Malwarebytes' Anti-Malware 1.26
Database version: 1110
Windows 5.1.2600 Service Pack 2
9/3/2008 4:46:33 AM
mbam-log-2008-09-03 (04-46-33).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 264322
Time elapsed: 4 hour(s), 26 minute(s), 39 second(s)
Memory Processes Infected: 17
Memory Modules Infected: 6
Registry Keys Infected: 13
Registry Values Infected: 43
Registry Data Items Infected: 4
Folders Infected: 17
Files Infected: 69
Memory Processes Infected:
D:\WINDOWS\runsql.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\sv.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\svzip.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\vlc.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\wdmon.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\svx.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\svw.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\WINDOWS\svc.exe (Trojan.Downloader) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\msctrl.exe (Trojan.Agent) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\msavsc.exe (Trojan.Agent) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\msscan.exe (Trojan.Agent) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\msiemon.exe (Trojan.Agent) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\msfw.exe (Trojan.Agent) -> Unloaded process successfully.
D:\Program Files\Microsoft Security Adviser\mssadv.exe (Trojan.Clicker) -> Unloaded process successfully.
D:\Program Files\rhceqlj0ec6p\rhceqlj0ec6p.exe (Rogue.Multiple) -> Unloaded process successfully.
D:\WINDOWS\svhoster.exe (Trojan.Agent) -> Unloaded process successfully.
D:\WINDOWS\system32\pphcaqlj0ec6p.exe (Trojan.FakeAlert) -> Unloaded process successfully.
Memory Modules Infected:
D:\Documents and Settings\Default\Local Settings\Temp\wndutl32.dll (Trojan.FakeAlert) -> Delete on reboot.
D:\Program Files\rhceqlj0ec6p\MFC71.dll (Rogue.Multiple) -> Delete on reboot.
D:\Program Files\rhceqlj0ec6p\MFC71ENU.DLL (Rogue.Multiple) -> Delete on reboot.
D:\Program Files\rhceqlj0ec6p\msvcp71.dll (Rogue.Multiple) -> Delete on reboot.
D:\Program Files\rhceqlj0ec6p\msvcr71.dll (Rogue.Multiple) -> Delete on reboot.
D:\WINDOWS\system32\autodis.dll (Spyware.BZub) -> Delete on reboot.
Registry Keys Infected:
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{020487cc-fc04-4b1e-863f-d9801796230b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\rhceqlj0ec6p (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\rhceqlj0ec6p (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\wkey (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\mwc (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{389992b5-9fad-42a7-a7aa-8cfb256e7676} (Spyware.BZub) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{389992b5-9fad-42a7-a7aa-8cfb256e7676} (Spyware.BZub) -> Quarantined and deleted successfully.
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\runsql (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netsv32 (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netzip (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\vlc (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wdmon (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netx (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netw (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\netc (Trojan.Downloader) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msctrl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msctrl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msavsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msavsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msscan.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msscan.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msiemon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msiemon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msfw.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msfw.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\{020487cc-fc04-4b1e-863f-d9801796230b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\D:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smrhceqlj0ec6p (Rogue.Multiple) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\antivirus (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\net64 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\UpdateWin (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bf (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\bk (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\iu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\OLE\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SYSTEM\CurrentControlSet\Control\Lsa\UpdateWin (Worm.Sdbot) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcaqlj0ec6p (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mssadv.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
Folders Infected:
D:\Program Files\Microsoft Security Adviser (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\append.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\xlib254.dll (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\rhceqlj0ec6p\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008 (Rogue.AntivirusXP2008) -> Quarantined and deleted successfully.
Files Infected:
D:\WINDOWS\runsql.exe (Trojan.Downloader) -> Delete on reboot.
D:\WINDOWS\sv.exe (Trojan.Downloader) -> Delete on reboot.
D:\WINDOWS\svzip.exe (Trojan.Downloader) -> Delete on reboot.
D:\WINDOWS\vlc.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\wdmon.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\svx.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\svw.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\WINDOWS\svc.exe (Trojan.Downloader) -> Delete on reboot.
D:\Program Files\Microsoft Security Adviser\msctrl.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\Microsoft Security Adviser\msavsc.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\Microsoft Security Adviser\msscan.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\Microsoft Security Adviser\msiemon.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\Microsoft Security Adviser\msfw.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\Program Files\Microsoft Security Adviser\mssadv.exe (Trojan.Clicker) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\wndutl32.dll (Trojan.FakeAlert) -> Delete on reboot.
D:\WINDOWS\Downloaded Program Files\popcaploader.dll (Adware.PopCap) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25caf.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25caa.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cab.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cac.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cad.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cae.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cag.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cah.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cai.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25cap.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25caq.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\60325cahp25car.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\QooBox\Quarantine\D\WINDOWS\system32\blphcaqlj0ec6p.scr.vir (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\blphcaqlj0ec6p.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\0.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\PCHealthCenter\e (Trojan.Fakealert) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\MFC71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\MFC71ENU.DLL (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\msvcp71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\msvcr71.dll (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\rhceqlj0ec6p.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\rhceqlj0ec6p.exe.local (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\rhceqlj0ec6p\Uninstall.exe (Rogue.Multiple) -> Quarantined and deleted successfully.
D:\Program Files\MSA\msa0.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
D:\Program Files\MSA\msa1.dat (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
D:\Program Files\MSA\MSA.ooo (Rogue.MSAntivirus) -> Quarantined and deleted successfully.
D:\WINDOWS\svhoster.exe (Trojan.Agent) -> Quarantined and deleted successfully.
D:\WINDOWS\system32\1054j.exe (Backdoor.Bot) -> Delete on reboot.
D:\WINDOWS\system32\autodis.dll (Spyware.BZub) -> Delete on reboot.
D:\WINDOWS\system32\pphcaqlj0ec6p.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\Antivirus XP 2008.lnk (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\config.cfg (Malware.Trace) -> Quarantined and deleted successfully.
D:\Documents and Settings\Default\Application Data\~tmp.html (Malware.Trace) -> Quarantined and deleted successfully.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ComboFix 08-09-01.03 - Default 2008-09-03 5:05:45.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.642 [GMT -4:00]
Running from: D:\Documents and Settings\Default\Desktop\ComboFix.exe
[color=red]
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/color]
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
D:\Program Files\PCHealthCenter
D:\WINDOWS\system32\ativvax.dll
.
---- Previous Run -------
.
D:\Program Files\PCHealthCenter
D:\Program Files\PCHealthCenter\Ù‹exe
D:\Program Files\PCHealthCenter\
0.exe
D:\Program Files\PCHealthCenter\
0.gif
D:\Program Files\PCHealthCenter\1.exe
D:\Program Files\PCHealthCenter\1.gif
D:\Program Files\PCHealthCenter\1.ico
D:\Program Files\PCHealthCenter\2.exe
D:\Program Files\PCHealthCenter\2.gif
D:\Program Files\PCHealthCenter\2.ico
D:\Program Files\PCHealthCenter\3.exe
D:\Program Files\PCHealthCenter\3.gif
D:\Program Files\PCHealthCenter\4.exe
D:\Program Files\PCHealthCenter\5.exe
D:\Program Files\PCHealthCenter\7.exe
D:\Program Files\PCHealthCenter\xe
D:\WINDOWS\system32\ati2dvag(3.dll
D:\WINDOWS\system32\blphcaqlj0ec6p.scr
D:\WINDOWS\system32\lphcaqlj0ec6p.exe
D:\WINDOWS\system32\phcaqlj0ec6p.bmp
.
((((((((((((((((((((((((( Files Created from 2008-08-03 to 2008-09-03 )))))))))))))))))))))))))))))))
.
2008-09-03 05:12 . 2008-09-03 05:12
d-------- D:\Program Files\PCHealthCenter
2008-09-03 05:12 . 2008-09-03 05:12 625,208 --a------ D:\WINDOWS\system32\phcaqlj0ec6p.bmp
2008-09-03 05:12 . 2008-09-03 05:12 203,776 --a------ D:\WINDOWS\system32\lphcaqlj0ec6p.exe
2008-09-03 05:12 . 2008-09-03 05:12 118,784 --a------ D:\WINDOWS\system32\blphcaqlj0ec6p.scr
2008-09-03 05:12 . 2008-09-03 05:12 81,920 --a------ D:\WINDOWS\system32\zovqtqly.exe
2008-09-03 05:02 . 2008-09-03 05:02 81,920 --a------ D:\WINDOWS\system32\wpwlafup.exe
2008-09-03 04:50 . 2008-09-03 04:50 81,920 --a------ D:\WINDOWS\system32\fejsxgpk.exe
2008-09-02 12:15 . 2008-09-02 12:15 203,776 --a------ D:\WINDOWS\system32\xcpmpubi.exe
2008-09-02 12:15 . 2008-09-02 12:15 98,304 --a------ D:\WINDOWS\system32\tulkfmfw.exe
2008-09-02 11:43 . 2008-09-02 11:43 98,304 --a------ D:\WINDOWS\system32\ngxilahw.exe
2008-09-02 11:26 . 2008-09-02 11:26 98,304 --a------ D:\WINDOWS\system32\utevadir.exe
2008-09-02 08:59 . 2008-09-02 08:59 d-------- D:\Program Files\CCleaner
2008-09-02 08:54 . 2008-09-02 08:54 d-------- D:\Program Files\SUPERAntiSpyware
2008-09-02 08:54 . 2008-09-02 08:54 d-------- D:\Program Files\Common Files\Wise Installation Wizard
2008-09-02 08:54 . 2008-09-02 08:54 d-------- D:\Documents and Settings\Default\Application Data\SUPERAntiSpyware.com
2008-09-02 08:54 . 2008-09-02 08:54 d-------- D:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-02 08:41 . 2008-09-02 23:13 d-------- D:\Program Files\Malwarebytes' Anti-Malware
2008-09-02 08:41 . 2008-09-02 00:16 38,528 --a------ D:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-02 08:41 . 2008-09-02 00:16 17,200 --a------ D:\WINDOWS\system32\drivers\mbam.sys
2008-09-02 08:35 . 2008-09-03 05:12 d-------- D:\Program Files\MSA
2008-09-01 20:02 . 2008-09-01 20:02 203,776 --a------ D:\WINDOWS\system32\bwbyxszu.exe
2008-08-22 12:19 . 2008-08-22 12:18 40,960 -r-hs---- D:\WINDOWS\system32\6to4svcl.exe
2008-08-22 12:19 . 2008-08-22 12:20 144 --ahs---- D:\WINDOWS\system32\1884727700.dat
2008-08-18 20:12 . 2008-08-18 20:12 d-------- D:\Program Files\Sun
2008-08-18 18:23 . 2008-08-18 20:26 d-------- D:\WINDOWS\system32\CatRoot_bak
2008-08-14 12:51 . 2008-08-14 12:51 53,248 --a------ D:\WINDOWS\vobwpobw.exe
2008-08-04 15:49 . 2008-08-04 15:49 d-------- D:\Documents and Settings\Default\Application Data\Malwarebytes
2008-08-04 15:49 . 2008-08-04 15:49 d-------- D:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-04 14:37 . 2008-08-04 14:37 d-------- D:\Program Files\brwireg
2008-08-04 14:37 . 2008-08-04 14:37 d-------- D:\Documents and Settings\All Users\Application Data\fsxadsbu
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-27 18:54 --------- d-----w D:\Program Files\XoftSpySE
2008-08-23 17:45 --------- d-----w D:\Program Files\MySpace
2008-08-23 17:43 --------- d-----w D:\Program Files\Lavasoft
2008-08-22 16:51 --------- d-----w D:\Program Files\Common Files\Symantec Shared
2008-08-19 14:25 --------- d-----w D:\Program Files\Microsoft Silverlight
2008-08-19 00:11 --------- d-----w D:\Program Files\Java
2008-07-29 02:48 --------- d--h--w D:\Program Files\InstallShield Installation Information
2008-07-29 02:48 --------- d-----w D:\Program Files\Logitech
2008-07-29 02:48 --------- d-----w D:\Program Files\Common Files\Logitech
2008-07-22 17:57 --------- d-----w D:\Program Files\RegCure
2008-07-22 16:14 --------- d-----w D:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-22 15:13 --------- d-----w D:\Program Files\Norton AntiVirus
2008-07-22 02:27 --------- d-----w D:\Program Files\Diablo II
2008-07-22 01:22 --------- d-----w D:\Program Files\PlayOnline
2008-07-21 23:05 --------- d-----w D:\Program Files\each logo type
2008-07-21 23:05 --------- d-----w D:\Documents and Settings\Default\Application Data\each logo type
2008-07-21 23:05 --------- d-----w D:\Documents and Settings\All Users\Application Data\bat glue time dash
2008-07-21 21:52 --------- d-----w D:\Program Files\LimeWire
2008-07-05 16:04 --------- d-----w D:\Documents and Settings\Default\Application Data\CyberLink
2008-07-05 16:03 --------- d-----w D:\Documents and Settings\All Users\Application Data\CyberLink
2008-07-05 15:52 --------- d-----w D:\Program Files\CyberLink
.
------- Sigcheck -------
2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 D:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2007-10-30 12:53 360832 64798ecfa43d78c7178375fcdd16d8c8 D:\WINDOWS\$hf_mig$\KB941644\SP2QFE\tcpip.sys
2008-06-20 06:44 360960 744e57c99232201ae98c49168b918f48 D:\WINDOWS\$hf_mig$\KB951748\SP2QFE\tcpip.sys
2008-06-20 07:51 361600 9aefa14bd6b182d61e3119fa5f436d3d D:\WINDOWS\$hf_mig$\KB951748\SP3GDR\tcpip.sys
2008-06-20 07:59 361600 ad978a1b783b5719720cff204b666c8e D:\WINDOWS\$hf_mig$\KB951748\SP3QFE\tcpip.sys
2008-04-13 15:20 361344 93ea8d04ec73a85db02eb8805988f733 D:\WINDOWS\SoftwareDistribution\Download\dd9ab5193501484cf5e6884fa1d22f9e\tcpip.sys
2008-06-20 06:45 360320 1cc09561e21a48a7f649a40f18235860 D:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 06:45 360320 1cc09561e21a48a7f649a40f18235860 D:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-09-02_11.55.30.90 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-12-31 12:00:00 91,648 ----a-w D:\WINDOWS\system32\certcl.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94250E81-34BF-4A61-B913-8E8FDEBEF855}]
2002-12-31 08:00 91648 --a------ D:\WINDOWS\system32\certcl.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"~YÕA~"="Ù‹exe" [X]
"@"="xe" [X]
"ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2002-12-31 15360]
"MonSetAdm"="D:\WINDOWS\system32\fejsxgpk.exe" [2008-09-03 81920]
"smartchk"="D:\WINDOWS\system32\wpwlafup.exe" [2008-09-03 81920]
"hlpstr"="D:\WINDOWS\system32\zovqtqly.exe" [2008-09-03 81920]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"~YÕA~"="Ù‹exe" [X]
"@"="xe" [X]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"QuickTime Task"="D:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" [2008-05-27 413696]
"osCheck"="D:\Program Files\Norton AntiVirus\osCheck.exe" [2007-02-07 771704]
"ccApp"="D:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 115816]
"RemoteControl"="D:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="D:\Program Files\CyberLink\PowerDVD\Language\Language.exe" [2007-02-07 54832]
"UpdatePPShortCut"="D:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2007-08-16 218408]
"hlpchkutil"="D:\WINDOWS\vobwpobw.exe" [2008-08-14 53248]
"lphcaqlj0ec6p"="D:\WINDOWS\system32\lphcaqlj0ec6p.exe" [2008-09-03 203776]
"C-Media Mixer"="Mixer.exe" [2001-11-15 D:\WINDOWS\mixer.exe]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\Currentversion\policies\explorer\Run]
"QcsL60w10k"="D:\Documents and Settings\All Users\Application Data\fsxadsbu\tgzudydo.exe" [2008-08-04 61440]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispBackgroundPage"= 1 (0x1)
"NoDispScrSavPage"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "D:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"procchkact"= {5A8DF54F-3C3A-F718-BF1B-008624137EAF} - D:\Program Files\brwireg\procchkact.dll [2008-08-04 110592]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.l3acm"= l3codecp.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ComAplApp
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphcaqlj0ec6p
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SMrhceqlj0ec6p
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2002-12-31 08:00 15360 D:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Lexmark X1100 Series]
--a------ 2003-08-19 06:43 57344 D:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
--a------ 2007-04-19 13:26 484904 D:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2007-03-01 15:57 153136 D:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Time Dash Second Regs]
--a------ 2008-09-02 23:01 5051904 D:\Documents and Settings\All Users\Application Data\bat glue time dash\bags bend.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2006-11-30 22:49 4662776 D:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\zBrowser Launcher]
--a------ 2003-12-01 11:38 892928 D:\Program Files\Logitech\iTouch\iTouch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AtiPTA]
--a------ 2006-02-21 21:05 344064 D:\WINDOWS\system32\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"D:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"D:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"D:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"D:\\Program Files\\LimeWire\\LimeWire.exe"=
"D:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"D:\\Program Files\\Yahoo!\\UPnP\\yupnpsrv.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"D:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"D:\\Program Files\\Messenger\\msmsgs.exe"=
"D:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"D:\\Program Files\\CyberLink\\PowerDirector\\PDR.exe"=
"D:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724
R0 si3112r;Silicon Image SiI 3112 SATARaid Controller;D:\WINDOWS\system32\drivers\si3112r.sys [2003-05-09 89749]
R0 SiWinAcc;SiWinAcc;D:\WINDOWS\system32\drivers\SiWinAcc.sys [2003-02-12 9600]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B};D:\Program Files\CyberLink\PowerDVD\000.fcl [2006-11-02 16:51 13560]
S0 uckkagnh;uckkagnh;D:\WINDOWS\system32\drivers\lztqajog.dat [ ]
S3 LCcfltr;Logitech USB Filter Driver;D:\WINDOWS\system32\Drivers\LCcFltr.Sys [2003-11-07 14092]
S3 XDva020;XDva020;D:\WINDOWS\system32\XDva020.sys [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"D:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
SharedTaskScheduler-IPC Configuration Utility - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - D:\Documents and Settings\Default\Application Data\Mozilla\Firefox\Profiles\bravk493.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - D:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - D:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin2.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin3.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin4.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\QuickTime\Plugins\npqtplugin5.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF -: plugin - D:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF -: plugin - D:\Program Files\Yahoo!\Shared\npYState.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, https://www.gmer.net
Rootkit scan 2008-09-03 05:12:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
D:\WINDOWS\system32\blphcaqlj0ec6p.scr 118784 bytes executable
scan completed successfully
hidden files: 1
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\uckkagnh]
"ImagePath"="system32\drivers\lztqajog.dat"
[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\D:\Program Files\CyberLink\PowerDVD\000.fcl"
.
------------------------ Other Running Processes ------------------------
.
D:\WINDOWS\system32\ati2evxx.exe
D:\WINDOWS\system32\ati2evxx.exe
D:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
D:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
D:\WINDOWS\system32\LEXBCES.EXE
D:\WINDOWS\system32\LEXPPS.EXE
D:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
D:\Program Files\Common Files\LightScribe\LSSrvc.exe
D:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\Program Files\CyberLink\Shared Files\RichVideo.exe
D:\Program Files\PCHealthCenter\0.exe
D:\Program Files\PCHealthCenter\1.exe
D:\Program Files\PCHealthCenter\2.exe
D:\Program Files\PCHealthCenter\3.exe
D:\Program Files\PCHealthCenter\4.exe
D:\Program Files\PCHealthCenter\7.exe
D:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
D:\WINDOWS\system32\taskmgr.exe
D:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
.
**************************************************************************
.
Completion time: 2008-09-03 5:22:10 - machine was rebooted [Default]
ComboFix-quarantined-files.txt 2008-09-03 09:22:04
ComboFix2.txt 2008-09-02 15:56:01
Pre-Run: 122,723,901,440 bytes free
Post-Run: 122,709,278,720 bytes free
265 --- E O F --- 2008-08-19 14:25:12