Tech Support Team

jon · #1 (**permalink**) **Top** 27th May 2008, 07:12 AM

Hi,
I keep getting a warning that <REMOVED>.... is trying to access the web and that it is dangerous. I am actually not trying to access the net when this happens.

And all of the sudden Explorer, etc. tell me it has a bug and some warnings about a part of the memory not being accessed.

What is this and what can I do to remove it?

By the way, I do not have the Windows installations cd or xp cd.

Thanks for your help, jon

**evilfantasy** · #2 (**permalink**) **Top** 27th May 2008, 08:17 AM

Welcome to TST

Prior to posting for help we ask that you please read and follow all instructions in the pinned topic titled Viruses/Spyware/Malware, preliminary removal instructions. Following the instructions will allow for us to quickly help you with specific fixes for what may remain on your system.

When you have completed the instructions post the logs in this thread and a member of the Security Team will be along to assist in further cleanup.

jon · #3 (**permalink**) **Top** 27th May 2008, 04:01 PM

Thanks for the welcome.

I did check the Viruses/Spyware/Malware, preliminary removal instructions and I am using my computer for banking, etc. and it suggested to reinstal windows but I do not have the CDs to reinstal windows.

Do you think that cleaning the system is enough?

Thank you. jon

**evilfantasy** · #4 (**permalink**) **Top** 27th May 2008, 05:42 PM

It depends on what all has gotten on to the PC. Seeing the logs will let us know what the best action to take is.

jon · #5 (**permalink**) **Top** 28th May 2008, 09:05 AM

My problems sounds like the one "unakipied" has.

What do I need to do you show you my logs (what is that?)?

Thanks.

**evilfantasy** · #6 (**permalink**) **Top** 28th May 2008, 09:08 AM

It's all in the link in the below quote.

Quote:

Originally Posted by evilfantasy

Welcome to TST

Prior to posting for help we ask that you please read and follow all instructions in the pinned topic titled CLICK HERE>> Viruses/Spyware/Malware, preliminary removal instructions. Following the instructions will allow for us to quickly help you with specific fixes for what may remain on your system.

When you have completed the instructions post the logs in this thread and a member of the Security Team will be along to assist in further cleanup.

jon · #7 (**permalink**) **Top** 28th May 2008, 10:10 AM

If I understand right I would have to do the whole cleaning process to get to point STEP 15 to get the logs?

Or is there a shorter way to showing you the logs to know what to do?

Thanks.

**evilfantasy** · #8 (**permalink**) **Top** 28th May 2008, 05:54 PM

Post a Hijackthis log and I will take a look.

Download and rename HijackThis (HJT)

Double-click on HJTInstall.
Click on the Install button.
It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
Upon install, HijackThis should open for you.

Close HijackThis and rename it.
Go to C:\Program Files\Trend Micro\HijackThis.exe
Right click on HijackThis.exe and select Rename.
Type in sniper.exe and press Enter.
Right-click on sniper.exe and select Send To > Desktop (create shortcut)

From the desktop open Hijackthis.
If using Windows Vista, Right-click and Run As Administrator.
Click on the Do a system scan and save a log file button
Hijackthis will scan and then a log will open in notepad.
Copy and then paste the entire contents of the log in your post.
Do not have Hijackthis fix anything yet. Most of what it finds will be harmless or even required.

Although we have renamed Hijackthis to sniper, we will still refer to it as Hijackthis or HJT.

jon · #9 (**permalink**) **Top** 29th May 2008, 09:01 AM

Ok. Here it is:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:55, on 29.5.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe
C:\Program Files\IBM\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\WINDOWS\system32\SNDVOL32.EXE
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\sniper.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Elisa navit
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = Live Search:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/mail?.intl=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = Elisa.Net -
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = Live Search:
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer - Provided by Elisa Internet
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {99972D1B-964E-49EC-92F4-1EB39F4810A5} - C:\WINDOWS\system32\khfCrRKC.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: BlueSoleil.lnk = ?
O4 - Global Startup: BTTray.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/229?79cb09f9dea2464ea1295914ef6e6dc2
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-us\msntabres.dll.mui/230?79cb09f9dea2464ea1295914ef6e6dc2
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IBM\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IBM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\IBM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Support - {5DAF478D-6983-41D1-98E0-63B27E556AF5} - Elisa -Asiakastuen etusivu (file missing) (HKCU)
O9 - Extra button: SMS - {AEEAE7C0-A389-4177-8318-FA40937CDD37} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Service - {D13E55B6-12DF-4D83-8642-6DA0BFE9EB93} - http://service.kolumbus.fi/ (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://elisa.net/
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: khfCrRKC - C:\WINDOWS\SYSTEM32\khfCrRKC.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\IBM\Bluetooth Software\bin\btwdins.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
O23 - Service: Retrospect Launcher (RetroLauncher) - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
O23 - Service: Retrospect Helper - EMC Corporation - C:\Program Files\Retrospect\Retrospect 7.5\rthlpsvc.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe

--
End of file - 10523 bytes

**evilfantasy** · #10 (**permalink**) **Top** 29th May 2008, 09:12 AM

It's going to take a few steps and a few more logs but we should be able to get it easy enough.

Open Hijackthis and select Do a system scan only.

Place a check mark next to the following entries: (if there)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {99972D1B-964E-49EC-92F4-1EB39F4810A5} - C:\WINDOWS\system32\khfCrRKC.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra button: Support - {5DAF478D-6983-41D1-98E0-63B27E556AF5} - Elisa -Asiakastuen etusivu (file missing) (HKCU)
O9 - Extra button: SMS - {AEEAE7C0-A389-4177-8318-FA40937CDD37} - http://sms.kolumbus.fi/ (file missing) (HKCU)
O9 - Extra button: Service - {D13E55B6-12DF-4D83-8642-6DA0BFE9EB93} - http://service.kolumbus.fi/ (file missing) (HKCU)

Important: Close all windows except for Hijackthis and then click Fix checked.

Exit Hijackthis.

----------

Run this Disable/Remove Windows Messenger to remove Windows Messenger.

Do not confuse Windows Messenger with MSN Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

----------

Download Combofix by sUBs from one of the below links.
(Try all three if necessary)

Important! Combofix.exe MUST be saved to and ran from the Desktop.

Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting Combofix.
Important! Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan.
- Click this link to see a list of security programs that should be disabled and how to disable them.
- If yours is not listed and you don't know how to disable it, please ask.
Warning: Combofix disconnects your computer from the internet. The connection is automatically restored before Combofix completes its run.
Double click combofix.exe & follow the prompts.
- Choose Yes to accept the Disclaimers.
When finished, it will produce a log for you.
Post that log in your next reply.

Warning: Do not mouseclick combofix's window while it is running. That may cause it to stall

If Combofix runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your computer.
Important: Remember to re-enable your antivirus and antispyware before reconnecting to the Internet.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

If needed, see this Combofix tutorial with screenshots that will detail the downloading and running of combofix more thoroughly.

----------

Next post add
Combofix log

jon · #11 (**permalink**) **Top** 29th May 2008, 09:54 AM

hi, when I get to |MG| Disable/Remove Windows Messenger
it does not show a place where I can download that specific program but instead it has all sorts of "Recommended Download" that take me to other pages.

**evilfantasy** · #12 (**permalink**) **Top** 29th May 2008, 10:01 AM

Download MessengerDisable here.

Unzip the file on the Desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

Exit out of MessengerDisable then delete the two files that were put on the Desktop.

jon · #13 (**permalink**) **Top** 29th May 2008, 10:17 AM

ok - disconnected messenger.
Regarding: Temporarily disable your antivirus, script blocking and any antispyware real time protection before performing a scan. I have Trend Micro PC-cillin and that one is not in the list. How can I do this?

**evilfantasy** · #14 (**permalink**) **Top** 29th May 2008, 10:21 AM

Exit PC-cillin Internet Security from the system tray menu

1.Close the PC-cillin Internet Security main console if it is open.

2. Right-click the PC-cillin Internet Security icon near your computer's system clock.

3. Click Exit from the menu.

4. Click Yes when the confirmation message appears.

The PC-cillin Internet Security icon will disappear. Windows may display a popup message saying "Trend Micro PC-cillin Internet Security 2007 is turned off" and "Trend Micro PC-cillin Internet Security (Firewall) is turned off".

5. To turn PC-cillin Internet Security on again, click Start > Programs or All Programs > Internet Security 2007 > Main Console.

jon · #15 (**permalink**) **Top** 29th May 2008, 12:00 PM

thanks.
Did all of the above and had to re-start the computer because it was not allowing me to go into the internet, however, the Windows Installer automatically started installing Windows Live Messenger (as I am writing this) and immediately the TrenMicro warning of Dangerous web site came on with the same warning. Here is the log:

ComboFix 08-05-28.4 - Alberto Carrero 2008-05-29 13:10:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.155 [GMT 3:00]
Running from: C:\Documents and Settings\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-29 )))))))))))))))))))))))))))))))
.

2008-05-28 17:36 . 2008-05-28 17:36 <DIR> d----c--- C:\3ef422939e818e480576b8f95ef8ca
2008-05-24 07:53 . 2008-05-24 07:53 57,344 --a------ C:\WINDOWS\system32\rqRLcCut.dll
2008-05-24 07:53 . 2008-05-24 07:53 57,344 --a------ C:\WINDOWS\system32\khfCrRKC.dll
2008-05-14 21:36 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-05-14 21:36 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\Alberto Carrero\Application Data\PC Suite
2008-05-14 21:33 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\Alberto Carrero\Application Data\Nokia
2008-05-14 21:31 . 2008-05-14 21:31 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-14 21:31 . 2008-05-14 21:31 <DIR> d-------- C:\Program Files\DIFX
2008-05-14 21:31 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-14 21:30 . 2008-05-26 07:06 <DIR> d-------- C:\Program Files\Nokia
2008-05-14 21:30 . 2007-11-29 10:32 48,128 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-05-14 21:25 . 2008-05-14 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-05-29 07:55 --------- d-----w C:\Program Files\Trend Micro
2008-05-28 18:18 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\Skype
2008-05-28 07:11 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\skypePM
2008-05-25 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Retrospect
2008-05-23 16:22 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\uTorrent
2008-05-08 18:15 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\dvdcss
2008-05-02 13:22 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-05-02 13:21 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-05-02 13:17 1,169,240 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2008-05-02 09:07 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\NCH Swift Sound
2008-04-10 12:15 --------- d-----w C:\Program Files\Java
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-18 21:04 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2006-12-03 19:56 5,254,656 ----a-w C:\Program Files\converter.exe
2006-12-01 19:28 8,282,187 ----a-w C:\Program Files\vlc-0.8.5-win32.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{99972D1B-964E-49EC-92F4-1EB39F4810A5}]
2008-05-24 07:53 57344 --a------ C:\WINDOWS\system32\khfCrRKC.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-11 02:44 679936]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2006-11-10 23:11 249927]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 15:34 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 15:33 561152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 10:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-07 14:19 3429904]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-06-10 18:10:59 1044480]
BTTray.lnk - C:\Program Files\IBM\Bluetooth Software\BTTray.exe [2004-01-20 19:15:12 507965]

[hkey_local_machine\software\microsoft\windows\curr entversion\explorer\shellexecutehooks]
"{99972D1B-964E-49EC-92F4-1EB39F4810A5}"= C:\WINDOWS\system32\khfCrRKC.dll [2008-05-24 07:53 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfCrRKC]
khfCrRKC.dll 2008-05-24 07:53 57344 C:\WINDOWS\system32\khfCrRKC.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Retrospect\\Retrospect 7.5\\Retrospect.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"94:TCP"= 94:TCP:VRS Recording System Web Control Panel
"8000:UDP"= 8000:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8001:UDP"= 8001:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8002:UDP"= 8002:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8003:UDP"= 8003:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8004:UDP"= 8004:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8005:UDP"= 8005:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8006:UDP"= 8006:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8007:UDP"= 8007:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8008:UDP"= 8008:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8009:UDP"= 8009:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"5060:UDP"= 5060:UDP:Axon Virtual PBX Sip Incoming Calls (UDP)
"81:TCP"= 81:TCP:Axon Virtual PBX Web Server

S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-05-28 08:08:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-29 09:55:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-29 13:14:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\khfCrRKC.dll
.
Completion time: 2008-05-29 13:17:20
ComboFix-quarantined-files.txt 2008-05-29 10:17:04

Pre-Run: 17,345,458,176 bytes free
Post-Run: 17,436,073,984 bytes free

129 --- E O F --- 2008-05-21 05:19:38

**evilfantasy** · #16 (**permalink**) **Top** 29th May 2008, 04:15 PM

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.

Click Start , then Run
Type notepad.exe in the Run Box.

2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code:

KillAll::

File::
C:\3ef422939e818e480576b8f95ef8ca
C:\WINDOWS\system32\rqRLcCut.dll
C:\WINDOWS\system32\khfCrRKC.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{99972D1B-964E-49EC-92F4-1EB39F4810A5}]

[-hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfCrRKC]

3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!

ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick combofix's window while it is running. That may cause your system to freeze

jon · #17 (**permalink**) **Top** 30th May 2008, 03:24 PM

hello! When I did the drag of CFScript into ComboFix.exe, Trend Micro warned me that an new software: NirCmd is trying to be installed. Is this part of what was copied and should I allow it to be installed?

Thank you! and here is the log:

ComboFix 08-05-28.4 - Alberto Carrero 2008-05-30 15:38:53.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.273 [GMT 3:00]
Running from: C:\Documents and Settings\Alberto Carrero\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\3ef422939e818e480576b8f95ef8ca
C:\WINDOWS\system32\khfCrRKC.dll
C:\WINDOWS\system32\rqRLcCut.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\khfCrRKC.dll
C:\WINDOWS\system32\rqRLcCut.dll

.
((((((((((((((((((((((((( Files Created from 2008-04-28 to 2008-05-30 )))))))))))))))))))))))))))))))
.

2008-05-28 17:36 . 2008-05-28 17:36 <DIR> d----c--- C:\3ef422939e818e480576b8f95ef8ca
2008-05-14 21:36 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PC Suite
2008-05-14 21:36 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\Alberto Carrero\Application Data\PC Suite
2008-05-14 21:33 . 2008-05-14 21:36 <DIR> d-------- C:\Documents and Settings\Alberto Carrero\Application Data\Nokia
2008-05-14 21:31 . 2008-05-14 21:31 <DIR> d-------- C:\Program Files\PC Connectivity Solution
2008-05-14 21:31 . 2008-05-14 21:31 <DIR> d-------- C:\Program Files\DIFX
2008-05-14 21:31 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys
2008-05-14 21:30 . 2008-05-26 07:06 <DIR> d-------- C:\Program Files\Nokia
2008-05-14 21:30 . 2007-11-29 10:32 48,128 --a------ C:\WINDOWS\system32\nmwcdcls.dll
2008-05-14 21:25 . 2008-05-14 21:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Installations
2008-04-20 10:45 . 2008-05-25 19:48 1,363,602 --a------ C:\WINDOWS\setupapi.log.1.old
2008-04-01 10:50 . 2008-05-02 12:07 <DIR> d-------- C:\Documents and Settings\Alberto Carrero\Application Data\NCH Swift Sound

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))) ))
.
2008-05-30 12:01 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\Skype
2008-05-30 11:18 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\skypePM
2008-05-29 07:55 --------- d-----w C:\Program Files\Trend Micro
2008-05-25 16:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Retrospect
2008-05-23 16:22 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\uTorrent
2008-05-08 18:15 --------- d-----w C:\Documents and Settings\Alberto Carrero\Application Data\dvdcss
2008-05-02 13:22 205,328 ----a-w C:\WINDOWS\system32\drivers\tmxpflt.sys
2008-05-02 13:21 36,368 ----a-w C:\WINDOWS\system32\drivers\tmpreflt.sys
2008-05-02 13:17 1,169,240 ----a-w C:\WINDOWS\system32\drivers\vsapint.sys
2008-04-10 12:15 --------- d-----w C:\Program Files\Java
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
2008-02-18 21:04 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2008-02-16 08:59 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2006-12-03 19:56 5,254,656 ----a-w C:\Program Files\converter.exe
2006-12-01 19:28 8,282,187 ----a-w C:\Program Files\vlc-0.8.5-win32.exe
.

((((((((((((((((((((((((((((( snapshot@2008-05-29_13.15.59,64 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-29 09:35:36 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-30 13:16:55 2,048 --s-a-w C:\WINDOWS\bootstat.dat
- 2008-05-29 09:29:44 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
+ 2008-05-29 10:59:12 29,926 ----a-r C:\WINDOWS\Installer\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}\MsblIco.Exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Curre ntVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 10:56 15360]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 18:22 21898024]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34 5724184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Curr entVersion\Run]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-11 02:44 679936]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2006-11-10 23:11 249927]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 15:34 126976]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 15:33 561152]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 10:56 110592 C:\WINDOWS\system32\bthprops.cpl]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" [2007-03-07 14:19 3429904]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42 267064]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 17:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 17:37 2178832]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
BlueSoleil.lnk - C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe [2007-06-10 18:10:59 1044480]
BTTray.lnk - C:\Program Files\IBM\Bluetooth Software\BTTray.exe [2004-01-20 19:15:12 507965]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\uTorrent\\utorrent.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Retrospect\\Retrospect 7.5\\Retrospect.exe"=
"C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpo licy\standardprofile\GloballyOpenPorts\List]
"94:TCP"= 94:TCP:VRS Recording System Web Control Panel
"8000:UDP"= 8000:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8001:UDP"= 8001:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8002:UDP"= 8002:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8003:UDP"= 8003:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8004:UDP"= 8004:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8005:UDP"= 8005:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8006:UDP"= 8006:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8007:UDP"= 8007:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8008:UDP"= 8008:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"8009:UDP"= 8009:UDP:Axon Virtual PBX RTP Incoming Audio (UDP)
"5060:UDP"= 5060:UDP:Axon Virtual PBX Sip Incoming Calls (UDP)
"81:TCP"= 81:TCP:Axon Virtual PBX Web Server

S3 pccsmcfd;PCCS Mode Change Filter Driver;C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 15:53]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-28 08:08:12 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-30 12:55:05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
.
************************************************** ************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-30 16:19:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

************************************************** ************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\ibm\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe
C:\Program Files\Retrospect\Retrospect 7.5\retrorun.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\PROGRA~1\TRENDM~1\INTERN~2\pccguide.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
C:\Program Files\iPod\bin\iPodService.exe
.
************************************************** ************************
.
Completion time: 2008-05-30 16:30:41 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-30 13:30:23
ComboFix2.txt 2008-05-29 10:17:22

Pre-Run: 18,166,185,984 bytes free
Post-Run: 18,166,153,216 bytes free

162 --- E O F --- 2008-05-21 05:19:38

**evilfantasy** · #18 (**permalink**) **Top** 31st May 2008, 02:04 AM

NirCmd is part of CF and is seen as suspicious by most AV's.

Copy this file path C:\3ef422939e818e480576b8f95ef8ca (highlight and press ctrl+C)

Go to Home - Antivirus online virus scan - viruschief.com

Paste the file path in the window under Quick Scan: (press ctrl+V on the keyboard to paste)

Click Scan.

You will see a message:
ENG: It can take up to 1 minute before your scan starts, please wait!
GER: Es kann bis zu einer Minute dauern bis Ihr Scan startet, bitte warten!

Once the scan is complete, copy the text in the window under BB Code and paste it into the next post.

jon · #19 (**permalink**) **Top** 31st May 2008, 11:20 AM

Hi.
Did exactly as you said and get : Error Upload/Formular error!

Please could you remove the personal information (persons name and any delicate codes) off the trheat so they are not publicly visible? I would greatly appreciate this!

Thank you for your great help.

jon · #20 (**permalink**) **Top** 31st May 2008, 11:35 AM

Hi again.

The computer restarted itself after my last post to you and I got the following:

The system has recovered from a serious error.
Error signature:
BCCode : 100000d1 BCP1 : 00000000 BCP2 : 00000002 BCP3 : 00000000
BCP4 : F866FC49 OSVer : 5_1_2600 SP : 2_0 Product : 256_1

Error Reports Contents:
C:\DOCUME~1\ALBERT~1\LOCALS~1\Temp\WER0004.dir00\M ini053108-01.dmp
C:\DOCUME~1\ALBERT~1\LOCALS~1\Temp\WER0004.dir00\s ysdata.xml

Also TrendMicro has a:
Recovery Notification saying that it has reverted to last known good configuration and asked me to restart.