# Flash drive folders turned to .EXE files?



## ww2b

My computer got this virus (link is to an image of the pop-up - http://fongthai.files.wordpress.com/2008/05/i-got-hacked.png) a few days ago, so I reformatted my computer. I backed up all of my files (MP3s, Word documents, and JPG pictures) on a 8GB flash drive. Now, all of the files by themselves work fine, but the folders on my flash drive have turned into .EXE files that I can't open.

Thanks in advance for your help.

--


DDS (Ver_09-03-16.01) - NTFSx86 
Run by Zhu Zhu at 15:43:21.79 on Thu 04/16/2009
Internet Explorer: 7.0.5730.13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.247.59 [GMT -4:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\igfxtray.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Zhu Zhu\Desktop\dds.scr

============== Pseudo HJT Report ===============

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1239835767250
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxsrvc.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\zhuzhu~1\applic~1\mozilla\firefox\profiles\7nrz9zi1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-15 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-4-15 27656]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-15 108552]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-4-15 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-15 298264]

=============== Created Last 30 ================

2009-04-16 15:31	<DIR>	--d-h---	c:\windows\PIF
2009-04-16 15:09	<DIR>	--d-----	c:\windows\system32\NtmsData
2009-04-16 06:42	<DIR>	--d-----	c:\documents and settings\Zhu Zhu
2009-04-15 22:55	<DIR>	--d-h---	C:\$AVG8.VAULT$
2009-04-15 22:50	107,368	a-------	c:\windows\system32\GEARAspi.dll
2009-04-15 22:50	23,400	a-------	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-15 22:50	<DIR>	--d-----	c:\program files\iPod
2009-04-15 22:50	<DIR>	--d-----	c:\program files\iTunes
2009-04-15 22:50	<DIR>	--d-----	c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-15 22:50	<DIR>	--d-----	c:\program files\Bonjour
2009-04-15 22:48	26,368	ac------	c:\windows\system32\dllcache\usbstor.sys
2009-04-15 22:45	9,200	--------	c:\windows\system32\drivers\cdralw2k.sys
2009-04-15 22:45	9,072	--------	c:\windows\system32\drivers\cdr4_xp.sys
2009-04-15 22:44	<DIR>	--d-----	c:\windows\system32\IOSUBSYS
2009-04-15 20:10	376	a-------	c:\windows\ODBC.INI
2009-04-15 20:09	<DIR>	--d-----	c:\program files\Microsoft ActiveSync
2009-04-15 20:08	<DIR>	--d-----	c:\windows\ShellNew
2009-04-15 19:57	10,520	a-------	c:\windows\system32\avgrsstx.dll
2009-04-15 19:57	325,640	a-------	c:\windows\system32\drivers\avgldx86.sys
2009-04-15 19:57	108,552	a-------	c:\windows\system32\drivers\avgtdix.sys
2009-04-15 19:57	<DIR>	--d-----	c:\windows\system32\drivers\Avg
2009-04-15 19:57	<DIR>	--d-----	c:\program files\AVG
2009-04-15 19:57	<DIR>	--d-----	c:\docume~1\alluse~1\applic~1\avg8
2009-04-15 19:34	272,128	-c------	c:\windows\system32\dllcache\bthport.sys
2009-04-15 19:32	203,136	-c------	c:\windows\system32\dllcache\rmcast.sys
2009-04-15 19:32	455,296	-c------	c:\windows\system32\dllcache\mrxsmb.sys
2009-04-15 19:32	333,952	-c------	c:\windows\system32\dllcache\srv.sys
2009-04-15 19:32	331,776	-c------	c:\windows\system32\dllcache\msadce.dll
2009-04-15 19:32	691,712	-c------	c:\windows\system32\dllcache\inetcomm.dll
2009-04-15 19:32	337,408	-c------	c:\windows\system32\dllcache\netapi32.dll
2009-04-15 19:32	1,106,944	-c------	c:\windows\system32\dllcache\msxml3.dll
2009-04-15 19:29	1,203,922	-c------	c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 19:29	2,560	--------	c:\windows\system32\xpsp4res.dll
2009-04-15 19:29	215,552	-c------	c:\windows\system32\dllcache\wordpad.exe
2009-04-15 19:21	<DIR>	--d-----	c:\windows\system32\scripting
2009-04-15 19:21	<DIR>	--d-----	c:\windows\system32\en
2009-04-15 19:21	<DIR>	--d-----	c:\windows\l2schemas
2009-04-15 19:21	<DIR>	--d-----	c:\windows\system32\bits
2009-04-15 19:19	<DIR>	--d-----	c:\windows\ServicePackFiles
2009-04-15 19:17	<DIR>	--d-----	c:\windows\network diagnostic
2009-04-15 19:07	97,117	-c------	c:\windows\system32\dllcache\mplayer2.hlp
2009-04-15 19:06	701,440	--------	c:\windows\system32\drivers\ati2mtag.sys
2009-04-15 18:52	138,496	-c------	c:\windows\system32\dllcache\afd.sys
2009-04-15 18:51	26,488	a-------	c:\windows\system32\spupdsvc.exe
2009-04-15 18:51	<DIR>	--d-----	c:\windows\system32\PreInstall
2009-04-15 18:51	<DIR>	--d-h---	c:\windows\$hf_mig$
2009-04-15 18:49	31,768	a-------	c:\windows\system32\wucltui.dll.mui
2009-04-15 18:49	23,576	a-------	c:\windows\system32\wuaucpl.cpl.mui
2009-04-15 18:49	23,576	a-------	c:\windows\system32\wuapi.dll.mui
2009-04-15 18:49	18,456	a-------	c:\windows\system32\wuaueng.dll.mui
2009-04-15 18:49	<DIR>	--d-----	c:\windows\system32\SoftwareDistribution
2009-04-15 18:37	151,552	a----r--	c:\windows\system32\igfxres.dll
2009-04-15 18:34	168,925	a----r--	c:\windows\system32\ialmdev5.dll
2009-04-15 18:34	77,373	a----r--	c:\windows\system32\drivers\ialmnt5.sys
2009-04-15 18:34	74,814	a----r--	c:\windows\system32\ialmdnt5.dll
2009-04-15 18:34	29,184	a----r--	c:\windows\system32\ialmrnt5.dll
2009-04-15 18:31	6,272	a-------	c:\windows\system32\drivers\splitter.sys
2009-04-15 18:31	83,072	a-------	c:\windows\system32\drivers\wdmaud.sys
2009-04-15 18:31	52,864	a-------	c:\windows\system32\drivers\dmusic.sys
2009-04-15 18:31	56,576	a-------	c:\windows\system32\drivers\swmidi.sys
2009-04-15 17:29	3,366,912	a-------	c:\windows\system32\GPhotos.scr
2009-04-14 22:15	<DIR>	--ds----	c:\windows\system32\Microsoft
2009-04-14 22:15	8,192	a-------	c:\windows\REGLOCS.OLD
2009-04-14 22:08	10,096,640	ac------	c:\windows\system32\dllcache\hwxcht.dll
2009-04-14 22:07	49,664	ac------	c:\windows\system32\dllcache\adrot.dll
2009-04-14 22:06	23,392	a-------	c:\windows\system32\nscompat.tlb
2009-04-14 22:06	16,832	a-------	c:\windows\system32\amcompat.tlb
2009-04-14 22:06	316,640	a-------	c:\windows\WMSysPr9.prx
2009-04-14 22:05	<DIR>	--dsh---	c:\documents and settings\all users\DRM
2009-04-14 22:05	488	a---hr--	c:\windows\system32\WindowsLogon.manifest
2009-04-14 22:05	488	a---hr--	c:\windows\system32\logonui.exe.manifest
2009-04-14 22:05	<DIR>	--ds----	c:\windows\Downloaded Program Files
2009-04-14 22:05	<DIR>	--d--r--	c:\windows\Offline Web Pages
2009-04-14 22:05	749	a---hr--	c:\windows\WindowsShell.Manifest
2009-04-14 22:05	749	a---hr--	c:\windows\system32\wuaucpl.cpl.manifest
2009-04-14 22:05	749	a---hr--	c:\windows\system32\sapi.cpl.manifest
2009-04-14 22:05	749	a---hr--	c:\windows\system32\nwc.cpl.manifest
2009-04-14 22:05	749	a---hr--	c:\windows\system32\ncpa.cpl.manifest
2009-04-14 22:05	749	a---hr--	c:\windows\system32\cdplayer.exe.manifest
2009-04-14 22:05	<DIR>	--d-h---	c:\program files\WindowsUpdate
2009-04-14 22:04	4,399,505	ac------	c:\windows\system32\dllcache\nls302en.lex
2009-04-14 22:04	<DIR>	--d-----	c:\windows\system32\DirectX
2009-04-14 22:03	<DIR>	--d-----	c:\program files\common files\MSSoap
2009-04-14 21:59	<DIR>	--d-----	c:\program files\Online Services
2009-04-14 21:59	<DIR>	--d-----	c:\program files\Messenger
2009-04-14 21:59	<DIR>	--d-----	c:\program files\MSN Gaming Zone
2009-04-14 21:58	<DIR>	--d-----	c:\program files\Windows NT
2009-04-14 17:48	<DIR>	--d-----	c:\program files\common files\ODBC
2009-04-14 17:48	<DIR>	--d-----	c:\program files\common files\SpeechEngines
2009-04-14 17:46	<DIR>	--d--r--	c:\documents and settings\all users\Documents

==================== Find3M ====================

2009-04-16 15:31	2,855	a-------	c:\windows\pif\Contacts.PIF
2009-04-15 19:24	86,327	a-------	c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-04-14 22:00	21,640	a-------	c:\windows\system32\emptyregdb.dat
2009-03-06 10:22	284,160	a-------	c:\windows\system32\pdh.dll
2009-03-02 20:18	826,368	a-------	c:\windows\system32\wininet.dll
2009-02-20 14:09	78,336	a-------	c:\windows\system32\ieencode.dll
2009-02-09 08:10	729,088	a-------	c:\windows\system32\lsasrv.dll
2009-02-09 08:10	714,752	a-------	c:\windows\system32\ntdll.dll
2009-02-09 08:10	617,472	a-------	c:\windows\system32\advapi32.dll
2009-02-09 08:10	401,408	a-------	c:\windows\system32\rpcss.dll
2009-02-09 07:13	1,846,784	a-------	c:\windows\system32\win32k.sys
2009-02-07 19:02	2,066,048	a-------	c:\windows\system32\ntkrnlpa.exe
2009-02-06 07:11	110,592	a-------	c:\windows\system32\services.exe
2009-02-06 07:08	2,189,056	a-------	c:\windows\system32\ntoskrnl.exe
2009-02-06 06:39	35,328	a-------	c:\windows\system32\sc.exe
2009-02-03 15:59	56,832	a-------	c:\windows\system32\secur32.dll

============= FINISH: 15:44:16.57 ===============


----------



## Ried

Hello ww2b,

*1.* Download *Flash_Disinfector.exe* and save it to your desktop.


*2.* Download *Combofix* from any of the links below, and save it to your desktop. 

*Link 1* 
*Link 2* 
*Link 3* 


**Note: It is important that it is saved directly to your desktop** 

=====================================

Disable your AntiVirus and AntiSpyware applications as they may otherwise interfere with our tools

=====================================

Double-click *Flash_Disinfector.exe* to run it and follow any prompts that may appear.
 The utility may ask you to *insert your flash drive and/or other removable drives *including your mobile phone. Please do so and allow the utility to clean up those drives as well.
 Wait until it has finished scanning and then exit the program.
 Reboot your computer when done.

=====================================

*Keep the flash drive inserted.....*


Double click on *combofix.exe *& follow the prompts.

As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. 


Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.










Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:












Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the *C:\ComboFix.txt* in your next reply along with an update on status of flash drive folders.


----------



## ww2b

I ran Flash Disinfector and my files were restored. However, on running ComboFix they reverted back to .EXE files. I then ran Flash Disinfector again and my files are working normally now.

Thank you very much!

--

ComboFix 09-04-18.01 - Zhu Zhu 04/17/2009 17:56.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.247.93 [GMT -4:00]
Running from: c:\documents and settings\Zhu Zhu\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ZHUZHU~1\LOCALS~1\Temp\lorer.exe
C:\MS-DOS.com
c:\windows\Cursors\Boom.vbs
c:\windows\Fonts\fonts.exe
c:\windows\Fonts\tskmgr.exe
c:\windows\Fonts\wav.wav
c:\windows\Help\Microsoft.hlp
c:\windows\Media\rndll32.pif
c:\windows\pchealth\Global.exe
c:\windows\pchealth\helpctr\binaries\HelpHost.com
c:\windows\system\KEYBOARD.exe
c:\windows\system32\dllcache\autorun.inf
c:\windows\system32\dllcache\Default.exe
c:\windows\system32\dllcache\Global.exe
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\Global.exe
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\svchost.exe
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
c:\windows\system32\dllcache\rndll32.exe
c:\windows\system32\dllcache\tskmgr.exe
c:\windows\system32\drivers\drivers.cab.exe
c:\windows\system32\regedit.exe

.
((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 )))))))))))))))))))))))))))))))
.

2009-04-17 21:55 . 2009-04-16 19:16	225280	-csha-r	c:\windows\system32\dllcache\svchost.exe
2009-04-17 21:55 . 2008-04-14 00:12	1033728	-c--a-w	c:\windows\system32\dllcache\explorer.exe
2009-04-17 21:33 . 2009-04-17 21:33	--------	d-----w	C:\autorun.inf
2009-04-17 19:37 . 2009-04-17 19:37	--------	d-----w	c:\documents and settings\Zhu Zhu\Application Data\Apple Computer
2009-04-16 19:31 . 2009-04-16 19:31	--------	d--h--w	c:\windows\PIF
2009-04-16 19:10 . 2009-04-16 19:10	--------	d-----w	c:\documents and settings\Zhu Zhu\Local Settings\Application Data\Mozilla
2009-04-16 19:09 . 2009-04-16 19:10	--------	d-----w	c:\windows\system32\NtmsData
2009-04-16 10:43 . 2009-04-17 19:37	--------	d-----w	c:\documents and settings\Zhu Zhu\Local Settings\Application Data\Apple Computer
2009-04-16 02:55 . 2009-04-16 19:29	--------	d--h--w	C:\$AVG8.VAULT$
2009-04-16 02:51 . 2009-04-16 02:51	--------	d-----w	c:\documents and settings\Administrator\Application Data\Apple Computer
2009-04-16 02:50 . 2009-03-19 20:32	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-16 02:50 . 2008-04-17 16:12	107368	----a-w	c:\windows\system32\GEARAspi.dll
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-16 02:49 . 2009-04-16 02:50	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-16 02:48 . 2009-04-16 02:48	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2009-04-16 02:48 . 2009-04-16 02:50	--------	dc----w	c:\windows\system32\DRVSTORE
2009-04-16 02:48 . 2008-04-13 18:45	26368	-c--a-w	c:\windows\system32\dllcache\usbstor.sys
2009-04-16 02:47 . 2009-04-16 02:47	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple
2009-04-16 02:47 . 2009-04-16 02:51	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-04-16 02:45 . 2008-11-20 19:19	9200	------w	c:\windows\system32\drivers\cdralw2k.sys
2009-04-16 02:45 . 2008-11-20 19:19	9072	------w	c:\windows\system32\drivers\cdr4_xp.sys
2009-04-16 02:45 . 2009-04-16 03:25	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-04-16 02:44 . 2009-04-16 02:44	--------	d-----w	c:\windows\system32\IOSUBSYS
2009-04-16 02:28 . 2009-04-16 02:28	0	----a-w	c:\windows\nsreg.dat
2009-04-16 02:28 . 2009-04-16 02:28	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-16 00:10 . 2009-04-17 01:09	376	----a-w	c:\windows\ODBC.INI
2009-04-16 00:08 . 2009-04-16 00:09	--------	d-----w	c:\windows\ShellNew
2009-04-15 23:57 . 2009-04-15 23:57	10520	----a-w	c:\windows\system32\avgrsstx.dll
2009-04-15 23:57 . 2009-04-17 21:30	--------	d-----w	c:\windows\system32\drivers\Avg
2009-04-15 23:57 . 2009-04-15 23:57	325640	----a-w	c:\windows\system32\drivers\avgldx86.sys
2009-04-15 23:57 . 2009-04-15 23:57	108552	----a-w	c:\windows\system32\drivers\avgtdix.sys
2009-04-15 23:57 . 2009-04-15 23:57	--------	d-----w	c:\documents and settings\All Users\Application Data\avg8
2009-04-15 23:41 . 2009-02-20 18:09	52224	-c----w	c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-15 23:41 . 2009-02-20 18:09	459264	-c----w	c:\windows\system32\dllcache\msfeeds.dll
2009-04-15 23:41 . 2009-02-20 18:09	268288	-c----w	c:\windows\system32\dllcache\iertutil.dll
2009-04-15 23:41 . 2009-02-20 18:09	63488	-c----w	c:\windows\system32\dllcache\icardie.dll
2009-04-15 23:41 . 2009-02-20 18:09	6066176	-c----w	c:\windows\system32\dllcache\ieframe.dll
2009-04-15 23:41 . 2009-02-20 18:09	383488	-c----w	c:\windows\system32\dllcache\ieapfltr.dll
2009-04-15 23:41 . 2009-02-20 10:20	13824	-c----w	c:\windows\system32\dllcache\ieudinit.exe
2009-04-15 23:41 . 2008-07-09 14:30	991232	-c----w	c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-15 23:41 . 2008-07-09 14:25	2455488	-c----w	c:\windows\system32\dllcache\ieapfltr.dat
2009-04-15 23:34 . 2008-06-13 11:05	272128	-c----w	c:\windows\system32\dllcache\bthport.sys
2009-04-15 23:33 . 2009-03-06 14:22	284160	-c----w	c:\windows\system32\dllcache\pdh.dll
2009-04-15 23:33 . 2009-02-09 12:10	401408	-c----w	c:\windows\system32\dllcache\rpcss.dll
2009-04-15 23:33 . 2009-02-06 11:11	110592	-c----w	c:\windows\system32\dllcache\services.exe
2009-04-15 23:33 . 2009-02-09 12:10	729088	-c----w	c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 23:33 . 2009-02-09 12:10	714752	-c----w	c:\windows\system32\dllcache\ntdll.dll
2009-04-15 23:33 . 2009-02-09 12:10	617472	-c----w	c:\windows\system32\dllcache\advapi32.dll
2009-04-15 23:33 . 2009-02-09 12:10	473600	-c----w	c:\windows\system32\dllcache\fastprox.dll
2009-04-15 23:33 . 2009-02-09 12:10	453120	-c----w	c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 23:33 . 2009-02-06 10:10	227840	-c----w	c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 23:33 . 2009-02-06 11:08	2189056	-c----w	c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-15 23:33 . 2009-02-06 11:06	2145280	-c----w	c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-15 23:33 . 2009-02-06 10:32	2023936	-c----w	c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-15 23:32 . 2008-05-08 14:02	203136	-c----w	c:\windows\system32\dllcache\rmcast.sys
2009-04-15 23:32 . 2008-10-24 11:21	455296	-c----w	c:\windows\system32\dllcache\mrxsmb.sys
2009-04-15 23:32 . 2008-12-11 10:57	333952	-c----w	c:\windows\system32\dllcache\srv.sys
2009-04-15 23:32 . 2008-05-01 14:33	331776	-c----w	c:\windows\system32\dllcache\msadce.dll
2009-04-15 23:32 . 2008-04-11 19:04	691712	-c----w	c:\windows\system32\dllcache\inetcomm.dll
2009-04-15 23:32 . 2008-10-15 16:34	337408	-c----w	c:\windows\system32\dllcache\netapi32.dll
2009-04-15 23:32 . 2008-09-04 17:15	1106944	-c----w	c:\windows\system32\dllcache\msxml3.dll
2009-04-15 23:29 . 2009-03-27 06:58	1203922	-c----w	c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 23:29 . 2008-05-03 11:55	2560	------w	c:\windows\system32\xpsp4res.dll
2009-04-15 23:29 . 2008-04-21 12:08	215552	-c----w	c:\windows\system32\dllcache\wordpad.exe
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\scripting
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\l2schemas
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\en
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\bits
2009-04-15 23:19 . 2009-04-15 23:22	--------	d-----w	c:\windows\ServicePackFiles
2009-04-15 23:07 . 2004-08-04 02:41	11868	------w	c:\windows\system32\drivers\mdmxsdk.sys
2009-04-15 23:06 . 2004-08-04 02:29	73216	------w	c:\windows\system32\drivers\atintuxx.sys
2009-04-15 22:52 . 2008-08-14 10:04	138496	-c----w	c:\windows\system32\dllcache\afd.sys
2009-04-15 22:51 . 2008-07-09 07:38	26488	----a-w	c:\windows\system32\spupdsvc.exe
2009-04-15 22:51 . 2009-04-17 15:00	--------	d--h--w	c:\windows\$hf_mig$
2009-04-15 22:49 . 2008-10-16 18:09	43544	----a-w	c:\windows\system32\wups2.dll
2009-04-15 22:49 . 2008-10-16 18:09	31768	----a-w	c:\windows\system32\wucltui.dll.mui
2009-04-15 22:49 . 2008-10-16 18:07	23576	----a-w	c:\windows\system32\wuaucpl.cpl.mui
2009-04-15 22:49 . 2008-10-16 18:07	23576	----a-w	c:\windows\system32\wuapi.dll.mui
2009-04-15 22:49 . 2008-10-16 18:07	18456	----a-w	c:\windows\system32\wuaueng.dll.mui
2009-04-15 22:47 . 2009-04-15 22:47	--------	d-s---w	c:\documents and settings\Administrator\UserData
2009-04-15 22:37 . 2002-04-25 01:19	151552	----a-r	c:\windows\system32\igfxres.dll
2009-04-15 22:34 . 2002-05-06 18:41	29184	----a-r	c:\windows\system32\ialmrnt5.dll
2009-04-15 22:34 . 2002-05-06 18:40	77373	----a-r	c:\windows\system32\drivers\ialmnt5.sys
2009-04-15 22:34 . 2002-05-06 18:40	74814	----a-r	c:\windows\system32\ialmdnt5.dll
2009-04-15 22:34 . 2002-05-06 18:39	168925	----a-r	c:\windows\system32\ialmdev5.dll
2009-04-15 22:31 . 2008-04-13 18:45	6272	----a-w	c:\windows\system32\drivers\splitter.sys
2009-04-15 22:31 . 2008-04-13 19:17	83072	----a-w	c:\windows\system32\drivers\wdmaud.sys
2009-04-15 22:31 . 2008-04-13 18:45	52864	----a-w	c:\windows\system32\drivers\dmusic.sys
2009-04-15 22:31 . 2008-04-13 18:45	56576	----a-w	c:\windows\system32\drivers\swmidi.sys
2009-04-15 21:29 . 2009-04-15 21:29	3366912	----a-w	c:\windows\system32\GPhotos.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-17 21:54 . 2009-04-17 21:54	1095	----a-w	C:\Bug.txt
2009-04-16 19:31 . 2009-04-16 19:31	2855	----a-w	c:\windows\PIF\Contacts.PIF
2009-04-16 03:17 . 2009-04-16 03:08	--------	d-----w	c:\program files\EphPod
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\iTunes
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\iPod
2009-04-16 02:50 . 2009-04-16 02:47	--------	d-----w	c:\program files\Common Files\Apple
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\Bonjour
2009-04-16 02:49 . 2009-04-16 02:49	--------	d-----w	c:\program files\QuickTime
2009-04-16 02:48 . 2009-04-16 02:48	--------	d-----w	c:\program files\Apple Software Update
2009-04-16 02:44 . 2009-04-16 02:44	--------	d-----w	c:\program files\Google
2009-04-16 00:21 . 2009-04-16 00:21	--------	d-----w	c:\program files\Common Files\Adobe AIR
2009-04-16 00:20 . 2009-04-16 00:20	--------	d-----w	c:\program files\Common Files\Adobe
2009-04-16 00:09 . 2009-04-16 00:09	--------	d-----w	c:\program files\Microsoft ActiveSync
2009-04-15 23:57 . 2009-04-15 23:57	--------	d-----w	c:\program files\AVG
2009-04-15 23:24 . 2009-04-15 02:05	86327	----a-w	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-15 23:17 . 2004-08-03 14:59	250048	--sha-r	C:\ntldr
2009-04-15 02:07 . 2009-04-15 02:07	--------	d-----w	c:\program files\microsoft frontpage
2009-04-15 02:00 . 2009-04-15 02:00	21640	----a-w	c:\windows\system32\emptyregdb.dat
2009-03-06 14:22 . 2004-08-03 16:56	284160	----a-w	c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-03 16:56	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-03 16:56	78336	----a-w	c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-03 16:56	729088	----a-w	c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-03 16:56	401408	----a-w	c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2004-08-03 16:56	617472	----a-w	c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-03 16:56	714752	----a-w	c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2004-08-03 15:17	1846784	----a-w	c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2004-08-03 22:59	2066048	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2004-08-03 16:56	110592	----a-w	c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-08-03 15:20	2189056	----a-w	c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2002-09-08 16:00	35328	----a-w	c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-08-03 16:56	56832	----a-w	c:\windows\system32\secur32.dll
.

------- Sigcheck -------

[-] 2008-04-14 00:12	1033728	F3F2AB6095FAB5020A2C3089F287017A	c:\windows\explorer.exe
[7] 2004-08-03 16:56	1032192	A0732187050030AE399B241436565E64	c:\windows\$NtServicePackUninstall$\explorer.exe
[7] 2008-04-14 00:12	1033728	12896823FB95BFB3DC9B46BCAEDC9923	c:\windows\ServicePackFiles\i386\explorer.exe
[7] 2008-04-14 00:12	1033728	12896823FB95BFB3DC9B46BCAEDC9923	c:\windows\SoftwareDistribution\Download\e9500597a78495f397efb821e37bf356\explorer.exe
[-] 2008-04-14 00:12	1033728	F3F2AB6095FAB5020A2C3089F287017A	c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2002-04-25 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2002-04-25 106496]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-15 1932568]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-15 23:57 10520	----a-w	c:\windows\system32\avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-15 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-15 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-15 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-15 298264]

.
- - - - ORPHANS REMOVED - - - -

HKCU-RunOnce-<NO NAME> - c:\windows\system32\dllcache\Default.exe
HKLM-RunOnce-<NO NAME> - c:\windows\system32\dllcache\Default.exe


.
------- Supplementary Scan -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Zhu Zhu\Application Data\Mozilla\Firefox\Profiles\7nrz9zi1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-17 17:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ... 

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-17 17:59
ComboFix-quarantined-files.txt 2009-04-17 21:59

Pre-Run: 33,904,865,280 bytes free
Post-Run: 34,034,507,776 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

232	--- E O F ---	2009-04-17 15:00


----------



## Ried

Good work, ww2b. 

Read through this entire procedure and if you have any questions, please ask them before you begin. Then either print out, or copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions. 


It's IMPORTANT to carry out the instructions in the sequence listed below.


***************************************************

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

---------------------------------------------------------------------

Open *notepad* and copy/paste the text in the code box below into it:



> FCopy::
> c:\windows\$NtServicePackUninstall$\explorer.exe | C:\windows\explorer.exe
> c:\windows\$NtServicePackUninstall$\explorer.exe | c:\windows\system32\dllcache\explorer.exe
> 
> FileLook::
> c:\windows\system32\dllcache\svchost.exe


Save this as *"CFScript.txt"*, and as Type: All Files (*.*)
in the same location as ComboFix.exe












Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt*. Please post that in your next reply.


===========================

Also, navigate to C:\Bug.txt. Right click and select Send to>Compressed (zipped) folder. Kindly attach that in your next reply.


----------



## ww2b

I was unable to find the Bug.txt file. Here is the log, though. Thank you!

--

ComboFix 09-04-18.05 - Zhu Zhu 04/18/2009 9:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.247.47 [GMT -4:00]
Running from: c:\documents and settings\Zhu Zhu\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Zhu Zhu\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\ZHUZHU~1\LOCALS~1\Temp\lorer.exe
C:\MS-DOS.com
c:\windows\Cursors\Boom.vbs
c:\windows\Fonts\fonts.exe
c:\windows\Fonts\tskmgr.exe
c:\windows\Fonts\wav.wav
c:\windows\Help\Microsoft.hlp
c:\windows\Media\rndll32.pif
c:\windows\pchealth\Global.exe
c:\windows\system\KEYBOARD.exe
c:\windows\system32\dllcache\autorun.inf
c:\windows\system32\dllcache\Default.exe
c:\windows\system32\dllcache\Global.exe
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}
c:\windows\system32\dllcache\Recycler.{645FF040-5081-101B-9F08-00AA002F954E}\system.exe
c:\windows\system32\dllcache\rndll32.exe
c:\windows\system32\dllcache\tskmgr.exe
c:\windows\system32\drivers\drivers.cab.exe
c:\windows\system32\regedit.exe

.
--------------- FCopy ---------------

c:\windows\$NtServicePackUninstall$\explorer.exe --> c:\windows\explorer.exe
c:\windows\$NtServicePackUninstall$\explorer.exe --> c:\windows\system32\dllcache\explorer.exe
.
((((((((((((((((((((((((( Files Created from 2009-03-18 to 2009-04-18 )))))))))))))))))))))))))))))))
.

2009-04-17 22:02 . 2009-04-17 22:02	17856	----a-w	c:\documents and settings\Zhu Zhu\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-17 21:55 . 2009-04-16 19:16	225280	-csha-r	c:\windows\system32\dllcache\svchost.exe
2009-04-17 21:55 . 2004-08-03 16:56	1032192	-c--a-w	c:\windows\system32\dllcache\explorer.exe
2009-04-17 21:33 . 2009-04-17 21:33	--------	d-----w	C:\autorun.inf
2009-04-17 19:37 . 2009-04-17 19:37	--------	d-----w	c:\documents and settings\Zhu Zhu\Application Data\Apple Computer
2009-04-16 19:31 . 2009-04-16 19:31	--------	d--h--w	c:\windows\PIF
2009-04-16 19:10 . 2009-04-16 19:10	--------	d-----w	c:\documents and settings\Zhu Zhu\Local Settings\Application Data\Mozilla
2009-04-16 19:09 . 2009-04-16 19:10	--------	d-----w	c:\windows\system32\NtmsData
2009-04-16 10:43 . 2009-04-17 19:37	--------	d-----w	c:\documents and settings\Zhu Zhu\Local Settings\Application Data\Apple Computer
2009-04-16 02:55 . 2009-04-18 13:38	--------	d--h--w	C:\$AVG8.VAULT$
2009-04-16 02:51 . 2009-04-16 02:51	--------	d-----w	c:\documents and settings\Administrator\Application Data\Apple Computer
2009-04-16 02:50 . 2009-03-19 20:32	23400	----a-w	c:\windows\system32\drivers\GEARAspiWDM.sys
2009-04-16 02:50 . 2008-04-17 16:12	107368	----a-w	c:\windows\system32\GEARAspi.dll
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-04-16 02:49 . 2009-04-16 02:50	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple Computer
2009-04-16 02:48 . 2009-04-16 02:48	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Apple
2009-04-16 02:48 . 2009-04-16 02:50	--------	dc----w	c:\windows\system32\DRVSTORE
2009-04-16 02:48 . 2008-04-13 18:45	26368	-c--a-w	c:\windows\system32\dllcache\usbstor.sys
2009-04-16 02:47 . 2009-04-16 02:47	--------	d-----w	c:\documents and settings\All Users\Application Data\Apple
2009-04-16 02:47 . 2009-04-16 02:51	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Apple Computer
2009-04-16 02:45 . 2008-11-20 19:19	9200	------w	c:\windows\system32\drivers\cdralw2k.sys
2009-04-16 02:45 . 2008-11-20 19:19	9072	------w	c:\windows\system32\drivers\cdr4_xp.sys
2009-04-16 02:45 . 2009-04-16 03:25	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Google
2009-04-16 02:44 . 2009-04-16 02:44	--------	d-----w	c:\windows\system32\IOSUBSYS
2009-04-16 02:28 . 2009-04-16 02:28	0	----a-w	c:\windows\nsreg.dat
2009-04-16 02:28 . 2009-04-16 02:28	--------	d-----w	c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2009-04-16 00:10 . 2009-04-17 01:09	376	----a-w	c:\windows\ODBC.INI
2009-04-16 00:08 . 2009-04-16 00:09	--------	d-----w	c:\windows\ShellNew
2009-04-15 23:57 . 2009-04-15 23:57	10520	----a-w	c:\windows\system32\avgrsstx.dll
2009-04-15 23:57 . 2009-04-18 13:26	--------	d-----w	c:\windows\system32\drivers\Avg
2009-04-15 23:57 . 2009-04-15 23:57	325640	----a-w	c:\windows\system32\drivers\avgldx86.sys
2009-04-15 23:57 . 2009-04-15 23:57	108552	----a-w	c:\windows\system32\drivers\avgtdix.sys
2009-04-15 23:57 . 2009-04-15 23:57	--------	d-----w	c:\documents and settings\All Users\Application Data\avg8
2009-04-15 23:41 . 2009-02-20 18:09	52224	-c----w	c:\windows\system32\dllcache\msfeedsbs.dll
2009-04-15 23:41 . 2009-02-20 18:09	459264	-c----w	c:\windows\system32\dllcache\msfeeds.dll
2009-04-15 23:41 . 2009-02-20 18:09	268288	-c----w	c:\windows\system32\dllcache\iertutil.dll
2009-04-15 23:41 . 2009-02-20 18:09	63488	-c----w	c:\windows\system32\dllcache\icardie.dll
2009-04-15 23:41 . 2009-02-20 18:09	6066176	-c----w	c:\windows\system32\dllcache\ieframe.dll
2009-04-15 23:41 . 2009-02-20 18:09	383488	-c----w	c:\windows\system32\dllcache\ieapfltr.dll
2009-04-15 23:41 . 2009-02-20 10:20	13824	-c----w	c:\windows\system32\dllcache\ieudinit.exe
2009-04-15 23:41 . 2008-07-09 14:30	991232	-c----w	c:\windows\system32\dllcache\ieframe.dll.mui
2009-04-15 23:41 . 2008-07-09 14:25	2455488	-c----w	c:\windows\system32\dllcache\ieapfltr.dat
2009-04-15 23:34 . 2008-06-13 11:05	272128	-c----w	c:\windows\system32\dllcache\bthport.sys
2009-04-15 23:33 . 2009-03-06 14:22	284160	-c----w	c:\windows\system32\dllcache\pdh.dll
2009-04-15 23:33 . 2009-02-09 12:10	401408	-c----w	c:\windows\system32\dllcache\rpcss.dll
2009-04-15 23:33 . 2009-02-06 11:11	110592	-c----w	c:\windows\system32\dllcache\services.exe
2009-04-15 23:33 . 2009-02-09 12:10	729088	-c----w	c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 23:33 . 2009-02-09 12:10	714752	-c----w	c:\windows\system32\dllcache\ntdll.dll
2009-04-15 23:33 . 2009-02-09 12:10	617472	-c----w	c:\windows\system32\dllcache\advapi32.dll
2009-04-15 23:33 . 2009-02-09 12:10	473600	-c----w	c:\windows\system32\dllcache\fastprox.dll
2009-04-15 23:33 . 2009-02-09 12:10	453120	-c----w	c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 23:33 . 2009-02-06 10:10	227840	-c----w	c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 23:33 . 2009-02-06 11:08	2189056	-c----w	c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-15 23:33 . 2009-02-06 11:06	2145280	-c----w	c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-15 23:33 . 2009-02-06 10:32	2023936	-c----w	c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-15 23:32 . 2008-05-08 14:02	203136	-c----w	c:\windows\system32\dllcache\rmcast.sys
2009-04-15 23:32 . 2008-10-24 11:21	455296	-c----w	c:\windows\system32\dllcache\mrxsmb.sys
2009-04-15 23:32 . 2008-12-11 10:57	333952	-c----w	c:\windows\system32\dllcache\srv.sys
2009-04-15 23:32 . 2008-05-01 14:33	331776	-c----w	c:\windows\system32\dllcache\msadce.dll
2009-04-15 23:32 . 2008-04-11 19:04	691712	-c----w	c:\windows\system32\dllcache\inetcomm.dll
2009-04-15 23:32 . 2008-10-15 16:34	337408	-c----w	c:\windows\system32\dllcache\netapi32.dll
2009-04-15 23:32 . 2008-09-04 17:15	1106944	-c----w	c:\windows\system32\dllcache\msxml3.dll
2009-04-15 23:29 . 2009-03-27 06:58	1203922	-c----w	c:\windows\system32\dllcache\sysmain.sdb
2009-04-15 23:29 . 2008-05-03 11:55	2560	------w	c:\windows\system32\xpsp4res.dll
2009-04-15 23:29 . 2008-04-21 12:08	215552	-c----w	c:\windows\system32\dllcache\wordpad.exe
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\scripting
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\l2schemas
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\en
2009-04-15 23:21 . 2009-04-15 23:21	--------	d-----w	c:\windows\system32\bits
2009-04-15 23:19 . 2009-04-15 23:22	--------	d-----w	c:\windows\ServicePackFiles
2009-04-15 23:07 . 2004-08-04 02:41	11868	------w	c:\windows\system32\drivers\mdmxsdk.sys
2009-04-15 23:06 . 2004-08-04 02:29	73216	------w	c:\windows\system32\drivers\atintuxx.sys
2009-04-15 22:52 . 2008-08-14 10:04	138496	-c----w	c:\windows\system32\dllcache\afd.sys
2009-04-15 22:51 . 2008-07-09 07:38	26488	----a-w	c:\windows\system32\spupdsvc.exe
2009-04-15 22:51 . 2009-04-17 15:00	--------	d--h--w	c:\windows\$hf_mig$
2009-04-15 22:49 . 2008-10-16 18:09	43544	----a-w	c:\windows\system32\wups2.dll
2009-04-15 22:49 . 2008-10-16 18:09	31768	----a-w	c:\windows\system32\wucltui.dll.mui
2009-04-15 22:49 . 2008-10-16 18:07	23576	----a-w	c:\windows\system32\wuaucpl.cpl.mui
2009-04-15 22:49 . 2008-10-16 18:07	23576	----a-w	c:\windows\system32\wuapi.dll.mui
2009-04-15 22:49 . 2008-10-16 18:07	18456	----a-w	c:\windows\system32\wuaueng.dll.mui
2009-04-15 22:47 . 2009-04-15 22:47	--------	d-s---w	c:\documents and settings\Administrator\UserData
2009-04-15 22:37 . 2002-04-25 01:19	151552	----a-r	c:\windows\system32\igfxres.dll
2009-04-15 22:34 . 2002-05-06 18:41	29184	----a-r	c:\windows\system32\ialmrnt5.dll
2009-04-15 22:34 . 2002-05-06 18:40	77373	----a-r	c:\windows\system32\drivers\ialmnt5.sys
2009-04-15 22:34 . 2002-05-06 18:40	74814	----a-r	c:\windows\system32\ialmdnt5.dll
2009-04-15 22:34 . 2002-05-06 18:39	168925	----a-r	c:\windows\system32\ialmdev5.dll
2009-04-15 22:31 . 2008-04-13 18:45	6272	----a-w	c:\windows\system32\drivers\splitter.sys
2009-04-15 22:31 . 2008-04-13 19:17	83072	----a-w	c:\windows\system32\drivers\wdmaud.sys
2009-04-15 22:31 . 2008-04-13 18:45	52864	----a-w	c:\windows\system32\drivers\dmusic.sys
2009-04-15 22:31 . 2008-04-13 18:45	56576	----a-w	c:\windows\system32\drivers\swmidi.sys
2009-04-15 21:29 . 2009-04-15 21:29	3366912	----a-w	c:\windows\system32\GPhotos.scr

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-16 19:31 . 2009-04-16 19:31	2855	----a-w	c:\windows\PIF\Contacts.PIF
2009-04-16 03:17 . 2009-04-16 03:08	--------	d-----w	c:\program files\EphPod
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\iTunes
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\iPod
2009-04-16 02:50 . 2009-04-16 02:47	--------	d-----w	c:\program files\Common Files\Apple
2009-04-16 02:50 . 2009-04-16 02:50	--------	d-----w	c:\program files\Bonjour
2009-04-16 02:49 . 2009-04-16 02:49	--------	d-----w	c:\program files\QuickTime
2009-04-16 02:48 . 2009-04-16 02:48	--------	d-----w	c:\program files\Apple Software Update
2009-04-16 02:44 . 2009-04-16 02:44	--------	d-----w	c:\program files\Google
2009-04-16 00:21 . 2009-04-16 00:21	--------	d-----w	c:\program files\Common Files\Adobe AIR
2009-04-16 00:20 . 2009-04-16 00:20	--------	d-----w	c:\program files\Common Files\Adobe
2009-04-16 00:09 . 2009-04-16 00:09	--------	d-----w	c:\program files\Microsoft ActiveSync
2009-04-15 23:57 . 2009-04-15 23:57	--------	d-----w	c:\program files\AVG
2009-04-15 23:24 . 2009-04-15 02:05	86327	----a-w	c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-04-15 23:17 . 2004-08-03 14:59	250048	--sha-r	C:\ntldr
2009-04-15 02:07 . 2009-04-15 02:07	--------	d-----w	c:\program files\microsoft frontpage
2009-04-15 02:00 . 2009-04-15 02:00	21640	----a-w	c:\windows\system32\emptyregdb.dat
2009-03-06 14:22 . 2004-08-03 16:56	284160	----a-w	c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-03 16:56	826368	----a-w	c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-03 16:56	78336	----a-w	c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-03 16:56	729088	----a-w	c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-03 16:56	401408	----a-w	c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2004-08-03 16:56	617472	----a-w	c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-03 16:56	714752	----a-w	c:\windows\system32\ntdll.dll
2009-02-09 11:13 . 2004-08-03 15:17	1846784	----a-w	c:\windows\system32\win32k.sys
2009-02-07 23:02 . 2004-08-03 22:59	2066048	----a-w	c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2004-08-03 16:56	110592	----a-w	c:\windows\system32\services.exe
2009-02-06 11:08 . 2004-08-03 15:20	2189056	----a-w	c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2002-09-08 16:00	35328	----a-w	c:\windows\system32\sc.exe
2009-02-03 19:59 . 2004-08-03 16:56	56832	----a-w	c:\windows\system32\secur32.dll
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.


---- c:\windows\system32\dllcache\svchost.exe ----
Company: 
File Description: 
File Version: 1.00
Product Name: xxx
Copyright: 
Original file name: Global.exe
File Size: 225280
Created Time: 2009-04-17 21:55
Modified Time: 2009-04-16 19:16
Accessed Time: 2009-04-18 13:56
MD5: 81803BB25CACF69D78ABD48D54774317
SHA: 3606B9414534DB45DD756262643AE8F143836707


((((((((((((((((((((((((((((( [email protected]_21.58.19 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-16 02:51 . 2009-04-17 22:21	102400 c:\windows\Installer\{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}\iTunesIco.exe
- 2009-04-16 02:51 . 2009-04-16 02:51	102400 c:\windows\Installer\{5EFCBB42-36AB-4FF9-B90C-E78C7B9EE7B3}\iTunesIco.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2002-04-25 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2002-04-25 106496]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-04-15 1932568]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-04-02 342312]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-04-15 23:57	10520	----a-w	c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\auto.exe]
"Debugger"=c:\windows\system32\drivers\drivers.cab.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autorun.exe]
"Debugger"=c:\windows\system32\drivers\drivers.cab.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe]
"Debugger"=c:\windows\system32\drivers\drivers.cab.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\boot.exe]
"Debugger"=c:\windows\Fonts\fonts.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ctfmon.exe]
"Debugger"=c:\windows\Fonts\Fonts.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msconfig.exe]
"Debugger"=c:\windows\Media\rndll32.pif

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\procexp.exe]
"Debugger"=c:\windows\pchealth\helpctr\binaries\HelpHost.com

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\taskmgr.exe]
"Debugger"=c:\windows\Fonts\tskmgr.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-04-15 325640]
S1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-04-15 108552]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-04-15 908056]
S2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-04-15 298264]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df48ec83-2a17-11de-8153-0002b39de1a3}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MS-DOS.com
\Shell\Explore\command - E:\MS-DOS.com
\Shell\Open\command - E:\MS-DOS.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df48ec8a-2a17-11de-8153-0002b39de1a3}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL MS-DOS.com
\Shell\Explore\command - E:\MS-DOS.com
\Shell\Open\command - E:\MS-DOS.com
.
- - - - ORPHANS REMOVED - - - -

HKCU-RunOnce-<NO NAME> - c:\windows\system32\dllcache\Default.exe
HKLM-Run-<NO NAME> - c:\windows\system\KEYBOARD.exe
HKLM-RunOnce-<NO NAME> - c:\windows\system32\dllcache\Default.exe
HKLM-Explorer_Run-sys - c:\windows\Fonts\Fonts.exe


.
------- Supplementary Scan -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Zhu Zhu\Application Data\Mozilla\Firefox\Profiles\7nrz9zi1.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-18 09:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ... 

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-04-18 10:00
ComboFix-quarantined-files.txt 2009-04-18 13:59
ComboFix2.txt 2009-04-17 21:59

Pre-Run: 28,035,317,760 bytes free
Post-Run: 28,022,333,440 bytes free

267	--- E O F ---	2009-04-17 15:00


----------



## Ried

Hi ww2b,

Insert your flash drive again.

It's IMPORTANT to carry out the instructions in the sequence listed below.


***************************************************


Open *notepad* and copy/paste the text in the code box below into it:



> File::
> E:\MS-DOS.com
> 
> Registry::
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\auto.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autorun.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\autoruns.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\boot.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\ctfmon.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\msconfig.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\procexp.exe]
> [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\taskmgr.exe]
> [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df48ec83-2a17-11de-8153-0002b39de1a3}]
> [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df48ec8a-2a17-11de-8153-0002b39de1a3}]


Save this as *"CFScript.txt"*, and as Type: All Files (*.*)
in the same location as ComboFix.exe

===================================

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

===================================












Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt*


--------------------------------------------------------------------

It's important to run this online scan to search for any remnants. It can take some time, so please be patient and allow it to run it's full course:

Using Internet Explorer or Firefox, visit http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html 

*1.* Click *Accept*, when prompted to download and install the program files and database of malware definitions. 


*2. * To optimize scanning time and produce a more sensible report for review:

Close any open programs

Turn off the real time scanner of any existing antivirus program while performing the online scan

*3. * Click *Run* at the Security prompt. The program will then begin downloading and installing and will also update the database. Please be patient as this can take several minutes. 
Once the update is complete, click on *My Computer* under the green *Scan* bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do *NOT* be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click *View scan report* at the bottom. 











 Click the *Save as Text* button to save the file to your desktop so that you may post it in your next reply

---------------------------------------------------------------

Please include the following in your next reply:

*C:\ComboFix.txt
Kaspersky results
Update on system behavior*


----------



## Ried

Are you still with me, ww2b?


----------

