Results 1 to 10 of 10

Thread: Please Help Browser Hijacked

Hybrid View

  1. 10-12-2008, 09:20 AM #1
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7

    Please Help Browser Hijacked

    Hi,

    My laptop is doing very strange things and it looks like there is some malware that I can not get rid of. Could you please check my logs and tell me what to do? The uninstall manager log is in .jpg because I can not save the log...
    Attached Images Attached Images
    Attached Files Attached Files
    Reply With Quote Reply With Quote
  2. 10-15-2008, 10:52 PM #2
    jholland1964's Avatar
    jholland1964
    jholland1964 is offline Administrator
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    First of all Did you reboot the system after running the MBA-M program?
    Also TURN OFF that SpyBot TeaTimer program and leave it off. It can interfere with any fixes done.
    Open Spybot, Choose Advanced Mode. Then click Tools. On the left side click Resident. Take the checkmark OUT of TeaTimer. Close the program and Reboot the computer. Then run a new MBA-M scan, fix everything found. Run a new HJT scan. Post back here with both logs. Please DON'T attach them. Please copy/paste each log.
    Judy
    Reply With Quote Reply With Quote
  3. 10-25-2008, 10:53 AM #3
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7
    After trying for some time to start in normal mode, I had to do the MBA-M in safe mode... I hope it of use anyway...

    Malwarebytes' Anti-Malware 1.28
    Versión de la Base de Datos: 1253
    Windows 5.1.2600 Service Pack 3

    10/25/2008 4:58:56 PM
    mbam-log-2008-10-25 (16-58-56).txt

    Tipo de examen : Examen Completo (C:\|D:\|)
    Objetos examinados: 73483
    Tiempo transcurrido: 1 hour(s), 13 minute(s), 31 second(s)

    Procesos en Memoria Infectados: 0
    Módulos en Memoria Infectados: 1
    Claves del Registro Infectadas: 7
    Valores del Registro Infectados: 0
    Elementos de Datos del Registro Infectados: 2
    Carpetas Infectadas: 0
    Ficheros Infectados: 8

    Procesos en Memoria Infectados:
    (No se han detectado elementos maliciosos)

    Módulos en Memoria Infectados:
    C:\WINDOWS\system32\iifdddEt.dll (Trojan.Vundo.H) -> Delete on reboot.

    Claves del Registro Infectadas:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Explorer\Browser Helper Objects\{1eabadd2-1c9c-4c56-a5b4-b23837b34e09} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{1eabadd2-1c9c-4c56-a5b4-b23837b34e09} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

    Valores del Registro Infectados:
    (No se han detectado elementos maliciosos)

    Elementos de Datos del Registro Infectados:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iifdddet -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iifdddet -> Delete on reboot.

    Carpetas Infectadas:
    (No se han detectado elementos maliciosos)

    Ficheros Infectados:
    C:\WINDOWS\system32\iifdddEt.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINDOWS\system32\tEdddfii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tEdddfii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\alvwllvn.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\nvllwvla.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\6NGNSTOD\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINDOWS\Temp\TDSS4064.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\Temp\TDSS9f2d.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.





    Logfile of HijackThis v1.99.1
    Scan saved at 5:37:04 PM, on 10/25/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Archivos de programa\Google\Update\GoogleUpdate.exe
    C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Archivos de programa\Eset\nod32krn.exe
    C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Archivos de programa\Eset\nod32kui.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\HJT\HijackThis.exe


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsue.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
    O2 - BHO: {ec584d1b-a865-16b9-5124-c806d82ba0d9} - {9d0ab28d-608c-4215-9b61-568ab1d485ce} - C:\WINDOWS\system32\pkdkdn.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.1.1119.173 6\swg.dll
    O2 - BHO: (no name) - {BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
    O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Archivos de programa\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [THotkey] C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E963EE0-F698-40FA-8DE4-BBBC3D2D2899}: NameServer = 208.67.222.222,208.67.220.220
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: pkdkdn.dll
    O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
    O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
    O20 - Winlogon Notify: ssqPgGXr - C:\WINDOWS\SYSTEM32\ssqPgGXr.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Google Update Service (gupdate1c8e071a1913dc0) (gupdate1c8e071a1913dc0) - Unknown owner - C:\Archivos de programa\Google\Update\GoogleUpdate.exe" /svc (file missing)
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe
    O23 - Service: PACSPTISVR - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SsBeSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
    Reply With Quote Reply With Quote
  4. 10-25-2008, 10:58 AM #4
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7
    Sorry I posted it twice...
    Last edited by maikelekiam; 10-25-2008 at 04:54 PM.
    Reply With Quote Reply With Quote
  5. 10-27-2008, 10:37 AM #5
    jholland1964's Avatar
    jholland1964
    jholland1964 is offline Administrator
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    You need to delete that old version of HiJackThis and download and scan with the newest version which is version 2.0.2
    http://www.trendsecure.com/portal/en...ols/hijackthis
    Reply With Quote Reply With Quote
  6. 10-27-2008, 02:05 PM #6
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7
    OK done!


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:04:19 PM, on 10/27/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16705)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Archivos de programa\Google\Update\GoogleUpdate.exe
    C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Archivos de programa\Eset\nod32krn.exe
    C:\Archivos de programa\Eset\nod32kui.exe
    C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Archivos de programa\Mozilla Firefox\firefox.exe
    C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsue.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O2 - BHO: (no name) - {998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
    O2 - BHO: {ec584d1b-a865-16b9-5124-c806d82ba0d9} - {9d0ab28d-608c-4215-9b61-568ab1d485ce} - C:\WINDOWS\system32\pkdkdn.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.1.1119.173 6\swg.dll
    O2 - BHO: (no name) - {BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
    O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [SoundMAXPnP] C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
    O4 - HKLM\..\Run: [SoundMAX] C:\Archivos de programa\Analog Devices\SoundMAX\Smax4.exe /tray
    O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
    O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [THotkey] C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Cursors" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Connection Wizard" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\NtmsData" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] cmd.exe /c md "%SystemDrive%\WINDOWS\Temp" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_10] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_11] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_12] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_13] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_14] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICIO LOCAL')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
    O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Cursors" (User 'Servicio de red')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
    O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{3E963EE0-F698-40FA-8DE4-BBBC3D2D2899}: NameServer = 208.67.222.222,208.67.220.220
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
    O20 - AppInit_DLLs: pkdkdn.dll
    O20 - Winlogon Notify: ssqPgGXr - C:\WINDOWS\SYSTEM32\ssqPgGXr.dll
    O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
    O23 - Service: Google Update Service (gupdate1c8e071a1913dc0) (gupdate1c8e071a1913dc0) - Google Inc. - C:\Archivos de programa\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: MSCSPTISRV - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\MSCSPTISRV.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe
    O23 - Service: PACSPTISVR - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\PACSPTISVR.exe
    O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SsBeSvc.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SPTISRV.exe
    O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SSScsiSV.exe
    O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe

    --
    End of file - 9220 bytes
    Reply With Quote Reply With Quote
  7. 10-28-2008, 09:26 AM #7
    jholland1964's Avatar
    jholland1964
    jholland1964 is offline Administrator
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    Download ComboFix
    Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
    Once the download is complete you will see the Combofix on the desktop.
    • Close all open Windows including this one.
    • Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
      Doubleclick the combofix icon on the desktop to run the program.



    Windows will issue a prompt asking whether you wish to run the program, click Run
    You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

    Now just sit back and allow the program to run

    Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

    When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
    This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.

    When all is complete then please post back here with that log.
    Reply With Quote Reply With Quote
  8. 10-28-2008, 03:06 PM #8
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7
    I post 2 logs because I realized right after the first scan that I forgot to disable the antivirus...

    ComboFix 08-10-28.01 - Administrador 2008-10-28 20:36:30.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.239 [GMT 1:00]
    Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\ComboFix.exe
    * Resident AV is active


    ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
    .

    (((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Administrador\Datos de programa\.#
    C:\WINDOWS\system32\bofnkqeq.ini
    C:\WINDOWS\system32\bpkkgxnx.ini
    C:\WINDOWS\system32\czzong.dll
    C:\WINDOWS\system32\doxugwve.dll
    C:\WINDOWS\system32\evwguxod.ini
    C:\WINDOWS\system32\gjglpngb.dll
    C:\WINDOWS\system32\gtyaowxn.dll
    C:\WINDOWS\system32\hgGwWQjJ.dll
    C:\WINDOWS\system32\iaklkwob.ini
    C:\WINDOWS\system32\iuzgoo.dll
    C:\WINDOWS\system32\jkkLCvvw.dll
    C:\WINDOWS\system32\mendevlc.ini
    C:\WINDOWS\system32\mTuDLkkj.ini
    C:\WINDOWS\system32\mTuDLkkj.ini2
    C:\WINDOWS\system32\mujyrp.dll
    C:\WINDOWS\system32\pkdkdn.dll
    C:\WINDOWS\system32\pmnkIXOf.dll
    C:\WINDOWS\system32\pwnlhwug.dll
    C:\WINDOWS\system32\qaioiron.dll
    C:\WINDOWS\system32\qeqknfob.dll
    C:\WINDOWS\system32\smcflf.dll
    C:\WINDOWS\system32\ssqPgGXr.dll
    C:\WINDOWS\system32\uplvmraw.dll
    C:\WINDOWS\system32\vtUlJcCv.dll
    C:\WINDOWS\system32\windows_update.exe
    C:\WINDOWS\system32\xxywUOgH.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Servicios )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_TDSSSERV
    -------\Service_TDSSserv


    (((((((((((((((((( Archivos creados desde 2008-09-28 - 2008-10-28 )))))))))))))))))))))))))))))))))
    .

    2008-10-28 20:39 . 2008-10-28 20:41 396 --ahs---- C:\WINDOWS\system32\mTuDLkkj.ini
    2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\sgnxfoif.dll
    2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\jgqaho.dll
    2008-10-27 20:05 . 2008-10-27 20:05 267,776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll
    2008-10-27 20:04 . 2008-10-27 20:04 <DIR> d-------- C:\Archivos de programa\Trend Micro
    2008-10-27 20:03 . 2008-10-27 20:03 812,344 --a------ C:\HJTInstall.exe
    2008-10-12 12:25 . 2008-10-12 12:25 <DIR> d-------- C:\Program Files
    2008-10-12 10:29 . 2008-10-12 12:24 <DIR> d-------- C:\Archivos de programa\EsetOnlineScanner
    2008-10-12 09:44 . 2008-10-12 09:45 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware
    2008-10-12 09:44 . 2008-09-09 23:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-12 09:44 . 2008-09-09 23:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-12 09:28 . 2008-10-12 09:28 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa\Malwarebytes
    2008-10-12 09:27 . 2008-10-12 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
    2008-10-11 20:22 . 2008-10-11 20:22 95 --a------ C:\WINDOWS\wininit.ini
    2008-10-11 19:48 . 2008-10-11 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
    2008-10-11 19:48 . 2008-10-11 19:48 <DIR> d-------- C:\Archivos de programa\Spybot - Search & Destroy
    2008-10-09 17:05 . 2008-10-09 17:05 <DIR> d-------- C:\Archivos de programa\ScanSoft
    2008-10-09 17:00 . 2008-10-09 17:01 <DIR> d-------- C:\Archivos de programa\Microsoft AutoRoute
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\xircom
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\restore
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\srchasst
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\msagent
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\Archivos de programa\microsoft frontpage
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\oobe
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\es
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-10-07 20:23 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-10-07 20:16 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\EHome
    2008-10-05 22:10 . 2008-10-05 22:10 <DIR> d-------- C:\Archivos de programa\ElcomSoft
    2008-10-05 21:44 . 2008-10-05 21:44 99 --a------ C:\pdfinfo.ini
    2008-10-05 21:44 . 2008-10-05 21:45 81 --a------ C:\WINDOWS\winDecrypt.INI
    2008-10-05 21:42 . 2008-10-05 21:42 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat
    2008-10-05 21:42 . 2008-10-05 21:54 36 --a------ C:\WINDOWS\verypdf.ini
    2008-10-05 21:41 . 2008-10-12 09:10 <DIR> d-------- C:\Archivos de programa\PDF Password Remover v2.5
    2008-10-05 20:03 . 2008-04-14 03:18 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
    2008-10-05 20:02 . 2008-04-14 03:18 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
    2008-10-05 20:01 . 2008-04-14 03:18 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-10-05 20:01 . 2008-04-13 19:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
    2008-10-05 20:01 . 2008-04-13 19:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
    2008-10-05 20:01 . 2008-04-14 03:18 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll

    .
    (((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))) )
    .
    2008-10-28 19:36 --------- d-----w C:\Archivos de programa\Eset
    2008-10-27 19:06 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Google Updater
    2008-10-12 08:10 --------- d-----w C:\Archivos de programa\Google
    2008-10-10 22:38 90,112 ----a-w C:\WINDOWS\DUMP6d24.tmp
    2008-10-10 22:37 98,304 ----a-w C:\WINDOWS\DUMP2334.tmp
    2008-10-10 22:36 98,304 ----a-w C:\WINDOWS\DUMP3407.tmp
    2008-10-10 21:11 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\uTorrent
    2008-10-07 19:43 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd9725.sys
    2008-09-30 18:13 --------- d-----w C:\Archivos de programa\Picasa2
    2008-09-17 17:17 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\Ahead
    2008-09-16 21:08 --------- d-----w C:\Archivos de programa\uTorrent
    2008-09-04 18:19 --------- d-----w C:\Archivos de programa\Pando Networks
    2008-08-05 20:05 53,248 ----a-w C:\WINDOWS\system32\suppdll.dll
    2008-08-05 20:05 35,363 ----a-w C:\WINDOWS\system32\windrvNT.sys
    .

    ((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A1F85C5-E150-4939-AAAB-38C245BED4CE}]
    2008-10-27 20:05 267776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7564a552-336f-41d4-b91a-1d409d5bb548}]
    2008-10-28 20:42 113152 --a------ C:\WINDOWS\system32\djntzp.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "nod32kui"="C:\Archivos de programa\Eset\nod32kui.exe" [2008-06-04 921600]
    "SoundMAXPnP"="C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
    "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 155648]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 126976]
    "THotkey"="C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe" [2004-12-14 368640]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    C:\Documents and Settings\All Users\Men£ Inicio\Programas\Inicio\
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-06-05 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "DisableStatusMessages"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer]
    "NoDesktopCleanupWizard"= 1 (0x1)
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMConfigurePrograms"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "NoResolveTrack"= 1 (0x1)
    "NoResolveSearch"= 1 (0x1)

    [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMConfigurePrograms"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "NoResolveTrack"= 1 (0x1)
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2 e,65,78,65,00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=jgqaho.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.X264"= x264vfw.dll
    "VIDC.3iv2"= 3ivxVfWCodec.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkkLDuTm

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
    "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
    "C:\\Archivos de programa\\Pando Networks\\Pando\\pando.exe"=
    "C:\\Archivos de programa\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Archivos de programa\\Malwarebytes' Anti-Malware\\mbam.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "57214:TCP"= 57214:TCP:Pando P2P TCP Listening Port
    "57214:UDP"= 57214:UDP:Pando P2P UDP Listening Port
    "4662:TCP"= 4662:TCP:uTORRENT

    S2 gupdate1c8e071a1913dc0;Google Update Service (gupdate1c8e071a1913dc0);C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 133104]
    S3 iscFlash;iscFlash;C:\WINDOWS\Temp\isc10tmp\iscflas h.sys [ ]
    S3 mpr_freader;MPR FileReader Driver;C:\Archivos de programa\Multi Password Recovery\mpr_freader.sys [ ]
    S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9e6caec0-3340-11dd-ab62-963b1372dd69}]
    \Shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9e6caec2-3340-11dd-ab62-963b1372dd69}]
    \Shell\AutoRun\command - F:\AutoRun.exe
    .
    Contenido de carpeta 'Tareas Programadas'

    2008-10-28 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
    - C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 23:42]
    .
    - - - - HUÉRFANOS ELIMINADOS - - - -

    BHO-{998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
    BHO-{BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
    HKLM-Run-Tvs - C:\Program Files\Toshiba\Tvs\TvsTray.exe
    HKLM-Run-64769aed - C:\WINDOWS\system32\qeqknfob.dll
    ShellExecuteHooks-{998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll


    .
    ------- Análisis Suplementario -------
    .
    FireFox -: Profile - C:\Documents and Settings\Administrador\Datos de programa\Mozilla\Firefox\Profiles\n1ai0fhk.default \
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
    FF -: plugin - C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Archivos de programa\Google\Google Earth Plugin\npgeplugin.dll
    FF -: plugin - C:\Archivos de programa\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
    FF -: plugin - C:\Archivos de programa\Google\Update\1.2.131.25\npGoogleOneClick 6.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava11.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava12.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava13.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava14.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava32.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJPI150_07.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPOJI610.dll
    FF -: plugin - C:\Archivos de programa\Mozilla Firefox\plugins\npPandoWebInst.dll
    FF -: plugin - C:\Archivos de programa\Picasa2\npPicasa2.dll
    .

    ************************************************** ************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-28 20:40:47
    Windows 5.1.2600 Service Pack 3 NTFS

    escaneando procesos ocultos ...

    escaneando entradas ocultas de autostart ...

    escaneando archivos ocultos ...


    C:\sccfg.sys 370 bytes
    C:\WINDOWS\system32\vscvswrh.dll 113152 bytes executable

    el escaneo se completo con exito
    archivos ocultos: 2

    ************************************************** ************************
    .
    --------------------- DLLs cargados bajo los procesos en ejecución ---------------------

    PROCESOS: C:\WINDOWS\system32\lsass.exe
    -> C:\WINDOWS\system32\jkkLDuTm.dll
    -> C:\Archivos de programa\Eset\pr_imon.dll

    PROCESOS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\iqkautwf.dll
    -> C:\WINDOWS\system32\jkkLDuTm.dll
    .
    ------------------------ Otros procesos en ejecución ------------------------
    .
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Archivos de programa\Eset\nod32krn.exe
    C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    .
    ************************************************** ************************
    .
    Tiempo completado: 2008-10-28 20:43:21 - Reiniciando la máquina
    ComboFix-quarantined-files.txt 2008-10-28 19:43:13

    Pre-Run: 3,005,747,200 bytes libres
    Post-Run: 3,519,385,600 bytes libres

    245 --- E O F --- 2008-10-09 17:30:22













    ComboFix 08-10-28.01 - Administrador 2008-10-28 20:56:40.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.242 [GMT 1:00]
    Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\ComboFix.exe
    * Resident AV is active


    ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
    .

    (((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\fwtuakqi.ini
    C:\WINDOWS\system32\iqkautwf.dll
    C:\WINDOWS\system32\mTuDLkkj.ini
    C:\WINDOWS\system32\mTuDLkkj.ini2

    .
    (((((((((((((((((( Archivos creados desde 2008-09-28 - 2008-10-28 )))))))))))))))))))))))))))))))))
    .

    2008-10-28 20:59 . 2008-10-28 21:00 494 --ahs---- C:\WINDOWS\system32\mTuDLkkj.ini
    2008-10-28 20:42 . 2008-10-28 20:42 113,152 --a------ C:\WINDOWS\system32\vscvswrh.dll
    2008-10-28 20:42 . 2008-10-28 20:42 113,152 --a------ C:\WINDOWS\system32\djntzp.dll
    2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\sgnxfoif.dll
    2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\jgqaho.dll
    2008-10-27 20:05 . 2008-10-27 20:05 267,776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll
    2008-10-27 20:04 . 2008-10-27 20:04 <DIR> d-------- C:\Archivos de programa\Trend Micro
    2008-10-27 20:03 . 2008-10-27 20:03 812,344 --a------ C:\HJTInstall.exe
    2008-10-12 12:25 . 2008-10-12 12:25 <DIR> d-------- C:\Program Files
    2008-10-12 10:29 . 2008-10-12 12:24 <DIR> d-------- C:\Archivos de programa\EsetOnlineScanner
    2008-10-12 09:44 . 2008-10-12 09:45 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware
    2008-10-12 09:44 . 2008-09-09 23:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-10-12 09:44 . 2008-09-09 23:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-10-12 09:28 . 2008-10-12 09:28 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa\Malwarebytes
    2008-10-12 09:27 . 2008-10-12 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
    2008-10-11 20:22 . 2008-10-11 20:22 95 --a------ C:\WINDOWS\wininit.ini
    2008-10-11 19:48 . 2008-10-11 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
    2008-10-11 19:48 . 2008-10-11 19:48 <DIR> d-------- C:\Archivos de programa\Spybot - Search & Destroy
    2008-10-09 17:05 . 2008-10-09 17:05 <DIR> d-------- C:\Archivos de programa\ScanSoft
    2008-10-09 17:00 . 2008-10-09 17:01 <DIR> d-------- C:\Archivos de programa\Microsoft AutoRoute
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\xircom
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\restore
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\srchasst
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\msagent
    2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\Archivos de programa\microsoft frontpage
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\oobe
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\es
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-10-07 20:23 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2008-10-07 20:16 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\EHome
    2008-10-05 22:10 . 2008-10-05 22:10 <DIR> d-------- C:\Archivos de programa\ElcomSoft
    2008-10-05 21:44 . 2008-10-05 21:44 99 --a------ C:\pdfinfo.ini
    2008-10-05 21:44 . 2008-10-05 21:45 81 --a------ C:\WINDOWS\winDecrypt.INI
    2008-10-05 21:42 . 2008-10-05 21:42 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat
    2008-10-05 21:42 . 2008-10-05 21:54 36 --a------ C:\WINDOWS\verypdf.ini
    2008-10-05 21:41 . 2008-10-12 09:10 <DIR> d-------- C:\Archivos de programa\PDF Password Remover v2.5
    2008-10-05 20:03 . 2008-04-14 03:18 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
    2008-10-05 20:02 . 2008-04-14 03:18 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
    2008-10-05 20:01 . 2008-04-14 03:18 136,192 --------- C:\WINDOWS\system32\aaclient.dll
    2008-10-05 20:01 . 2008-04-13 19:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
    2008-10-05 20:01 . 2008-04-13 19:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
    2008-10-05 20:01 . 2008-04-14 03:18 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
    2008-10-05 20:01 . 2008-04-14 03:18 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll

    .
    (((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))) )
    .
    2008-10-28 19:36 --------- d-----w C:\Archivos de programa\Eset
    2008-10-27 19:06 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Google Updater
    2008-10-12 08:10 --------- d-----w C:\Archivos de programa\Google
    2008-10-10 22:38 90,112 ----a-w C:\WINDOWS\DUMP6d24.tmp
    2008-10-10 22:37 98,304 ----a-w C:\WINDOWS\DUMP2334.tmp
    2008-10-10 22:36 98,304 ----a-w C:\WINDOWS\DUMP3407.tmp
    2008-10-10 21:11 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\uTorrent
    2008-10-07 19:43 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd9725.sys
    2008-09-30 18:13 --------- d-----w C:\Archivos de programa\Picasa2
    2008-09-17 17:17 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\Ahead
    2008-09-16 21:08 --------- d-----w C:\Archivos de programa\uTorrent
    2008-09-04 18:19 --------- d-----w C:\Archivos de programa\Pando Networks
    2008-08-05 20:05 53,248 ----a-w C:\WINDOWS\system32\suppdll.dll
    2008-08-05 20:05 35,363 ----a-w C:\WINDOWS\system32\windrvNT.sys
    .

    ((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7564a552-336f-41d4-b91a-1d409d5bb548}]
    2008-10-28 20:42 113152 --a------ C:\WINDOWS\system32\djntzp.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A23CABA5-C51E-4CB5-A23B-ADFA4D8D9FCF}]
    2008-10-27 20:05 267776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
    "nod32kui"="C:\Archivos de programa\Eset\nod32kui.exe" [2008-06-04 921600]
    "SoundMAXPnP"="C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
    "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 155648]
    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 126976]
    "THotkey"="C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe" [2004-12-14 368640]
    "64769aed"="C:\WINDOWS\system32\jkiagxlr.dll" [2008-10-28 75264]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\Cur rentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

    C:\Documents and Settings\All Users\Men£ Inicio\Programas\Inicio\
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-06-05 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\system]
    "DisableStatusMessages"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\curr entversion\policies\explorer]
    "NoDesktopCleanupWizard"= 1 (0x1)
    "ForceClassicControlPanel"= 1 (0x1)

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMConfigurePrograms"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "NoResolveTrack"= 1 (0x1)
    "NoResolveSearch"= 1 (0x1)

    [HKEY_USERS\.default\software\microsoft\windows\cur rentversion\policies\explorer]
    "NoSMHelp"= 1 (0x1)
    "NoSMConfigurePrograms"= 1 (0x1)
    "NoSMMyPictures"= 1 (0x1)
    "NoResolveTrack"= 1 (0x1)
    "NoResolveSearch"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
    "UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2 e,65,78,65,00

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=jgqaho.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.X264"= x264vfw.dll
    "VIDC.3iv2"= 3ivxVfWCodec.dll

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\contro l\lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkkLDuTm

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
    "DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
    "C:\\Archivos de programa\\Pando Networks\\Pando\\pando.exe"=
    "C:\\Archivos de programa\\uTorrent\\uTorrent.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Archivos de programa\\Malwarebytes' Anti-Malware\\mbam.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
    "57214:TCP"= 57214:TCP:Pando P2P TCP Listening Port
    "57214:UDP"= 57214:UDP:Pando P2P UDP Listening Port
    "4662:TCP"= 4662:TCP:uTORRENT

    S2 gupdate1c8e071a1913dc0;Google Update Service (gupdate1c8e071a1913dc0);C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 133104]
    S3 iscFlash;iscFlash;C:\WINDOWS\Temp\isc10tmp\iscflas h.sys [ ]
    S3 mpr_freader;MPR FileReader Driver;C:\Archivos de programa\Multi Password Recovery\mpr_freader.sys [ ]
    S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9e6caec0-3340-11dd-ab62-963b1372dd69}]
    \Shell\AutoRun\command - F:\AutoRun.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\curre ntversion\explorer\mountpoints2\{9e6caec2-3340-11dd-ab62-963b1372dd69}]
    \Shell\AutoRun\command - F:\AutoRun.exe
    .
    Contenido de carpeta 'Tareas Programadas'

    2008-10-28 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
    - C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 23:42]
    .
    .
    ------- Análisis Suplementario -------
    .
    FireFox -: Profile - C:\Documents and Settings\Administrador\Datos de programa\Mozilla\Firefox\Profiles\n1ai0fhk.default \
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
    FF -: plugin - C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Archivos de programa\Google\Google Earth Plugin\npgeplugin.dll
    FF -: plugin - C:\Archivos de programa\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
    FF -: plugin - C:\Archivos de programa\Google\Update\1.2.131.25\npGoogleOneClick 6.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava11.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava12.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava13.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava14.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava32.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJPI150_07.dll
    FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPOJI610.dll
    FF -: plugin - C:\Archivos de programa\Mozilla Firefox\plugins\npPandoWebInst.dll
    FF -: plugin - C:\Archivos de programa\Picasa2\npPicasa2.dll
    .

    ************************************************** ************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-28 21:00:07
    Windows 5.1.2600 Service Pack 3 NTFS

    escaneando procesos ocultos ...

    escaneando entradas ocultas de autostart ...

    escaneando archivos ocultos ...


    C:\sccfg.sys 370 bytes
    C:\WINDOWS\system32\mTuDLkkj.ini 411483 bytes
    C:\WINDOWS\system32\rlxgaikj.ini
    C:\WINDOWS\system32\jkiagxlr.dll

    el escaneo se completo con exito
    archivos ocultos: 4

    ************************************************** ************************
    .
    --------------------- DLLs cargados bajo los procesos en ejecución ---------------------

    PROCESOS: C:\WINDOWS\system32\lsass.exe
    -> C:\WINDOWS\system32\jkkLDuTm.dll
    -> C:\Archivos de programa\Eset\pr_imon.dll

    PROCESOS: C:\WINDOWS\explorer.exe
    -> C:\WINDOWS\system32\jkkLDuTm.dll
    -> C:\WINDOWS\system32\jkiagxlr.dll
    .
    ------------------------ Otros procesos en ejecución ------------------------
    .
    C:\WINDOWS\system32\DVDRAMSV.exe
    C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
    C:\Archivos de programa\Eset\nod32krn.exe
    C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
    C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
    C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    .
    ************************************************** ************************
    .
    Tiempo completado: 2008-10-28 21:02:18 - Reiniciando la máquina
    ComboFix-quarantined-files.txt 2008-10-28 20:02:10
    ComboFix2.txt 2008-10-28 19:43:22

    Pre-Run: 3,526,914,048 bytes libres
    Post-Run: 3,516,989,440 bytes libres

    218 --- E O F --- 2008-10-09 17:30:22
    Reply With Quote Reply With Quote
  9. 10-28-2008, 11:46 PM #9
    jholland1964's Avatar
    jholland1964
    jholland1964 is offline Administrator
    Join Date
    Aug 2006
    Location
    The Middle
    Age
    80
    Posts
    4,079
    Hate to ask this but is there some way you can post these logs in English? My Spanish is limited to high school Spanish classes...many years ago.
    Reply With Quote Reply With Quote
  10. 10-30-2008, 11:41 AM #10
    maikelekiam
    maikelekiam is offline Junior Member
    Join Date
    Jan 2008
    Posts
    7
    It is not a problem


    ComboFix 08-10-28.01 - Administrator 2008-10-28 20:36:30.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.239 [1:00 GMT]
    It runs from: C: \ Documents and Settings \ Administrator \ Desktop \ ComboFix.exe
    * Resident AV is activated


    WARNING - THIS TEAM HAS NOT install the Recovery Console!
    .

    Other (((((((((((((((((((((((((((((((((((( eliminations )))))))))))) )))))))))))))))))))))))))))))))))))))
    .

    C: \ Documents and Settings \ Administrator \ Application Data \. #
    C: \ WINDOWS \ system32 \ bofnkqeq.ini
    C: \ WINDOWS \ system32 \ bpkkgxnx.ini
    C: \ WINDOWS \ system32 \ czzong.dll
    C: \ WINDOWS \ system32 \ doxugwve.dll
    C: \ WINDOWS \ system32 \ evwguxod.ini
    C: \ WINDOWS \ system32 \ gjglpngb.dll
    C: \ WINDOWS \ system32 \ gtyaowxn.dll
    C: \ WINDOWS \ system32 \ hgGwWQjJ.dll
    C: \ WINDOWS \ system32 \ iaklkwob.ini
    C: \ WINDOWS \ system32 \ iuzgoo.dll
    C: \ WINDOWS \ system32 \ jkkLCvvw.dll
    C: \ WINDOWS \ system32 \ mendevlc.ini
    C: \ WINDOWS \ system32 \ mTuDLkkj.ini
    C: \ WINDOWS \ system32 \ mTuDLkkj.ini2
    C: \ WINDOWS \ system32 \ mujyrp.dll
    C: \ WINDOWS \ system32 \ pkdkdn.dll
    C: \ WINDOWS \ system32 \ pmnkIXOf.dll
    C: \ WINDOWS \ system32 \ pwnlhwug.dll
    C: \ WINDOWS \ system32 \ qaioiron.dll
    C: \ WINDOWS \ system32 \ qeqknfob.dll
    C: \ WINDOWS \ system32 \ smcflf.dll
    C: \ WINDOWS \ system32 \ ssqPgGXr.dll
    C: \ WINDOWS \ system32 \ uplvmraw.dll
    C: \ WINDOWS \ system32 \ vtUlJcCv.dll
    C: \ WINDOWS \ system32 \ windows_update.exe
    C: \ WINDOWS \ system32 \ xxywUOgH.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers / Services )))))))) )))))))))))))))))))))))))))))))))))))))))
    .

    ------- \ Legacy_TDSSSERV
    ------- \ Service_TDSSserv


    (((((((((((((((((( Files created from 2008-09-28 - 2008-10-28 )))))))))))))))))) )))))))))))))))
    .

    2008-10-28 20:39. 2008-10-28 20:41 396 - AHS ---- C: \ WINDOWS \ system32 \ mTuDLkkj.ini
    2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ sgnxfoif.dll
    2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ jgqaho.dll
    2008-10-27 20:05. 2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    2008-10-27 20:04. 2008-10-27 20:04 <DIR> d -------- C: \ Program Files \ Trend Micro
    2008-10-27 20:03. 2008-10-27 20:03 812344 - a ------ C: \ HJTInstall.exe
    2008-10-12 12:25. 2008-10-12 12:25 <DIR> d -------- C: \ Program Files
    2008-10-12 10:29. 2008-10-12 12:24 <DIR> d -------- C: \ Program Files \ EsetOnlineScanner
    2008-10-12 09:44. 2008-10-12 09:45 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware
    2008-10-12 09:44. 2008-09-09 23:04 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys
    2008-10-12 09:44. 2008-09-09 23:03 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys
    2008-10-12 09:28. 2008-10-12 09:28 <DIR> d -------- C: \ Documents and Settings \ Administrator \ Application Data \ Malwarebytes
    2008-10-12 09:27. 2008-10-12 09:27 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
    2008-10-11 20:22. 2008-10-11 20:22 95 - a ------ C: \ WINDOWS \ Wininit.ini
    2008-10-11 19:48. 2008-10-11 19:53 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy
    2008-10-11 19:48. 2008-10-11 19:48 <DIR> d -------- C: \ Program Files \ Spybot - Search & Destroy
    2008-10-09 17:05. 2008-10-09 17:05 <DIR> d -------- C: \ Program Files \ ScanSoft
    2008-10-09 17:00. 2008-10-09 17:01 <DIR> d -------- C: \ Program Files \ Microsoft AutoRoute
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ Xircom
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ restore
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ srchasst
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ msagent
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ Program Files \ microsoft frontpage
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ OOBE
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ is
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ bits
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ l2schemas
    2008-10-07 20:23. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ ServicePackFiles
    2008-10-07 20:16. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ EHome
    2008-10-05 22:10. 2008-10-05 22:10 <DIR> d -------- C: \ Program Files \ ElcomSoft
    2008-10-05 21:44. 2008-10-05 21:44 99 - a ------ C: \ pdfinfo.ini
    2008-10-05 21:44. 2008-10-05 21:45 81 - a ------ C: \ WINDOWS \ winDecrypt.INI
    2008-10-05 21:42. 2008-10-05 21:42 1024 - a ------ C: \ WINDOWS \ system32 \ pwdremover.dat
    2008-10-05 21:42. 2008-10-05 21:54 36 - a ------ C: \ WINDOWS \ verypdf.ini
    2008-10-05 21:41. 2008-10-12 09:10 <DIR> d -------- C: \ Program Files \ PDF Password Remover v2.5
    2008-10-05 20:03. 2008-04-14 03:18 4274816 --------- C: \ WINDOWS \ system32 \ nv4_disp.dll
    2008-10-05 20:02. 2008-04-14 03:18 1888992 --------- C: \ WINDOWS \ system32 \ ati3duag.dll
    2008-10-05 20:01. 2008-04-14 03:18 136192 --------- C: \ WINDOWS \ system32 \ aaclient.dll
    2008-10-05 20:01. 2008-04-13 19:36 44928 --------- C: \ WINDOWS \ system32 \ drivers \ agpcpq.sys
    2008-10-05 20:01. 2008-04-13 19:36 42368 --------- C: \ WINDOWS \ system32 \ drivers \ Agp440.sys
    2008-10-05 20:01. 2008-04-14 03:18 4255 --------- C: \ WINDOWS \ system32 \ drivers \ adv01nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3967 --------- C: \ WINDOWS \ system32 \ drivers \ adv02nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3775 --------- C: \ WINDOWS \ system32 \ drivers \ adv11nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3711 --------- C: \ WINDOWS \ system32 \ drivers \ adv09nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3647 --------- C: \ WINDOWS \ system32 \ drivers \ adv07nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3615 --------- C: \ WINDOWS \ system32 \ drivers \ adv05nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3135 --------- C: \ WINDOWS \ system32 \ drivers \ adv08nt5.dll

    .
    (((((((((((((((((((((((((((((((((((((( Report Find3M )))))))))) )))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-28 19:36 --------- ----- w d C: \ Program Files \ Eset
    2008-10-27 19:06 --------- ----- w d C: \ Documents and Settings \ All Users \ Application Data \ Google Updater
    2008-10-12 08:10 --------- ----- w d C: \ Program Files \ Google
    2008-10-10 22:38 90,112 ---- aw C: \ WINDOWS \ DUMP6d24.tmp
    2008-10-10 22:37 98,304 ---- aw C: \ WINDOWS \ DUMP2334.tmp
    2008-10-10 22:36 98,304 ---- aw C: \ WINDOWS \ DUMP3407.tmp
    2008-10-10 21:11 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ uTorrent
    2008-10-07 19:43 96384 ---- aw C: \ WINDOWS \ system32 \ drivers \ sptd9725.sys
    2008-09-30 18:13 --------- ----- w d C: \ Program Files \ Picasa2
    2008-09-17 17:17 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ Ahead
    2008-09-16 21:08 --------- ----- w d C: \ Program Files \ uTorrent
    2008-09-04 18:19 --------- ----- w d C: \ Program Files \ Pando Networks
    2008-08-05 20:05 53248 ---- aw C: \ WINDOWS \ system32 \ suppdll.dll
    2008-08-05 20:05 35363 ---- aw C: \ WINDOWS \ system32 \ windrvNT.sys
    .

    ((((((((((((((((((((((((((((((((( Loading Points Reg )))))))))))))) ))))))))))))))))))))))))))))))))))))
    .
    .
    * Note * empty entries & legitimate default entries are not displayed
    REGEDIT4

    [HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (2A1F85C5-E150-4939-AAAB-38C245BED4CE)]
    2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll

    [HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (7564a552-336f-41d4-b91a-1d409d5bb548)]
    2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll

    [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curren ntVersion \ Run]
    "ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
    "nod32kui" = "C: \ Program Files \ Eset \ nod32kui.exe" [2008-06-04 921600]
    "SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ SoundMAX \ SMax4PNP.exe" [2004-10-14 1388544]

    "IgfxTray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2004-10-08 155,648]
    "HotKeysCmds" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2004-10-08 126,976]
    "THotkey" = "C: \ Program Files \ Toshiba \ Toshiba Applet \ thotkey.exe" [2004-12-14 368,640]

    [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
    "CTFMON.EXE" = "C: \ WINDOWS \ system32 \ CTFMON.EXE" [2008-04-14 15360]

    C: \ Documents and Settings \ All Users \ Start Menu £ \ Programs \ Startup \
    RAMASST.lnk - C: \ WINDOWS \ system32 \ RAMASST.exe [2008-06-05 155648]

    [HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ system]
    "DisableStatusMessages" = 0 (0x0)

    [HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ explorer]
    "NoDesktopCleanupWizard" = 1 (0x1)
    "ForceClassicControlPanel" = 1 (0x1)

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ policies \ explorer]
    "NoSMHelp" = 1 (0x1)
    "NoSMConfigurePrograms" = 1 (0x1)
    "NoSMMyPictures" = 1 (0x1)
    "NoResolveTrack" = 1 (0x1)
    "NoResolveSearch" = 1 (0x1)

    [HKEY_USERS \. Default \ software \ microsoft \ windows \ cur rentversion \ policies \ explorer]
    "NoSMHelp" = 1 (0x1)
    "NoSMConfigurePrograms" = 1 (0x1)
    "NoSMMyPictures" = 1 (0x1)
    "NoResolveTrack" = 1 (0x1)
    "NoResolveSearch" = 1 (0x1)

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
    "UIHost" = hex (2): 58,50,69,7 a, 65.5 f, 4c, 6f, 67.6 f, 6e, 2 e, 65,78,65,00

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows]
    "AppInit_DLLs" = jgqaho.dll

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ drivers32]
    "VIDC.X264" = x264vfw.dll
    "VIDC.3iv2" = 3ivxVfWCodec.dll

    [HKEY_LOCAL_MACHINE \ system \ currentcontrolset \ contro l \ lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C: \ WINDOWS \ system32 \ jkkLDuTm

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile]
    "DisableUnicastResponsesToMulticastBroadcast" = 0 (0x0)

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ AuthorizedApplications \ List]
    "% windir% \ \ system32 \ \ Sessmgr.exe" =
    "C: \ \ Program Files \ \ Skype \ Phone \ \ Skype.exe" =
    "C: \ \ Program Files \ \ Pando Networks \ \ Pando \ \ pando.exe" =
    "C: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" =
    "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" =
    "C: \ \ Program Files \ \ Malwarebytes' Anti-Malware \ \ mbam.exe" =

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ GloballyOpenPorts \ List]
    "57214: TCP" = 57214: TCP: Pando P2P Listening TCP Port
    "57214: UDP" = 57214: UDP: Pando P2P UDP Port Listening
    "4662: TCP" = 4662: TCP: uTORRENT

    S2 gupdate1c8e071a1913dc0; Google Update Service (gupdate1c8e071a1913dc0); C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 133104]
    S3 iscFlash; iscFlash; C: \ WINDOWS \ Temp \ isc10tmp \ iscflas h.sys []
    S3 mpr_freader; MPR FileReader Driver; C: \ Program Files \ Multi Password Recovery \ mpr_freader.sys []
    S3 USBSTOR; Device USB mass storage of data; C: \ WINDOWS \ system32 \ DRIVERS \ USBSTOR.SYS [2008-04-13 26368]

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec0-3340-11dd-ab62-963b1372dd69)]
    \ Shell \ AutoRun \ command - F: \ Autorun.exe

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec2-3340-11dd-ab62-963b1372dd69)]
    \ Shell \ AutoRun \ command - F: \ Autorun.exe
    .
    Content folder 'Scheduled Tasks'

    2008-10-28 C: \ WINDOWS \ Tasks \ GoogleUpdateTaskMachine.job
    - C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 23:42]
    .
    - - - - ORPHANS Remove - - - --

    BHO-(998DAE3E-7D4F-4952-A71F-467D8FE64407) - C: \ WINDOWS \ system32 \ ssqPgGXr.dll
    (-BHO BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6) - (no file)
    HKLM-Run-TVS - C: \ Program Files \ Toshiba \ TVS \ TvsTray.exe
    HKLM-Run-64769aed - C: \ WINDOWS \ system32 \ qeqknfob.dll
    ShellExecuteHooks (-998DAE3E-7D4F-4952-A71F-467D8FE64407) - C: \ WINDOWS \ system32 \ ssqPgGXr.dll


    .
    ------- ------- Supplemental Analysis
    .
    FireFox -: Profile - C: \ Documents and Settings \ Administrator \ Application Data \ Mozilla \ Firefox \ Profiles \ n1ai0fhk.default \
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
    FF -: plugin - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ Browser \ nppdf32.dll
    FF -: plugin - C: \ Program Files \ Google \ Google Earth Plugin \ npgeplugin.dll
    FF -: plugin - C: \ Program Files \ Google \ Google Updater \ 2.2.1273.1045 \ npCIDetect12.dll
    FF -: plugin - C: \ Program Files \ Google \ Update \ 1.2.131.25 \ npGoogleOneClick 6.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava11.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava12.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava13.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava14.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava32.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJPI150_07.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPOJI610.dll
    FF -: plugin - C: \ Program Files \ Mozilla Firefox \ plugins \ npPandoWebInst.dll
    FF -: plugin - C: \ Program Files \ Picasa2 \ npPicasa2.dll
    .

    ************************************************** ************************

    catchman 0.3.1367 W2K/XP/Vista - rootkit / stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-28 20:40:47
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C: \ sccfg.sys 370 bytes
    C: \ WINDOWS \ system32 \ vscvswrh.dll 113,152 byte executable

    The scan was completed successfully
    Hidden Files: 2

    ************************************************** ************************
    .
    --------------------- DLLs loaded under running processes ---------------------

    PROCESS: C: \ WINDOWS \ system32 \ lsass.exe
    -> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    -> C: \ Program Files \ Eset \ pr_imon.dll

    PROCESS: C: \ WINDOWS \ explorer.exe
    -> C: \ WINDOWS \ system32 \ iqkautwf.dll
    -> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    .
    Other processes running ------------------------ ---------------------- --
    .
    C: \ WINDOWS \ system32 \ DVDRAMSV.exe
    C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
    C: \ Program Files \ Eset \ nod32krn.exe
    C: \ Program Files \ CyberLink \ Shared files \ RichVideo.exe
    C: \ Program Files \ Analog Devices \ SoundMAX \ SMAgent.exe
    C: \ Program Files \ toshiba \ TOSHIBA Applet \ TAPPSRV.exe
    C: \ WINDOWS \ system32 \ wdfmgr.exe
    C: \ WINDOWS \ system32 \ rundll32.exe
    C: \ WINDOWS \ system32 \ wscntfy.exe
    C: \ WINDOWS \ system32 \ rundll32.exe
    .
    ************************************************** ************************
    .
    Time completed: 2008-10-28 20:43:21 - Rebooting the machine
    ComboFix-quarantined-files.txt 2008-10-28 19:43:13

    Pre-Run: 3,005,747,200 bytes free
    Post-Run: 3,519,385,600 bytes free

    245 E O F --- --- 2008-10-09 17:30:22













    ComboFix 08-10-28.01 - Administrator 2008-10-28 20:56:40.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.242 [1:00 GMT]
    It runs from: C: \ Documents and Settings \ Administrator \ Desktop \ ComboFix.exe
    * Resident AV is activated


    WARNING - THIS TEAM HAS NOT install the Recovery Console!
    .

    Other (((((((((((((((((((((((((((((((((((( eliminations )))))))))))) )))))))))))))))))))))))))))))))))))))
    .

    C: \ WINDOWS \ system32 \ fwtuakqi.ini
    C: \ WINDOWS \ system32 \ iqkautwf.dll
    C: \ WINDOWS \ system32 \ mTuDLkkj.ini
    C: \ WINDOWS \ system32 \ mTuDLkkj.ini2

    .
    (((((((((((((((((( Files created from 2008-09-28 - 2008-10-28 )))))))))))))))))) )))))))))))))))
    .

    2008-10-28 20:59. 2008-10-28 21:00 494 - AHS ---- C: \ WINDOWS \ system32 \ mTuDLkkj.ini
    2008-10-28 20:42. 2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ vscvswrh.dll
    2008-10-28 20:42. 2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll
    2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ sgnxfoif.dll
    2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ jgqaho.dll
    2008-10-27 20:05. 2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    2008-10-27 20:04. 2008-10-27 20:04 <DIR> d -------- C: \ Program Files \ Trend Micro
    2008-10-27 20:03. 2008-10-27 20:03 812344 - a ------ C: \ HJTInstall.exe
    2008-10-12 12:25. 2008-10-12 12:25 <DIR> d -------- C: \ Program Files
    2008-10-12 10:29. 2008-10-12 12:24 <DIR> d -------- C: \ Program Files \ EsetOnlineScanner
    2008-10-12 09:44. 2008-10-12 09:45 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware
    2008-10-12 09:44. 2008-09-09 23:04 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys
    2008-10-12 09:44. 2008-09-09 23:03 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys
    2008-10-12 09:28. 2008-10-12 09:28 <DIR> d -------- C: \ Documents and Settings \ Administrator \ Application Data \ Malwarebytes
    2008-10-12 09:27. 2008-10-12 09:27 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
    2008-10-11 20:22. 2008-10-11 20:22 95 - a ------ C: \ WINDOWS \ Wininit.ini
    2008-10-11 19:48. 2008-10-11 19:53 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy
    2008-10-11 19:48. 2008-10-11 19:48 <DIR> d -------- C: \ Program Files \ Spybot - Search & Destroy
    2008-10-09 17:05. 2008-10-09 17:05 <DIR> d -------- C: \ Program Files \ ScanSoft
    2008-10-09 17:00. 2008-10-09 17:01 <DIR> d -------- C: \ Program Files \ Microsoft AutoRoute
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ Xircom
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ restore
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ srchasst
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ msagent
    2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ Program Files \ microsoft frontpage
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ OOBE
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ is
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ bits
    2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ l2schemas
    2008-10-07 20:23. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ ServicePackFiles
    2008-10-07 20:16. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ EHome
    2008-10-05 22:10. 2008-10-05 22:10 <DIR> d -------- C: \ Program Files \ ElcomSoft
    2008-10-05 21:44. 2008-10-05 21:44 99 - a ------ C: \ pdfinfo.ini
    2008-10-05 21:44. 2008-10-05 21:45 81 - a ------ C: \ WINDOWS \ winDecrypt.INI
    2008-10-05 21:42. 2008-10-05 21:42 1024 - a ------ C: \ WINDOWS \ system32 \ pwdremover.dat
    2008-10-05 21:42. 2008-10-05 21:54 36 - a ------ C: \ WINDOWS \ verypdf.ini
    2008-10-05 21:41. 2008-10-12 09:10 <DIR> d -------- C: \ Program Files \ PDF Password Remover v2.5
    2008-10-05 20:03. 2008-04-14 03:18 4274816 --------- C: \ WINDOWS \ system32 \ nv4_disp.dll
    2008-10-05 20:02. 2008-04-14 03:18 1888992 --------- C: \ WINDOWS \ system32 \ ati3duag.dll
    2008-10-05 20:01. 2008-04-14 03:18 136192 --------- C: \ WINDOWS \ system32 \ aaclient.dll
    2008-10-05 20:01. 2008-04-13 19:36 44928 --------- C: \ WINDOWS \ system32 \ drivers \ agpcpq.sys
    2008-10-05 20:01. 2008-04-13 19:36 42368 --------- C: \ WINDOWS \ system32 \ drivers \ Agp440.sys
    2008-10-05 20:01. 2008-04-14 03:18 4255 --------- C: \ WINDOWS \ system32 \ drivers \ adv01nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3967 --------- C: \ WINDOWS \ system32 \ drivers \ adv02nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3775 --------- C: \ WINDOWS \ system32 \ drivers \ adv11nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3711 --------- C: \ WINDOWS \ system32 \ drivers \ adv09nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3647 --------- C: \ WINDOWS \ system32 \ drivers \ adv07nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3615 --------- C: \ WINDOWS \ system32 \ drivers \ adv05nt5.dll
    2008-10-05 20:01. 2008-04-14 03:18 3135 --------- C: \ WINDOWS \ system32 \ drivers \ adv08nt5.dll

    .
    (((((((((((((((((((((((((((((((((((((( Report Find3M )))))))))) )))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-28 19:36 --------- ----- w d C: \ Program Files \ Eset
    2008-10-27 19:06 --------- ----- w d C: \ Documents and Settings \ All Users \ Application Data \ Google Updater
    2008-10-12 08:10 --------- ----- w d C: \ Program Files \ Google
    2008-10-10 22:38 90,112 ---- aw C: \ WINDOWS \ DUMP6d24.tmp
    2008-10-10 22:37 98,304 ---- aw C: \ WINDOWS \ DUMP2334.tmp
    2008-10-10 22:36 98,304 ---- aw C: \ WINDOWS \ DUMP3407.tmp
    2008-10-10 21:11 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ uTorrent
    2008-10-07 19:43 96384 ---- aw C: \ WINDOWS \ system32 \ drivers \ sptd9725.sys
    2008-09-30 18:13 --------- ----- w d C: \ Program Files \ Picasa2
    2008-09-17 17:17 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ Ahead
    2008-09-16 21:08 --------- ----- w d C: \ Program Files \ uTorrent
    2008-09-04 18:19 --------- ----- w d C: \ Program Files \ Pando Networks
    2008-08-05 20:05 53248 ---- aw C: \ WINDOWS \ system32 \ suppdll.dll
    2008-08-05 20:05 35363 ---- aw C: \ WINDOWS \ system32 \ windrvNT.sys
    .

    ((((((((((((((((((((((((((((((((( Loading Points Reg )))))))))))))) ))))))))))))))))))))))))))))))))))))
    .
    .
    * Note * empty entries & legitimate default entries are not displayed
    REGEDIT4

    [HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (7564a552-336f-41d4-b91a-1d409d5bb548)]
    2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll

    [HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (A23CABA5-C51E-4CB5-A23B-ADFA4D8D9FCF)]
    2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll

    [HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curren ntVersion \ Run]
    "ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2008-04-14 15360]

    [HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
    "nod32kui" = "C: \ Program Files \ Eset \ nod32kui.exe" [2008-06-04 921600]
    "SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ SoundMAX \ SMax4PNP.exe" [2004-10-14 1388544]
    "IgfxTray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2004-10-08 155,648]
    "HotKeysCmds" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2004-10-08 126,976]
    "THotkey" = "C: \ Program Files \ Toshiba \ Toshiba Applet \ thotkey.exe" [2004-12-14 368,640]
    "64769aed" = "C: \ WINDOWS \ system32 \ jkiagxlr.dll" [2008-10-28 75264]

    [HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
    "CTFMON.EXE" = "C: \ WINDOWS \ system32 \ CTFMON.EXE" [2008-04-14 15360]

    C: \ Documents and Settings \ All Users \ Start Menu £ \ Programs \ Startup \
    RAMASST.lnk - C: \ WINDOWS \ system32 \ RAMASST.exe [2008-06-05 155648]

    [HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ system]
    "DisableStatusMessages" = 0 (0x0)

    [HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ explorer]
    "NoDesktopCleanupWizard" = 1 (0x1)
    "ForceClassicControlPanel" = 1 (0x1)

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ policies \ explorer]
    "NoSMHelp" = 1 (0x1)
    "NoSMConfigurePrograms" = 1 (0x1)
    "NoSMMyPictures" = 1 (0x1)
    "NoResolveTrack" = 1 (0x1)
    "NoResolveSearch" = 1 (0x1)

    [HKEY_USERS \. Default \ software \ microsoft \ windows \ cur rentversion \ policies \ explorer]
    "NoSMHelp" = 1 (0x1)
    "NoSMConfigurePrograms" = 1 (0x1)
    "NoSMMyPictures" = 1 (0x1)
    "NoResolveTrack" = 1 (0x1)
    "NoResolveSearch" = 1 (0x1)

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
    "UIHost" = hex (2): 58,50,69,7 a, 65.5 f, 4c, 6f, 67.6 f, 6e, 2 e, 65,78,65,00

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows]
    "AppInit_DLLs" = jgqaho.dll

    [HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ drivers32]
    "VIDC.X264" = x264vfw.dll
    "VIDC.3iv2" = 3ivxVfWCodec.dll

    [HKEY_LOCAL_MACHINE \ system \ currentcontrolset \ contro l \ lsa]
    Authentication Packages REG_MULTI_SZ msv1_0 C: \ WINDOWS \ system32 \ jkkLDuTm

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile]
    "DisableUnicastResponsesToMulticastBroadcast" = 0 (0x0)

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ AuthorizedApplications \ List]
    "% windir% \ \ system32 \ \ Sessmgr.exe" =
    "C: \ \ Program Files \ \ Skype \ Phone \ \ Skype.exe" =
    "C: \ \ Program Files \ \ Pando Networks \ \ Pando \ \ pando.exe" =
    "C: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" =
    "% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" =
    "C: \ \ Program Files \ \ Malwarebytes' Anti-Malware \ \ mbam.exe" =

    [HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ GloballyOpenPorts \ List]
    "57214: TCP" = 57214: TCP: Pando P2P Listening TCP Port
    "57214: UDP" = 57214: UDP: Pando P2P UDP Port Listening
    "4662: TCP" = 4662: TCP: uTORRENT

    S2 gupdate1c8e071a1913dc0; Google Update Service (gupdate1c8e071a1913dc0); C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 133104]
    S3 iscFlash; iscFlash; C: \ WINDOWS \ Temp \ isc10tmp \ iscflas h.sys []
    S3 mpr_freader; MPR FileReader Driver; C: \ Program Files \ Multi Password Recovery \ mpr_freader.sys []
    S3 USBSTOR; Device USB mass storage of data; C: \ WINDOWS \ system32 \ DRIVERS \ USBSTOR.SYS [2008-04-13 26368]

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec0-3340-11dd-ab62-963b1372dd69)]
    \ Shell \ AutoRun \ command - F: \ Autorun.exe

    [HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec2-3340-11dd-ab62-963b1372dd69)]
    \ Shell \ AutoRun \ command - F: \ Autorun.exe
    .
    Content folder 'Scheduled Tasks'

    2008-10-28 C: \ WINDOWS \ Tasks \ GoogleUpdateTaskMachine.job
    - C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 23:42]
    .
    .
    ------- ------- Supplemental Analysis
    .
    FireFox -: Profile - C: \ Documents and Settings \ Administrator \ Application Data \ Mozilla \ Firefox \ Profiles \ n1ai0fhk.default \
    FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
    FF -: plugin - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ Browser \ nppdf32.dll
    FF -: plugin - C: \ Program Files \ Google \ Google Earth Plugin \ npgeplugin.dll
    FF -: plugin - C: \ Program Files \ Google \ Google Updater \ 2.2.1273.1045 \ npCIDetect12.dll
    FF -: plugin - C: \ Program Files \ Google \ Update \ 1.2.131.25 \ npGoogleOneClick 6.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava11.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava12.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava13.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava14.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava32.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJPI150_07.dll
    FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPOJI610.dll
    FF -: plugin - C: \ Program Files \ Mozilla Firefox \ plugins \ npPandoWebInst.dll
    FF -: plugin - C: \ Program Files \ Picasa2 \ npPicasa2.dll
    .

    ************************************************** ************************

    catchman 0.3.1367 W2K/XP/Vista - rootkit / stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-28 21:00:07
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    C: \ sccfg.sys 370 bytes
    C: \ WINDOWS \ system32 \ mTuDLkkj.ini 411,483 bytes
    C: \ WINDOWS \ system32 \ rlxgaikj.ini
    C: \ WINDOWS \ system32 \ jkiagxlr.dll

    The scan was completed successfully
    Hidden Files: 4

    ************************************************** ************************
    .
    --------------------- DLLs loaded under running processes ---------------------

    PROCESS: C: \ WINDOWS \ system32 \ lsass.exe
    -> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    -> C: \ Program Files \ Eset \ pr_imon.dll

    PROCESS: C: \ WINDOWS \ explorer.exe
    -> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
    -> C: \ WINDOWS \ system32 \ jkiagxlr.dll
    .
    Other processes running ------------------------ ---------------------- --
    .
    C: \ WINDOWS \ system32 \ DVDRAMSV.exe
    C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
    C: \ Program Files \ Eset \ nod32krn.exe
    C: \ Program Files \ CyberLink \ Shared files \ RichVideo.exe
    C: \ Program Files \ Analog Devices \ SoundMAX \ SMAgent.exe
    C: \ Program Files \ toshiba \ TOSHIBA Applet \ TAPPSRV.exe
    C: \ WINDOWS \ system32 \ wdfmgr.exe
    C: \ WINDOWS \ system32 \ wscntfy.exe
    C: \ WINDOWS \ system32 \ rundll32.exe
    C: \ WINDOWS \ system32 \ rundll32.exe
    .
    ************************************************** ************************
    .
    Time completed: 2008-10-28 21:02:18 - Rebooting the machine
    ComboFix-quarantined-files.txt 2008-10-28 20:02:10
    ComboFix2.txt 2008-10-28 19:43:22

    Pre-Run: 3,526,914,048 bytes free
    Post-Run: 3,516,989,440 bytes free

    218 E O F --- --- 2008-10-09 17:30:22
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules