-06-29 04:17 . 2009-06-29 04:28 -------- d-----w- c:\program files\Dl_cats
2009-06-29 04:16 . 2005-08-18 10:26 40960 ----a-w- c:\windows\system32\dlcgvs.dll
2009-06-29 04:16 . 2006-11-07 16:30 344064 ----a-w- c:\windows\system32\dlcgcoin.dll
2009-06-29 04:16 . 2008-04-13 16:15 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-29 04:16 . 2008-04-13 16:15 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-29 04:12 . 2008-04-13 16:17 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-06-29 04:12 . 2008-04-13 16:17 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-06-29 04:08 . 2008-04-13 16:15 32128 -c--a-w- c:\windows\system32\dllcache\usbccgp.sys
2009-06-29 04:08 . 2008-04-13 16:15 32128 ----a-w- c:\windows\system32\drivers\usbccgp.sys
2009-06-28 09:54 . 2009-06-28 09:54 -------- d-sh--w- c:\documents and settings\dina\PrivacIE
2009-06-28 02:04 . 2009-06-28 02:04 -------- d--h--w- c:\windows\$hf_mig$
2009-06-27 13:18 . 2008-04-13 16:09 5504 -c--a-w- c:\windows\system32\dllcache\mstee.sys
2009-06-27 13:18 . 2008-04-13 16:09 5504 ----a-w- c:\windows\system32\drivers\MSTEE.sys
2009-06-27 13:18 . 2008-04-13 16:16 10880 -c--a-w- c:\windows\system32\dllcache\ndisip.sys
2009-06-27 13:18 . 2008-04-13 16:16 10880 ----a-w- c:\windows\system32\drivers\NdisIP.sys
2009-06-27 13:17 . 2008-04-13 16:16 15232 -c--a-w- c:\windows\system32\dllcache\streamip.sys
2009-06-27 13:17 . 2008-04-13 16:16 15232 ----a-w- c:\windows\system32\drivers\StreamIP.sys
2009-06-27 13:17 . 2008-04-13 16:16 11136 -c--a-w- c:\windows\system32\dllcache\slip.sys
2009-06-27 13:17 . 2008-04-13 16:16 11136 ----a-w- c:\windows\system32\drivers\SLIP.sys
2009-06-27 13:17 . 2008-04-13 16:16 19200 -c--a-w- c:\windows\system32\dllcache\wstcodec.sys
2009-06-27 13:17 . 2008-04-13 16:16 19200 ----a-w- c:\windows\system32\drivers\WSTCODEC.SYS
2009-06-27 13:17 . 2008-04-13 16:16 85248 -c--a-w- c:\windows\system32\dllcache\nabtsfec.sys
2009-06-27 13:17 . 2008-04-13 16:16 85248 ----a-w- c:\windows\system32\drivers\NABTSFEC.sys
2009-06-27 13:17 . 2008-04-13 16:16 17024 -c--a-w- c:\windows\system32\dllcache\ccdecode.sys
2009-06-27 13:17 . 2008-04-13 16:16 17024 ----a-w- c:\windows\system32\drivers\CCDECODE.sys
2009-06-27 13:01 . 2006-08-21 06:22 81920 ----a-w- c:\windows\amcap.exe
2009-06-27 13:00 . 2009-06-27 13:00 -------- d-----w- c:\documents and settings\dina\Local Settings\Application Data\ESET
2009-06-27 13:00 . 2006-08-21 06:35 114688 ----a-w- c:\windows\tsnpstd3.exe
2009-06-27 13:00 . 2009-06-27 13:00 -------- d-----w- c:\program files\Common Files\snpstd3
2009-06-27 13:00 . 2006-08-21 06:29 151552 ----a-w- c:\windows\system32\rsnpstd3.dll
2009-06-27 13:00 . 2006-05-10 01:19 20480 ----a-w- c:\windows\usnpstd3.exe
2009-06-27 13:00 . 2005-12-23 09:17 53248 ----a-w- c:\windows\vsnpstd3.dll
2009-06-27 13:00 . 2005-11-23 05:55 53248 ----a-w- c:\windows\system32\csnpstd3.dll
2009-06-27 12:58 . 2006-05-10 01:20 344064 ----a-w- c:\windows\vsnpstd3.exe
2009-06-27 12:58 . 2006-02-06 12:19 8410880 ----a-w- c:\windows\system32\drivers\snpstd3.sys
2009-06-27 12:57 . 2008-04-13 21:42 53760 -c--a-w- c:\windows\system32\dllcache\vfwwdm32.dll
2009-06-27 12:57 . 2008-04-13 21:42 53760 ----a-w- c:\windows\system32\vfwwdm32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2009-07-02 10:13 . 2009-06-27 03:20 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-07-01 15:05 . 2009-06-27 03:36 -------- d-----w- c:\documents and settings\dina\Application Data\Free Download Manager
2009-06-29 15:21 . 2009-06-27 02:29 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-06-29 04:21 . 2009-06-27 02:40 -------- d-----w- c:\program files\Common Files\InstallShield
2009-06-29 04:18 . 2009-06-29 04:15 -------- d-----w- c:\program files\Dell AIO 810
2009-06-27 13:00 . 2009-06-27 02:40 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-06-27 07:35 . 2009-06-27 03:10 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-27 07:33 . 2009-06-27 03:10 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-27 07:27 . 2009-06-27 07:27 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-06-27 07:01 . 2009-06-27 07:01 -------- d-----w- c:\program files\Common Files\Windows Live
2009-06-27 07:00 . 2009-06-27 07:00 68456 ----a-w- c:\documents and settings\dina\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-06-27 06:48 . 2009-06-27 06:14 -------- d-----w- c:\program files\Java
2009-06-27 06:46 . 2009-06-27 06:46 152576 ----a-w- c:\documents and settings\dina\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-27 06:33 . 2009-06-27 06:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Nokia
2009-06-27 06:32 . 2009-06-27 06:25 -------- d-----w- c:\program files\Common Files\Nokia
2009-06-27 06:32 . 2009-06-27 06:24 -------- d-----w- c:\program files\Nokia
2009-06-27 06:29 . 2009-06-27 06:29 3351812 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9F59C3AE-81B0-4EF6-9762-D674BB079705}\Installer\CommonCustomActions\msxml6 Exec.exe
2009-06-27 06:29 . 2009-06-27 06:29 36864 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9F59C3AE-81B0-4EF6-9762-D674BB079705}\Installer\CommonCustomActions\Sleep. exe
2009-06-27 06:29 . 2009-06-27 06:29 3181612 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9F59C3AE-81B0-4EF6-9762-D674BB079705}\Installer\CommonCustomActions\vcredi stExec.exe
2009-06-27 06:29 . 2009-06-27 06:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Installations
2009-06-27 06:28 . 2009-06-27 06:25 -------- d-----w- c:\documents and settings\dina\Application Data\PC Suite
2009-06-27 06:28 . 2009-06-27 06:25 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Suite
2009-06-27 06:28 . 2009-06-27 06:28 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_010 07.Wdf
2009-06-27 06:28 . 2009-06-27 06:28 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_C oinstaller_Critical.Wdf
2009-06-27 06:25 . 2009-06-27 06:25 -------- d-----w- c:\documents and settings\dina\Application Data\Nokia
2009-06-27 06:25 . 2009-06-27 06:25 -------- d-----w- c:\program files\Common Files\PCSuite
2009-06-27 06:25 . 2009-06-27 06:25 -------- d-----w- c:\program files\DIFX
2009-06-27 06:24 . 2009-06-27 06:24 -------- d-----w- c:\program files\PC Connectivity Solution
2009-06-27 06:24 . 2009-06-27 06:24 8192 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\Uninst CCD.exe
2009-06-27 06:24 . 2009-06-27 06:24 61440 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\Uninst PCSFEMsi.exe
2009-06-27 06:24 . 2009-06-27 06:24 10240 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Installer\CommonCustomActions\Uninst PCS.exe
2009-06-27 06:20 . 2009-06-27 03:01 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-27 06:15 . 2009-06-27 06:11 -------- d-----w- c:\program files\LimeWire
2009-06-27 06:14 . 2009-06-27 06:14 152576 ----a-w- c:\documents and settings\dina\Application Data\Sun\Java\jre1.6.0_11\lzma.dll
2009-06-27 06:08 . 2009-06-27 06:08 -------- d-----w- c:\program files\VideoLAN
2009-06-27 06:04 . 2009-06-27 06:04 -------- d-----w- c:\program files\Windows Media Connect 2
2009-06-27 03:50 . 2009-06-27 03:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-06-27 03:48 . 2009-06-27 03:48 -------- d-----w- c:\program files\Microsoft Works
2009-06-27 03:48 . 2009-06-27 03:48 -------- d-----w- c:\program files\MSBuild
2009-06-27 03:36 . 2009-06-27 03:36 -------- d-----w- c:\program files\Free Download Manager
2009-06-27 03:36 . 2009-06-27 03:36 -------- d-----w- c:\documents and settings\All Users\Application Data\FreeDownloadManager.ORG
2009-06-27 03:35 . 2009-06-27 03:35 -------- d-----w- c:\program files\Auslogics
2009-06-27 03:25 . 2009-06-27 03:22 -------- dcsh--w- c:\program files\Common Files\WindowsLiveInstaller
2009-06-27 03:21 . 2009-06-27 03:21 -------- d-----w- c:\documents and settings\All Users\Application Data\WLInstaller
2009-06-27 03:20 . 2009-06-27 03:20 -------- d-----w- c:\program files\Google
2009-06-27 03:05 . 2009-06-27 03:05 11861 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2009-06-27 03:05 . 2009-06-27 03:05 -------- d-----w- c:\program files\Gigabyte
2009-06-27 03:02 . 2009-06-27 03:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Adobe Systems
2009-06-27 03:02 . 2009-06-27 03:02 -------- d-----w- c:\program files\Common Files\Adobe Systems Shared
2009-06-27 02:53 . 2009-06-27 02:53 -------- d-----w- c:\documents and settings\dina\Application Data\ESET
2009-06-27 02:50 . 2009-06-27 02:50 -------- d-----w- c:\program files\ESET
2009-06-27 02:50 . 2009-06-27 02:50 -------- d-----w- c:\documents and settings\All Users\Application Data\ESET
2009-06-27 02:47 . 2009-06-27 02:47 -------- d-----w- c:\program files\ClevoMailCheck
2009-06-27 02:46 . 2009-06-27 02:46 249856 ------w- c:\windows\Setup1.exe
2009-06-27 02:46 . 2009-06-27 02:46 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-06-27 02:46 . 2009-06-27 02:46 -------- d-----w- c:\program files\Synaptics
2009-06-27 02:42 . 2009-06-27 02:42 -------- d-----w- c:\program files\Realtek Sound Manager
2009-06-27 02:42 . 2009-06-27 02:42 -------- d-----w- c:\program files\AvRack
2009-06-27 02:41 . 2009-06-27 02:41 -------- d-----w- c:\program files\Intel
2009-06-27 02:31 . 2009-06-27 02:31 -------- d-----w- c:\program files\microsoft frontpage
2009-06-27 02:26 . 2009-06-27 02:26 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-06-13 07:10 . 2009-06-27 06:30 24376008 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{9F59C3AE-81B0-4EF6-9762-D674BB079705}\NokiaSoftwareUpdaterSetup_en.exe
2009-06-12 06:16 . 2009-06-27 06:24 34348464 ----a-w- c:\documents and settings\All Users\Application Data\Installations\{AC4E9457-107B-448F-AD89-605E122E8C59}\Nokia_PC_Suite_7_1_26_1_eng_web.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Google Update"="c:\documents and settings\dina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-27 133104]
"Free Uploader Oe Integration"="c:\program files\Free Download Manager\FUM\fumoei.exe" [2007-06-10 40960]
"PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe" [2009-05-18 1312256]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2003-12-15 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2003-12-15 118784]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2002-12-05 126976]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2002-12-06 569344]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2008-07-01 1447168]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-11 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-08 148888]
"tsnpstd3"="c:\windows\tsnpstd3.exe" [2006-08-21 114688]
"snpstd3"="c:\windows\vsnpstd3.exe" [2006-05-10 344064]
"DLCGCATS"="c:\windows\System32\spool\DRIVERS\W32X 86\3\DLCGtime.dll" [2006-10-20 73728]
"dlcgmon.exe"="c:\program files\Dell AIO 810\dlcgmon.exe" [2006-12-08 430984]
"BluetoothAuthenticationAgent"="bthprops.cpl" - c:\windows\system32\bthprops.cpl [2008-04-14 110592]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2003-12-19 65024]
"CHotkey"="mHotkey.exe" - c:\windows\mHotkey.exe [2002-05-27 472576]

c:\documents and settings\dina\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
GN-WIKG Utility.lnk - c:\program files\Gigabyte\Gigabyte GN-WIKG Wireless Mini PCI Adapter\GbConfig.exe [2009-6-27 520192]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\dlcgcoms.exe"=

R2 CLEVOIO;CLEVOIO;c:\windows\system32\drivers\CLEVOI O.sys [7/26/2003 12:31 AM 11520]
R2 ekrn;Eset Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [7/1/2008 9:02 AM 468224]
S2 VGAORG;VGAORG; [x]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSe tup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1935655697-839522115-1003Core.job
- c:\documents and settings\dina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-27 03:10]

2009-07-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2052111302-1935655697-839522115-1003UA.job
- c:\documents and settings\dina\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-27 03:10]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Menu - F:\Autorun.exe
HKLM-Run-CameraFixer - c:\windows\CameraFixer.exe

.
------- Supplementary Scan -------
.
IE: Download all with Free Download Manager - file://c:\program files\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://c:\program files\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://c:\program files\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://c:\program files\Free Download Manager\dllink.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - c:\program files\Free Download Manager\FUM\fumiebtn.dll
.

************************************************** ************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2009-07-03 10:26
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
DLCGCATS = rundll32 c:\windows\System32\spool\DRIVERS\W32X86\3\DLCGtim e.dll,_RunDLLEntry@16????????????????????????????? ?????????????????????????????????????????????????? ?????????????????????????????????????????????????? ??????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
Completion time: 2009-07-03 10:27
ComboFix-quarantined-files.txt 2009-07-03 02:27

Pre-Run: 26,142,834,688 bytes free
Post-Run: 26,207,178,752 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOW S
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Micro soft Windows XP Professional" /noexecute=optin /fastdetect

225 --- E O F --- 2009-06-28 02:04

Osiris · 07-03-2009, 12:14 AM

Did you reinstall messenger yet? combofix deleted an item which is good.

Member Login