Bullguard Antivirus Forum Download A Free Copy Of Bullguard Antivirus Software
Free Antivirus Forum - Learn about antivirus, firewalls and personal security Free Antivirus Forum - Learn about antivirus, firewalls and personal security
 HomeLog InRegisterCommunity CalendarSearch the ForumView The Member ListHelp
I need help removing a (wowfx.dll)
   
BullGuard Antivirus Forum > Virus Removal > Removal Help > I need help removing a (wowfx.dll)  
Forum Quick Jump
 
New Topic Post reply to : I need help removing a (wowfx.dll) Printable version of : I need help removing a (wowfx.dll)
[ << Previous Thread | Next Thread >> ]

thegascomp
New Member


Date Joined Sep 2007
Total Posts : 16
  		   Posted 8-31-2008 12:46 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Hello
 
I have download something and along with that happen to get a visitor, a wowfx.dll
now my norton keeps detecting it and doesnt seem to go away. i ran the other anti virus software i have but non of them detect the gritter.
 
can you help me remove it please
 
thank you
 
Thegascomp
 
Back to Top
 

thegascomp
New Member


Date Joined Sep 2007
Total Posts : 16
  		   Posted 8-31-2008 12:49 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:47:28 PM, on 8/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Unable to get Internet Explorer version!
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
c:\program files\dvrmstoolbox\dvrmsfilewatcherservice.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\ThaGas\Desktop\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O2 - BHO: Windows Live Call HoverToCall class - {7E853D72-626A-48EC-A868-BA8D5E23E045} - C:\Program Files\Windows Live\Messenger\HTC.DLL
O2 - BHO: BhoApp Class - {8A0B0A6D-F9E4-E432-2E58-287EEC2151A4} - C:\Program Files\altcmd\altcmd32.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9A9076FE-E6D1-4545-8224-3F65746FB9B9} - C:\WINDOWS\system32\urqNDspO.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O3 - Toolbar: qalkfxor - {EB5B47E9-140B-4E4B-B9EF-A0D5BF1DA2AD} - C:\WINDOWS\qalkfxor.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Drag'n'Drop_Autolaunch] "C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe"
O4 - HKLM\..\Run: [SmartPatrol] C:\PROGRA~1\AddWeb8\SmartPatrol.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: hp psc 1000 series.lnk = ?
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://linktrader.cyberspacehq.com
O16 - DPF: CabBuilder - http://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1195079143781
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://www.gamehouse.com/games/mjolauncher.cab
O16 - DPF: {80B626D6-BC34-4BCF-B5A1-7149E4FD9CFA} (UnoCtrl Class) - http://zone.msn.com/bingame/zpagames/GAME_UNO1.cab60096.cab
O16 - DPF: {ABB660B6-6694-407B-950A-EDBA5A159722} (DVC Download Control) - http://www.gamehouse.com/games/dvcode/DVCControl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab
O20 - AppInit_DLLs: C:\WINDOWS\system32\wowfx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: awtSMDsr - awtSMDsr.dll (file missing)
O21 - SSODL: UgixjC - {6023109C-CA89-BA36-5A4C-D7F879A78B20} - (no file)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Application Layer Gateway Service ALGSpooler (ALGSpooler) - Unknown owner - C:\WINDOWS\system32\aasliax.exe (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DVRMSFileWatcherService -   - c:\program files\dvrmstoolbox\dvrmsfilewatcherservice.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: ScsiAccess - Unknown owner - C:\Program Files\Photodex\ProShowGold\ScsiAccess.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 15358 bytes
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13812
  		   Posted 8-31-2008 4:58 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Hello scool
 
 
Please download Combofix:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
 
 
And save to the desktop.

Close all other browser windows.
 
 
 
 
Important-> Temporarily disable your anti-virus, real-time protection before performing a scan. They can interfere with combofix or remove some of its embedded files which may cause "unpredictable results".
 
 
Go to Start->Run and copy/paste: ComboFix /snapshot and hit OK. It should run Combofix.
 
Please note, that once you start combofix you should not click anywhere on the combofix window as it can cause the program to stall. In fact, when combofix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

 When finished, it will produce a logfile located at C:\combofix.txt.
 

Post the contents of that log in your next reply
 
NB. If you are using any P2P (file sharing) programs, please remove them before we clean your computer.. We do not clean logs that have P2P applications installed as this can cause reinfection during your cleaning.

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

thegascomp
New Member


Date Joined Sep 2007
Total Posts : 16
  		   Posted 8-31-2008 1:33 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
ComboFix 08-08-30.03 - ThaGas 2008-08-31 8:10:56.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1361 [GMT -4:00]
Running from: C:\Documents and Settings\ThaGas\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.\documents\Settings
C:\Documents and Settings\LocalService\Application Data\microsoft\internet explorer\Desktop.htt
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\#SharedObjects\XPRMNN8N\bin.clearspring.com
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\#SharedObjects\XPRMNN8N\bin.clearspring.com\clearspring.sol
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\#SharedObjects\XPRMNN8N\interclick.com
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\#SharedObjects\XPRMNN8N\interclick.com\ud.sol
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#bin.clearspring.com\settings.sol
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\ThaGas\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\ThaGas\Application Data\temp.dll
C:\Documents and Settings\ThaGas\Start Menu\Programs\PlayMP3z
C:\Documents and Settings\ThaGas\Start Menu\Programs\PlayMP3z\Run PlayMP3z.lnk
C:\Program Files\altcmd
C:\Program Files\altcmd\altcmd.inf
C:\Program Files\altcmd\uninstall.bat
C:\Program Files\FBrowserAdvisor
C:\Program Files\FBrowsingAdvisor
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt
C:\Program Files\FBrowsingAdvisor\Logo.png
C:\Program Files\FBrowsingAdvisor\main.db
C:\Program Files\FBrowsingAdvisor\Thumbs.db
C:\Program Files\FBrowsingAdvisor\unins000.dat
C:\Program Files\FBrowsingAdvisor\unins000.exe
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll
C:\Program Files\PlayMP3z
C:\Program Files\PlayMP3z\PlayMP3.exe
C:\Program Files\PlayMP3z\uninstall.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system32\config\system~1\applic~1\install.dat
C:\WINDOWS\system32\gvmusixg.dll
C:\WINDOWS\system32\gxisumvg.ini
C:\WINDOWS\system32\OpsDNqru.ini
C:\WINDOWS\system32\OpsDNqru.ini2

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_6TO4
-------\Legacy_ALGSPOOLER
-------\Legacy_IPRIP
-------\Legacy_SYMAVC32
-------\Legacy_ZZZDRV_LICH
-------\Service_6to4
-------\Service_ALGSpooler
-------\Service_Driver
-------\Service_Iprip
-------\Service_symavc32


((((((((((((((((((((((((( Files Created from 2008-07-28 to 2008-08-31 )))))))))))))))))))))))))))))))
.

2008-08-29 14:25 . 2008-08-29 14:25 <DIR> d-------- C:\WINDOWS\system32\xlib254.dll
2008-08-29 14:25 . 2008-08-29 14:25 <DIR> d-------- C:\WINDOWS\system32\append.dll
2008-08-29 14:23 . 2008-08-29 13:16 155,648 --a------ C:\WINDOWS\qalkfxor.dll
2008-08-25 21:12 . 2008-08-25 21:12 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-22 18:16 . 2008-08-22 18:16 <DIR> d-------- C:\Program Files\BreezeSys
2008-08-22 18:16 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-08-22 18:16 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-08-22 13:44 . 2008-08-22 13:44 <DIR> d-------- C:\Program Files\Veoh Networks
2008-08-13 10:22 . 2008-08-13 10:22 <DIR> d-------- C:\Program Files\Sun
2008-08-13 10:18 . 2008-05-01 10:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 10:05 . 2008-08-13 10:06 <DIR> d-------- C:\Program Files\QuickTime
2008-08-13 10:04 . 2008-08-13 10:04 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-11 22:00 . 2008-08-22 18:49 <DIR> d-------- C:\Program Files\Canon
2008-08-11 22:00 . 2008-08-11 22:00 <DIR> d-------- C:\canondcc
2008-08-11 16:32 . 2008-08-11 16:32 9,275 --ah----- C:\hpothb07.tif
2008-08-11 16:32 . 2008-08-11 16:32 2,285 --ah----- C:\hpothb07.dat
2008-08-11 16:27 . 2008-08-11 16:27 3,925 --ah----- C:\Documents and Settings\ThaGas\hpothb07.dat
2008-08-08 13:33 . 2008-08-08 13:33 <DIR> d-------- C:\Program Files\VCDEasy
2008-08-08 13:33 . 2008-08-08 13:33 <DIR> d-------- C:\Documents and Settings\ThaGas\Application Data\VCDEasy
2008-08-04 14:37 . 2008-08-04 14:37 268 --ah----- C:\sqmdata19.sqm
2008-08-04 14:37 . 2008-08-04 14:37 244 --ah----- C:\sqmnoopt19.sqm
2008-08-04 14:25 . 2002-11-01 08:00 18,944 --a------ C:\WINDOWS\system32\simptcp.dll
2008-08-04 14:25 . 2002-11-01 08:00 18,944 --a--c--- C:\WINDOWS\system32\dllcache\simptcp.dll
2008-08-04 14:06 . 2008-08-04 14:06 268 --ah----- C:\sqmdata18.sqm
2008-08-04 14:06 . 2008-08-04 14:06 244 --ah----- C:\sqmnoopt18.sqm
2008-08-03 03:06 . 2008-08-03 03:06 268 --ah----- C:\sqmdata17.sqm
2008-08-03 03:06 . 2008-08-03 03:06 244 --ah----- C:\sqmnoopt17.sqm
2008-08-02 15:44 . 2008-08-02 15:44 268 --ah----- C:\sqmdata16.sqm
2008-08-02 15:44 . 2008-08-02 15:44 244 --ah----- C:\sqmnoopt16.sqm
2008-08-02 14:55 . 2008-08-02 14:55 268 --ah----- C:\sqmdata15.sqm
2008-08-02 14:55 . 2008-08-02 14:55 244 --ah----- C:\sqmnoopt15.sqm
2008-08-02 14:49 . 2008-08-02 14:49 268 --ah----- C:\sqmdata14.sqm
2008-08-02 14:49 . 2008-08-02 14:49 244 --ah----- C:\sqmnoopt14.sqm
2008-08-02 09:24 . 2008-08-02 09:24 268 --ah----- C:\sqmdata13.sqm
2008-08-02 09:24 . 2008-08-02 09:24 244 --ah----- C:\sqmnoopt13.sqm
2008-08-02 09:19 . 2008-08-02 09:19 268 --ah----- C:\sqmdata12.sqm
2008-08-02 09:19 . 2008-08-02 09:19 244 --ah----- C:\sqmnoopt12.sqm
2008-07-15 16:07 . 2008-07-15 16:07 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-07-10 21:21 . 2008-07-10 21:21 <DIR> d-------- C:\Documents and Settings\ThaGas\Application Data\DAEMON Tools
2008-07-10 21:21 . 2008-07-10 21:21 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-07-07 16:32 . 2008-07-07 16:32 253,952 -----c--- C:\WINDOWS\system32\dllcache\es.dll
2008-07-06 11:41 . 2008-07-06 11:41 0 --a------ C:\WINDOWS\system32\QuickTime.qtp
2008-07-05 22:05 . 2008-07-05 22:05 <DIR> d-------- C:\Program Files\Xilisoft
2008-07-05 21:53 . 2008-07-05 21:59 <DIR> d--h----- C:\Program Files\Zero G Registry
2008-07-05 21:53 . 2008-07-05 21:53 <DIR> d--h----- C:\Documents and Settings\ThaGas\InstallAnywhere
2008-07-05 15:35 . 2008-07-05 15:40 <DIR> d-------- C:\Program Files\Swf2Avi
2008-07-05 15:34 . 2008-07-05 15:34 33,832 --a------ C:\WINDOWS\system32\aqufejhm.exe
2008-07-05 14:53 . 2008-08-11 16:50 <DIR> d-------- C:\Program Files\ALLCapture 2.0 Trial
2008-07-05 14:53 . 2008-07-05 15:02 <DIR> d-------- C:\Documents and Settings\ThaGas\Application Data\ALLCapture
2008-07-05 14:53 . 2008-07-05 14:53 9,864,877 --a------ C:\temp\allcapture-trial.exe
2008-07-05 14:48 . 2008-07-05 14:48 <DIR> d-------- C:\Program Files\Deskshare
2008-07-05 14:48 . 2008-08-22 19:11 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-05 14:47 . 2008-07-05 14:48 4,508,960 --a------ C:\temp\myscreenrecorder.exe
2008-07-03 09:24 . 2008-07-03 09:24 268 --ah----- C:\sqmdata11.sqm
2008-07-03 09:24 . 2008-07-03 09:24 244 --ah----- C:\sqmnoopt11.sqm
2008-07-02 12:18 . 2008-07-02 12:18 8,250,382 --a------ C:\WINDOWS\screensaver2.scr
2008-07-02 12:12 . 2008-07-02 12:13 6,677,212 --a------ C:\WINDOWS\screensaver.scr
2008-07-01 19:09 . 2008-07-01 19:09 268 --ah----- C:\sqmdata10.sqm
2008-07-01 19:09 . 2008-07-01 19:09 244 --ah----- C:\sqmnoopt10.sqm
2008-07-01 17:42 . 2008-07-01 17:42 268 --ah----- C:\sqmdata09.sqm
2008-07-01 17:42 . 2008-07-01 17:42 244 --ah----- C:\sqmnoopt09.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-31 12:16 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-08-31 00:51 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\FileZilla
2008-08-30 23:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-30 01:51 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-08-29 18:39 --------- d-----w C:\Program Files\Norton Security Scan
2008-08-27 00:39 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\Corel
2008-08-24 22:57 --------- d-----w C:\Program Files\Incomplete
2008-08-24 21:19 --------- d-----w C:\Program Files\LimeWire
2008-08-24 20:35 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\LimeWire
2008-08-22 22:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 07:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-13 14:21 --------- d-----w C:\Program Files\Java
2008-08-11 20:50 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-11 20:50 --------- d-----w C:\Program Files\PC Inspector File Recovery
2008-08-11 20:50 --------- d-----w C:\Program Files\Flash Slideshow Maker Professional
2008-08-11 20:50 --------- d-----w C:\Program Files\EmailMarketingDirector
2008-08-11 20:50 --------- d-----w C:\Program Files\DivX
2008-08-11 18:08 --------- d-----w C:\Program Files\FileZilla Client
2008-08-06 19:50 --------- d-----w C:\Program Files\Google
2008-08-06 07:05 --------- d-----w C:\Program Files\Microsoft Works
2008-08-04 20:04 --------- d-----w C:\Program Files\Winamp Remote
2008-04-14 00:15 92,064 ----a-w C:\Documents and Settings\ThaGas\mqdmmdm.sys
2008-04-14 00:15 9,232 ----a-w C:\Documents and Settings\ThaGas\mqdmmdfl.sys
2008-04-14 00:15 79,328 ----a-w C:\Documents and Settings\ThaGas\mqdmserd.sys
2008-04-14 00:15 66,656 ----a-w C:\Documents and Settings\ThaGas\mqdmbus.sys
2008-04-14 00:15 6,208 ----a-w C:\Documents and Settings\ThaGas\mqdmcmnt.sys
2008-04-14 00:15 5,936 ----a-w C:\Documents and Settings\ThaGas\mqdmwhnt.sys
2008-04-14 00:15 4,048 ----a-w C:\Documents and Settings\ThaGas\mqdmcr.sys
2008-04-14 00:15 25,600 ----a-w C:\Documents and Settings\ThaGas\usbsermptxp.sys
2008-04-14 00:15 22,768 ----a-w C:\Documents and Settings\ThaGas\usbsermpt.sys
2008-02-26 00:04 8,161,280 ----a-w C:\Program Files\HTML Guardian 7.msi
2007-12-03 17:31 36,868 ----a-w C:\Program Files\uninst-3DStroke.exe
2007-11-15 19:27 476,752 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{EB5B47E9-140B-4E4B-B9EF-A0D5BF1DA2AD}"= "C:\WINDOWS\qalkfxor.dll" [2008-08-29 13:16 155648]

[HKEY_CLASSES_ROOT\clsid\{eb5b47e9-140b-4e4b-b9ef-a0d5bf1da2ad}]
[HKEY_CLASSES_ROOT\qalkfxor.1]
[HKEY_CLASSES_ROOT\TypeLib\{3AEEDFDA-C26F-4F18-A897-630E3A5A46A6}]
[HKEY_CLASSES_ROOT\qalkfxor]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 15:06 1318912]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-17 15:05 68856]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 12:15 50528]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 16:02 495616]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 18:06 3660848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-04-30 22:07 843776]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 17:44 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 16:18 124128]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-15 15:14 180269]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"Drag'n'Drop_Autolaunch"="C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe" [2004-08-10 14:47 131072]
"SmartPatrol"="C:\PROGRA~1\AddWeb8\SmartPatrol.exe" [2008-02-05 02:54 1171968]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 18:54 37376]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 18:14 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"nwiz"="nwiz.exe" [2007-10-04 18:14 1626112 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 03:18 437160]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 16:32 8699904]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 02:19:50 217193]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-15 14:44:43 110592]
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 18:21:38 147456]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 18:11:12 28672]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 14:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\cinemsup.sys [2002-07-19 09:10]
R2 DVRMSFileWatcherService;DVRMSFileWatcherService;c:\program files\dvrmstoolbox\dvrmsfilewatcherservice.exe [2008-03-19 20:09]
R2 io.sys;IO.DLL Driver;C:\WINDOWS\system32\drivers\io.sys [2008-04-06 00:34]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2007-12-03 13:38]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
S1 kcp;kcp;C:\WINDOWS\system32\drivers\kcp.sys []
S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys []
S3 mamotou;mamotou;C:\WINDOWS\system32\DRIVERS\mamotou.sys [2007-02-02 16:57]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2007-12-03 13:38]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2007-12-03 13:38]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2007-12-03 13:38]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2007-12-03 13:38]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-29 11:17]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13668f27-aa4a-11dc-947c-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{834bd6ab-a66b-11dc-9470-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9adb552e-93a9-11dc-9455-001a92bf0034}]
\Shell\AutoRun\command - LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d99fba85-c1fe-11dc-9498-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4358d95-4ada-11dd-8fd6-001a92bf0034}]
\Shell\AutoRun\command - setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-31 C:\WINDOWS\Tasks\1-Click Maintenance.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-04-16 09:59]

2008-08-26 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-06-27 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1206111487.job
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-09 17:56]

2008-08-31 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 20:20]

2008-08-27 C:\WINDOWS\Tasks\Norton Security Scan.job
- C:\Program Files\Norton Security Scan\Nss.exe [2008-01-09 04:08]
.
- - - - ORPHANS REMOVED - - - -

BHO-{9A9076FE-E6D1-4545-8224-3F65746FB9B9} - C:\WINDOWS\system32\urqNDspO.dll
WebBrowser-{6638A9DE-0745-4292-8A2E-AE530E7B9B3F} - (no file)
SSODL-UgixjC-{6023109C-CA89-BA36-5A4C-D7F879A78B20} - (no file)
Notify-awtSMDsr - awtSMDsr.dll


.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1;*.local
O8 -: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
C:\WINDOWS\Downloaded Program Files\OSDED4D.OSD
C:\WINDOWS\Downloaded Program Files\InstallerControl.dll

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {ABB660B6-6694-407B-950A-EDBA5A159722} - hxxp://www.gamehouse.com/games/dvcode/DVCControl.cab
C:\WINDOWS\Downloaded Program Files\DVC Download Control.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-31 08:19:12
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Photodex\ProShowGold\scsiaccess.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
C:\Program Files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2008-08-31 8:29:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-31 12:29:47
ComboFix2.txt 2007-12-18 23:00:32

Pre-Run: 50,382,118,912 bytes free
Post-Run: 51,003,973,632 bytes free

310 --- E O F --- 2008-08-29 04:24:38
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13812
  		   Posted 8-31-2008 2:17 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Please download Malwarebytes' Anti-Malware:
http://www.spywarefri.dk/downloads1/mbam-setup.exe
 
Or here:
http://www.download.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?tag=mncol;pop&cdlPid=10878968
 
 to your desktop.
 
Double-click mbam-setup.exe and follow the prompts to install the program.
                     
At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch


Malwarebytes' Anti-Malware, then click Finish.
                     
If an update is found, it will download and install the latest version.
                     
Once the program has loaded, select Perform full scan, then click Scan.
                     
When the scan is complete, click OK, then Show Results to view the results.
 
Be sure that everything is checked, and click Remove Selected.
 
When completed, a log will open in Notepad. Please save it to a convenient location.
 
Copy and Paste that log into your next reply, along with fresh combofix  log.
 
 
NB: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
 

Do NOT post your problem in someone elses thread.
Member of - Alliance of Security Analysis Professionals
Please do NOT PM me any logs. They will be deleted

Back to Top
 

thegascomp
New Member


Date Joined Sep 2007
Total Posts : 16
  		   Posted 9-7-2008 10:00 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
ComboFix 08-09-05.02 - ThaGas 2008-09-07 4:29:46.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1458 [GMT -4:00]
Running from: C:\Documents and Settings\ThaGas\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))
.

2008-09-07 04:38 . 2008-09-07 04:38 27 --a------ C:\Flag.Fil
2008-08-31 09:41 . 2008-08-31 09:41 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-31 09:41 . 2008-08-31 09:41 <DIR> d-------- C:\Documents and Settings\ThaGas\Application Data\Malwarebytes
2008-08-31 09:41 . 2008-08-31 09:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-31 09:41 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-31 09:41 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-29 14:25 . 2008-08-29 14:25 <DIR> d-------- C:\WINDOWS\system32\xlib254.dll
2008-08-29 14:25 . 2008-08-29 14:25 <DIR> d-------- C:\WINDOWS\system32\append.dll
2008-08-29 14:23 . 2008-08-29 13:16 155,648 --a------ C:\WINDOWS\qalkfxor.dll
2008-08-25 21:12 . 2008-08-25 21:12 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-22 18:16 . 2008-08-22 18:16 <DIR> d-------- C:\Program Files\BreezeSys
2008-08-22 18:16 . 2004-08-04 00:56 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-08-22 18:16 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-08-22 13:44 . 2008-08-22 13:44 <DIR> d-------- C:\Program Files\Veoh Networks
2008-08-13 10:22 . 2008-08-13 10:22 <DIR> d-------- C:\Program Files\Sun
2008-08-13 10:18 . 2008-05-01 10:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 10:05 . 2008-08-13 10:06 <DIR> d-------- C:\Program Files\QuickTime
2008-08-13 10:04 . 2008-08-13 10:04 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-11 22:00 . 2008-08-22 18:49 <DIR> d-------- C:\Program Files\Canon
2008-08-11 22:00 . 2008-08-11 22:00 <DIR> d-------- C:\canondcc
2008-08-11 16:32 . 2008-08-11 16:32 9,275 --ah----- C:\hpothb07.tif
2008-08-11 16:32 . 2008-08-11 16:32 2,285 --ah----- C:\hpothb07.dat
2008-08-11 16:27 . 2008-08-11 16:27 3,925 --ah----- C:\Documents and Settings\ThaGas\hpothb07.dat
2008-08-08 13:33 . 2008-08-08 13:33 <DIR> d-------- C:\Program Files\VCDEasy
2008-08-08 13:33 . 2008-08-08 13:33 <DIR> d-------- C:\Documents and Settings\ThaGas\Application Data\VCDEasy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-06 23:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-09-06 19:46 --------- d-----w C:\Program Files\Incomplete
2008-09-06 19:44 --------- d-----w C:\Program Files\LimeWire
2008-09-06 19:39 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\LimeWire
2008-09-06 19:39 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\FileZilla
2008-09-01 21:59 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\Corel
2008-09-01 12:39 --------- d-----w C:\Program Files\Symantec AntiVirus
2008-09-01 12:36 --------- d-----w C:\Program Files\Norton Security Scan
2008-08-30 01:51 --------- d-----w C:\Program Files\SUPERAntiSpyware
2008-08-22 23:11 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-22 22:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-14 07:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-08-13 14:21 --------- d-----w C:\Program Files\Java
2008-08-11 20:50 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-11 20:50 --------- d-----w C:\Program Files\PC Inspector File Recovery
2008-08-11 20:50 --------- d-----w C:\Program Files\Flash Slideshow Maker Professional
2008-08-11 20:50 --------- d-----w C:\Program Files\EmailMarketingDirector
2008-08-11 20:50 --------- d-----w C:\Program Files\DivX
2008-08-11 20:50 --------- d-----w C:\Program Files\ALLCapture 2.0 Trial
2008-08-11 18:08 --------- d-----w C:\Program Files\FileZilla Client
2008-08-06 19:50 --------- d-----w C:\Program Files\Google
2008-08-06 07:05 --------- d-----w C:\Program Files\Microsoft Works
2008-08-04 20:04 --------- d-----w C:\Program Files\Winamp Remote
2008-07-11 01:21 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-07-11 01:21 --------- d-----w C:\Documents and Settings\ThaGas\Application Data\DAEMON Tools
2008-07-02 16:18 8,250,382 ----a-w C:\WINDOWS\screensaver2.scr
2008-07-02 16:13 6,677,212 ----a-w C:\WINDOWS\screensaver.scr
2008-04-14 00:15 92,064 ----a-w C:\Documents and Settings\ThaGas\mqdmmdm.sys
2008-04-14 00:15 9,232 ----a-w C:\Documents and Settings\ThaGas\mqdmmdfl.sys
2008-04-14 00:15 79,328 ----a-w C:\Documents and Settings\ThaGas\mqdmserd.sys
2008-04-14 00:15 66,656 ----a-w C:\Documents and Settings\ThaGas\mqdmbus.sys
2008-04-14 00:15 6,208 ----a-w C:\Documents and Settings\ThaGas\mqdmcmnt.sys
2008-04-14 00:15 5,936 ----a-w C:\Documents and Settings\ThaGas\mqdmwhnt.sys
2008-04-14 00:15 4,048 ----a-w C:\Documents and Settings\ThaGas\mqdmcr.sys
2008-04-14 00:15 25,600 ----a-w C:\Documents and Settings\ThaGas\usbsermptxp.sys
2008-04-14 00:15 22,768 ----a-w C:\Documents and Settings\ThaGas\usbsermpt.sys
2008-02-26 00:04 8,161,280 ----a-w C:\Program Files\HTML Guardian 7.msi
2007-12-03 17:31 36,868 ----a-w C:\Program Files\uninst-3DStroke.exe
2007-11-15 19:27 476,752 ----a-w C:\Documents and Settings\All Users\Application Data\pswi_preloaded.exe
.

((((((((((((((((((((((((((((( snapshot@2008-08-31_ 8.29.30.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-27 00:37:20 3,922 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
+ 2008-09-01 21:56:22 3,922 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 1318912]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-17 68856]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 50528]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-01-07 495616]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-08-13 3660848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-04-30 843776]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-02-29 66680]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2004-03-12 124128]
"NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-15 180269]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Drag'n'Drop_Autolaunch"="C:\Program Files\Iomega HotBurn Pro\Autolaunch.exe" [2004-08-10 131072]
"SmartPatrol"="C:\PROGRA~1\AddWeb8\SmartPatrol.exe" [2008-02-05 1171968]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 37376]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-04 8491008]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 413696]
"nwiz"="nwiz.exe" [2007-10-04 C:\WINDOWS\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-11-15 110592]
hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2003-04-09 147456]
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-04-09 28672]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2007-04-19 14:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"SENTINEL"= snti386.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

R1 Cinemsup;Cinemsup;C:\WINDOWS\system32\drivers\cinemsup.sys [2002-07-19 6656]
R2 DVRMSFileWatcherService;DVRMSFileWatcherService;c:\program files\dvrmstoolbox\dvrmsfilewatcherservice.exe [2008-03-19 20480]
R2 io.sys;IO.DLL Driver;C:\WINDOWS\system32\drivers\io.sys [2008-04-06 5152]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2007-12-03 14336]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652]
S1 kcp;kcp;C:\WINDOWS\system32\drivers\kcp.sys [ ]
S2 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [ ]
S3 mamotou;mamotou;C:\WINDOWS\system32\DRIVERS\mamotou.sys [2007-02-02 49377]
S3 p2pgasvc;Peer Networking Group Authentication;C:\WINDOWS\System32\svchost.exe [2007-12-03 14336]
S3 p2pimsvc;Peer Networking Identity Manager;C:\WINDOWS\System32\svchost.exe [2007-12-03 14336]
S3 p2psvc;Peer Networking;C:\WINDOWS\System32\svchost.exe [2007-12-03 14336]
S3 PNRPSvc;Peer Name Resolution Protocol;C:\WINDOWS\System32\svchost.exe [2007-12-03 14336]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-04-29 354560]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{13668f27-aa4a-11dc-947c-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{834bd6ab-a66b-11dc-9470-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9adb552e-93a9-11dc-9455-001a92bf0034}]
\Shell\AutoRun\command - LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d99fba85-c1fe-11dc-9498-001a92bf0034}]
\Shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f4358d95-4ada-11dd-8fd6-001a92bf0034}]
\Shell\AutoRun\command - setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
.
.
------- Supplementary Scan -------
.
R1 -: HKCU-Internet Settings,ProxyOverride = 127.0.0.1;*.local
O8 -: &AOL Toolbar Search - c:\program files\aol\aim toolbar 5.0\resources\en-US\local\search.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O16 -: CabBuilder - hxxp://kiw.imgag.com/imgag/kiw/toolbar/download/InstallerControl.cab
C:\WINDOWS\Downloaded Program Files\OSDED4D.OSD
C:\WINDOWS\Downloaded Program Files\InstallerControl.dll

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {ABB660B6-6694-407B-950A-EDBA5A159722} - hxxp://www.gamehouse.com/games/dvcode/DVCControl.cab
C:\WINDOWS\Downloaded Program Files\DVC Download Control.ocx
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 04:37:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PSIService.exe
C:\Program Files\Photodex\ProShowGold\scsiaccess.exe
C:\WINDOWS\system32\tcpsvcs.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-09-07 4:48:27 - machine was rebooted [ThaGas]
ComboFix-quarantined-files.txt 2008-09-07 08:48:23
ComboFix2.txt 2008-08-31 12:29:52
ComboFix3.txt 2007-12-18 23:00:32

Pre-Run: 35,181,391,872 bytes free
Post-Run: 46,509,768,704 bytes free

213 --- E O F --- 2008-09-03 03:12:14
Back to Top
 

thegascomp
New Member


Date Joined Sep 2007
Total Posts : 16
  		   Posted 9-7-2008 10:01 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Malwarebytes' Anti-Malware 1.24
Database version: 1012
Windows 5.1.2600 Service Pack 2

10:37:22 AM 8/31/2008
mbam-log-8-31-2008 (10-37-22).txt

Scan type: Full Scan (C:\|)
Objects scanned: 206672
Time elapsed: 43 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 8

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\smartenhancer (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\WR (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\downloader.downloaderctrl.1 (Adware.2020search) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\SmartEnhancer (Trojan.BHO) -> Quarantined and deleted successfully.

Files Infected:
C:\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\FBrowsingAdvisor\XPCOMEvents.dll.vir (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\QooBox\Quarantine\C\Program Files\PlayMP3z\PlayMP3.exe.vir (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7641E3A9-64B5-47B3-A86D-B2AD451689BA}\RP393\A0137086.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{7641E3A9-64B5-47B3-A86D-B2AD451689BA}\RP393\A0137087.exe (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
C:\Program Files\SmartEnhancer\pcre3.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\SmartEnhancer\SmartEnhancer.dat (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Program Files\SmartEnhancer\uninstall.exe (Trojan.BHO) -> Quarantined and deleted successfully.
Back to Top
 

Touch
Forum Moderator




Date Joined Jun 2004
Total Posts : 13812
  		   Posted 9-9-2008 5:51 (GMT +1)    Quote: I need help removing a (wowfx.dll)Alert an admin about: I need help removing a (wowfx.dll)
Open notepad and copy/paste the text in the quotebox below into it:


Quote:
 
Killall::
 
Snapshot::
 
 
File::
C:\WINDOWS\qalkfxor.dll
C:\Windows\System32\drivers\kcp.sys
 
Driver::
kcp


 
Save this as:
CFScript
 
http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif
Refering to the picture above, drag CFScript into ComboFix.exe

Then post fresh combofix  log.

Do NOT post your problem in someone elses thread.
A non-profit, volunteer network.

Back to Top
 
New Topic Post reply to : I need help removing a (wowfx.dll) Printable version of : I need help removing a (wowfx.dll)
 
Forum Information
Currently it is Wednesday, December 03, 2008 7:00 AM (GMT +1)
There are a total of 64.512 posts in 15.910 threads.
In the last 3 days there were 19 new threads and 77 reply posts. View Active Threads
Who's Online
This forum has 27326 registered members. Please welcome our newest member, DooN.
41 Guest(s), 0 Registered Member(s) are currently online.  Details
5 Latest Threads
Help with a (win32 trojan gen other) (0)03-12-2008 02:25:45 (finz)
Ok...I'm infected, now what? (24)03-12-2008 02:11:28 (Zalen)
Antivirus disabled/URL Redirect Malware.Wont let me install MALEWAREBYTES (3)03-12-2008 02:08:19 (cgamm)
Trojan Horse Generic 12.KAO (5)03-12-2008 02:01:58 (Taryn)
No Safe Mode, explorer.exe crashes, no internet (0)03-12-2008 00:49:20 (roygbp)


Need Support? Write to: | Forum Help Manual

Download free trial version of Bullguard