# "Task manager has been disabled by your administrator", i am the administrator! Help!



## jimj2k (May 25, 2007)

Heya, 
recently my computer has been running really slow and when i press ctrl alt delete a warning box says "Task manager has been disabled by your administrator" even though i am the administrator. As well as this on the start menu the shutdown button has disappeared leaving only the log off button! I'm guessing that this is a virus, and any help you guys can give me to help sort this out would be greatly appreciated.

thanks in advance

jimj2k


----------



## bonk (Sep 8, 2005)

Welcome,

The best way is to post a HijackThis log and let an Log Expert to look at it for you.

Download *HijackThis* to your desktop

*Double* click on HijackThis on your Desktop
Then click on *Unzip*
It will install to *Program files* by default
Then Click *Start*>>>*Run *type *C:\Program Files *click *OK*
Look for a folder called *HijackThis*
*Double *click on it 
On the *right *you will see a Icon of *Dynamite *with *plunger*
*Double* click on the Icon
Click on Icon and choose *"scan system and save a logfile" *usually in notepad
Copy and Paste the logfile in your next post
Using *Ctrl+A* to copy All and *Ctrl+C* to copy and *Ctrl+V* to paste.


----------



## timothye (Nov 19, 2004)

i take no response ability for this or this site 
http://windowsxp.mvps.org/Taskmanager_error.htm
but a simple google search brought this up


----------



## jimj2k (May 25, 2007)

Hey guys thanks for replying, i've also just noticed that there is no "run" on the start menu either, damn thing. This is the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 19:53:56, on 25/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Belkin\F5D7051\WLService.exe
C:\Program Files\Belkin\F5D7051\WLanCfgG.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\setup.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\James\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: Belkin Wireless Network Monitor Utility (USB).lnk = C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Belkin High-Speed Mode Wireless G USB Driver (Belkin High-Speed Mode Wireless G USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\F5D7051\WLService.exe
O23 - Service: NTLOAD - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)
O23 - Service: NTSVCMGR - Unknown owner - c:\windows\system32\dllcache\win32\winlogon.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe

again appreciate your help,

thankyou


----------



## dvk01 (Dec 14, 2002)

Download *WinPFind3U.exe* to your Desktop and double-click on it to extract the files. It will create a folder named WinPFind3u on your desktop.


Open the WinPFind3u folder and double-click on *WinPFind3U.exe* to start the program.
In the *Processes * group click *Non-Microsoft* 
In the *Win32 Services * group click *Non-Microsoft* 
In the *Driver Services * group click *Non-Microsoft* 
In the *Registry * group click *Non-Microsoft* 
In the *Files Created Within* group click *30 days* Make sure Non-Microsoft only is *CHECKED*
In the *Files Modified Within* group select *30 days* Make sure Non-Microsoft only is *CHECKED*
In the *File String Search* group select *Non-Microsoft*
In the *additional scans section*, please select *only these 

 Reg - Desktop Components
Reg - Disabled MS Config Items
Reg - Safeboot Options
File - Additional Folder Scans
*
*
[*]Now click the Run Scan button on the toolbar.
[*]The program will be scanning huge amounts of data so depending on your system it could take a long time to complete. Let it run unhindered until it finishes.
[*]When the scan is complete Notepad will open with the report file loaded in it.
[*]Save that notepad file 
*
*
Use the  Reply button and attach the notepad file here . I will review it when it comes in.*


----------



## jimj2k (May 25, 2007)

thanks very much for this i think i have attached the file


----------



## jimj2k (May 25, 2007)

anyone who could have a look at his winpfind3u log it would be greatly appreciating this virus is really getting frustrating


----------



## dvk01 (Dec 14, 2002)

first

Download
http://www.uploads.ejvindh.net/rustbfix.exe
...and save it to your desktop.

Double click on rustbfix.exe to run the tool. If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically. After the reboot 2 logfiles will open (%root%\avenger.txt & %root%\rustbfix\pelog.txt). Post the content of these logfiles along with a new HijackThis log.

after the 2 reboots then

WinPFind3 Fix -

Start WinPFind3U. Copy/Paste the information in the codebox below into the pane where it says "Paste fix here" and then click the *Run Fix* button.


```
[Kill Explorer]
[Unregister Dlls]
[Processes - Non-Microsoft Only]
YY -> setup.exe -> %SystemRoot%\setup.exe
YY -> setup.exe -> %SystemRoot%\setup.exe
[Win32 Services - Non-Microsoft Only]
YY -> (NTLOAD) NTLOAD [Win32_Own | Auto | Stopped] -> %System32%\dllcache\win32\winlogon.exe
YY -> (NTSVCMGR) NTSVCMGR [Win32_Own | Auto | Stopped] -> %System32%\dllcache\win32\winlogon.exe
[Driver Services - Non-Microsoft Only]
YY -> (core) core [Kernel | System | Running] -> %System32%\drivers\core.sys
[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
YY -> setup -> %System32%\ophkbkkr.dll [rundll32.exe "C:\WINDOWS\system32\ophkbkkr.dll",realset]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
YY -> {78BD2971-EB54-4EE9-95F2-F6321B16AC85} [HKLM] -> %System32%\byxyxvt.dll []
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
YY -> byxyxvt -> %System32%\byxyxvt.dll
YN -> iphump -> iphump.dll
YY -> vtsqo -> %System32%\vtsqo.dll
< CurrentVersion Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoRun -> 1
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoClose -> 1
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableTaskMgr -> 1
YN -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\DisableRegistryTools -> 1
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YY -> {4B646AFB-9341-4330-8FD1-C32485AEE619} [HKLM] -> %System32%\wxyuftmx.dll [Reg Data - Value does not exist]
YY -> {78BD2971-EB54-4EE9-95F2-F6321B16AC85} [HKLM] -> %System32%\byxyxvt.dll [Reg Data - Value does not exist]
YY -> {9D1B74EA-1B91-4667-87CA-97E09995AF87} [HKLM] -> %System32%\vtsqo.dll [Reg Data - Value does not exist]
YY -> {EDE129E1-7C4C-45D3-906A-CD80D6702CB5} [HKLM] -> %System32%\vtsqo.dll [Reg Data - Value does not exist]
< Internet Explorer ToolBars [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\
YN -> ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
YN -> WebBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found]
[Files/Folders - Created Within 30 days]
NY -> djmggki.exe -> %SystemDrive%\djmggki.exe
NY -> mupsfkdw.exe -> %SystemDrive%\mupsfkdw.exe
NY -> yyfh.exe -> %SystemDrive%\yyfh.exe
NY -> jknradee.sys -> %SystemRoot%\jknradee.sys
NY -> bljoktwc.dll -> %System32%\bljoktwc.dll
NY -> byxyxvt.dll -> %System32%\byxyxvt.dll
NY -> max1d1641.exe -> %System32%\max1d1641.exe
NY -> ophkbkkr.dll -> %System32%\ophkbkkr.dll
NY -> oqstv.bak1 -> %System32%\oqstv.bak1
NY -> oqstv.bak2 -> %System32%\oqstv.bak2
NY -> oqstv.ini -> %System32%\oqstv.ini
NY -> oqstv.ini2 -> %System32%\oqstv.ini2
NY -> protector.exe -> %System32%\protector.exe
NY -> RegistryCleanerSetup.exe -> %System32%\RegistryCleanerSetup.exe
NY -> rkkbkhpo.ini -> %System32%\rkkbkhpo.ini
NY -> rlbcktgm.dll -> %System32%\rlbcktgm.dll
NY -> vtsqo.dll -> %System32%\vtsqo.dll
NY -> wxyuftmx.dll -> %System32%\wxyuftmx.dll
NY -> xpdt.sys -> %System32%\xpdt.sys
NY -> core.cache.dsk -> %System32%\drivers\core.cache.dsk
NY -> core.sys -> %System32%\drivers\core.sys
[Empty Temp Folders]
[Start Explorer]
[Reboot]
```
The fix should only take a very short time and then you will be asked if you want to reboot. Choose Yes.

when it reboots

Post the following back here:

the latest .log file from the WinPFind3u folder (it will have a name in the format mmddyyyy_hhmmss.log)

I will review the information when it comes back in.

Also let me know of any problems you encountered performing the steps above or any continuing problems you are still having with the computer.

when it reboots then

Download  Combofix to your desktop:

* Double-click combofix.exe & follow the prompts.
* When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


----------



## jimj2k (May 25, 2007)

ok other than taking an age the first step went well, and i have the two logs they are below:

Pelog:

************************* Rustock.b-fix v. 1.01 -- By ejvindh *************************
26/05/2007 15:47:18.32

******************* Pre-run Status of system *******************

Rootkit driver xpdt is found. Starting the unload-procedure....

Rustock.b-ADS attached to the System32-folder:
No streams found.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32


******************* Post-run Status of system *******************

Rustock.b-driver on the system: NONE!

Rustock.b-ADS attached to the System32-folder:
No System32-ADS found.

Looking for Rustock.b-files in the System32-folder:
No Rustock.b-files found in system32


******************************* End of Logfile ********************************




Avenger:

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\spfbsegm

*******************

Script file located at: \??\C:\Program Files\ppkiibio.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver xpdt unloaded successfully.
Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

Completed script processing.

*******************

Finished! Terminate.


----------



## dvk01 (Dec 14, 2002)

PK 

lets have teh wpfind report & teh combofix report please


----------



## jimj2k (May 25, 2007)

just tried the wpfind and my computer crashed, i'm going to try again now, oh and hears the hijackthis log.

Logfile of HijackThis v1.99.1
Scan saved at 16:20:28, on 26/05/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16441)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Belkin\F5D7051\WLService.exe
C:\Program Files\Belkin\F5D7051\WLanCfgG.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\WinTV\Ir.exe
C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
C:\PROGRA~1\HEWLET~1\AiO\Shared\Bin\hpoevm07.exe
C:\WINDOWS\system32\hpoipm07.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpOSTS07.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\James\Desktop\Other Stuff\gsrgf.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.4.29.dll
O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\wxyuftmx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {78BD2971-EB54-4EE9-95F2-F6321B16AC85} - C:\WINDOWS\system32\byxyxvt.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: (no name) - {bc802af4-9c3c-497e-a878-fe3231082ae5} - (no file)
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O2 - BHO: (no name) - {E966FB03-0CCD-4A92-AFAE-096858FC0639} - C:\WINDOWS\system32\vtsqo.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [setup] rundll32.exe "C:\WINDOWS\system32\ophkbkkr.dll",realset
O4 - HKLM\..\RunServices: [SchedulingAgent] C:\WINDOWS\system32\mstask.exe
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutoStart IR.lnk = C:\Program Files\WinTV\Ir.exe
O4 - Global Startup: Belkin Wireless Network Monitor Utility (USB).lnk = C:\Program Files\Belkin Corporation\Belkin Wireless Network Monitor Utility and Driver (USB)\BelkinWlanMonitor.exe
O4 - Global Startup: HPAiODevice(hp psc 700 series) - 1.lnk = C:\Program Files\Hewlett-Packard\AiO\hp psc 700 series\Bin\hpobrt07.exe
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .UVR: C:\Program Files\Internet Explorer\Plugins\NPUPano.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab31267.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: byxyxvt - C:\WINDOWS\SYSTEM32\byxyxvt.dll
O20 - Winlogon Notify: iphump - iphump.dll (file missing)
O20 - Winlogon Notify: vtsqo - C:\WINDOWS\system32\vtsqo.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Belkin High-Speed Mode Wireless G USB Driver (Belkin High-Speed Mode Wireless G USB Network Adapter Service) - Unknown owner - C:\Program Files\Belkin\F5D7051\WLService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe


----------



## jimj2k (May 25, 2007)

unfortunately it crashed again, shall i do the other one anyway?


----------



## jimj2k (May 25, 2007)

This is the combofix file, as i say wpfind crashes when i try to load it

"James" - 2007-05-26 16:40:39 Service Pack 2 
ComboFix 07-05.26.3.V - Running from: "C:\Documents and Settings\James\Desktop\"

(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\WinFlyer32.dll
C:\WINDOWS\system32\ophkbkkr.dll
C:\WINDOWS\system32\rlbcktgm.dll
C:\WINDOWS\system32\rkkbkhpo.ini
C:\WINDOWS\system32\oqstv.bak1
C:\WINDOWS\system32\oqstv.bak2
C:\WINDOWS\system32\oqstv.ini
C:\WINDOWS\system32\oqstv.ini2
C:\WINDOWS\system32\oqstv.tmp
C:\WINDOWS\system32\oqstv.bak1
C:\WINDOWS\system32\oqstv.bak2
C:\WINDOWS\system32\oqstv.ini
C:\WINDOWS\system32\oqstv.ini2
C:\WINDOWS\system32\oqstv.tmp

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\1169736936.exe"
"C:\DOCUME~1\James\Desktop.\internet explorer.lnk"
"C:\WINDOWS\system32\win32.dll"
"C:\Temp\tn3"
"C:\WINDOWS\system32\drivers\core.sys"

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_CORE
-------\LEGACY_NTIO256
-------\core
-------\ntio256

((((((((((((((((((((((((((((((( Files Created from 2007-04-26 to 2007-05-26 ))))))))))))))))))))))))))))))))))

2007-05-26 15:57 d--------	C:\avenger
2007-05-26 15:47 d--------	C:\Rustbfix
2007-05-26 11:02 d--------	C:\DOCUME~1\James\APPLIC~1\Spyware Terminator
2007-05-26 11:02 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spyware Terminator
2007-05-26 11:01 d--------	C:\Program Files\Spyware Terminator
2007-05-26 10:23 d--------	C:\DOCUME~1\ALLUSE~1\APPLIC~1\ParetoLogic Anti-Spyware
2007-05-25 20:27 d--------	C:\Documents and Settings\James\.housecall6.6
2007-05-25 20:27 d--------	C:\DOCUME~1\James\.housecall6.6
2007-05-25 19:53 50,745	--a------	C:\WINDOWS\system32\wxyuftmx.dll
2007-05-25 15:36	1,024,158	---hs----	C:\WINDOWS\system32\oqstv.ini2
2007-05-25 15:34 d--------	C:\DOCUME~1\t\APPLIC~1\Teleca
2007-05-25 15:34 d--------	C:\DOCUME~1\t\APPLIC~1\Real
2007-05-25 15:29	1,048,576	--ah-----	C:\DOCUME~1\t\NTUSER.DAT
2007-05-25 14:53	263,220	---hs----	C:\WINDOWS\system32\vtsqo.dll
2007-05-25 14:50	557,741	--a------	C:\WINDOWS\system32\RegistryCleanerSetup.exe
2007-05-25 14:48	60,574	--a------	C:\WINDOWS\system32\xpdt.sys
2007-05-25 14:48	1,536	--a------	C:\djmggki.exe
2007-05-25 14:47	29,206	--a------	C:\WINDOWS\system32\byxyxvt.dll
2007-05-25 10:02 d--------	C:\Program Files\Elaborate Bytes
2007-05-22 22:34 d--------	C:\DOCUME~1\James\APPLIC~1\XnView
2007-05-21 18:51	17,801	--a------	C:\WINDOWS\system32\drivers\AegisP.sys
2007-05-21 18:50	94,208	--a------	C:\WINDOWS\system32\GTW32N50.dll
2007-05-21 18:50	40,960	--a------	C:\WINDOWS\system32\F5D7051.dll
2007-05-21 18:50	29,184	--a------	C:\WINDOWS\system32\drivers\RNDISMPK.sys
2007-05-21 18:50	15,872	--a------	C:\WINDOWS\system32\GTNDIS5.sys
2007-05-21 18:50	13,824	--a------	C:\WINDOWS\system32\drivers\usb8023k.sys
2007-05-21 18:50	1,396,831	--a------	C:\WINDOWS\system32\AegisE5.dll
2007-05-21 18:50 d--------	C:\Program Files\Belkin
2007-05-19 21:08	86,016	---------	C:\WINDOWS\system32\ElbyCDIO.dll
2007-05-19 15:36	34,308	--a------	C:\WINDOWS\system32\Chip.dll
2007-05-19 15:35 d--h-----	C:\WINDOWS\Mods
2007-05-18 14:44 d--------	C:\DOCUME~1\James\APPLIC~1\FrostWire
2007-05-18 14:40 d--------	C:\Program Files\FrostWire
2007-05-18 08:56 d--------	C:\Program Files\AVIConverter
2007-05-09 22:59 d--------	C:\Downloads
2007-05-09 22:58 d--------	C:\Program Files\BitComet
2007-05-09 22:20 d--------	C:\Program Files\blcorp
2007-05-09 22:20 d--------	C:\DOCUME~1\James\APPLIC~1\Business Logic
2007-05-09 21:40 d--------	C:\Program Files\AusLogics Disk Defrag
2007-05-09 21:14 d--------	C:\Program Files\SpeedFan
2007-05-09 21:06 d--------	C:\Program Files\CCleaner
2007-05-08 15:54 d--------	C:\Temp\TEMP62663
2007-04-27 17:41	4	--a------	C:\WINDOWS\jknradee.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-25 17:32:16	--------	d-----w	C:\Program Files\Microsoft ActiveSync
2007-05-25 12:01:13	--------	d-----w	C:\Program Files\SlySoft
2007-05-15 14:24:38	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\uTorrent
2007-05-09 21:59:30	2,560	----a-w	C:\WINDOWS\system32\BitCometRes.dll
2007-05-09 21:42:45	--------	d-----w	C:\Program Files\quicksnooker
2007-05-09 21:42:35	--------	d-----w	C:\Program Files\Cool Edit 96
2007-05-09 21:42:21	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\Azureus
2007-05-08 21:27:51	--------	d-----w	C:\Program Files\BELKIN USB Wireless Monitor
2007-05-08 14:15:08	--------	d-----w	C:\Program Files\Tales of Pirates Online
2007-05-01 14:21:12	--------	d-----w	C:\Program Files\Morpheus
2007-04-30 18:30:32	--------	d-----w	C:\Program Files\BearFlix
2007-04-30 18:30:11	--------	d-----w	C:\Program Files\BitTorrent
2007-04-30 15:46:10	745,600	----a-w	C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:41:55	85,952	----a-w	C:\WINDOWS\system32\drivers\aswmon.sys
2007-04-30 15:41:42	94,552	----a-w	C:\WINDOWS\system32\drivers\aswmon2.sys
2007-04-30 15:39:41	23,416	----a-w	C:\WINDOWS\system32\drivers\aswRdr.sys
2007-04-30 15:38:51	43,176	----a-w	C:\WINDOWS\system32\drivers\aswTdi.sys
2007-04-30 15:37:23	26,888	----a-w	C:\WINDOWS\system32\drivers\aavmker4.sys
2007-04-30 15:35:28	95,872	----a-w	C:\WINDOWS\system32\AVASTSS.scr
2007-04-27 17:21:26	11,211	----a-w	C:\WINDOWS\mozver.dat
2007-04-24 18:57:01	--------	d-----w	C:\Program Files\CitrixWire
2007-04-23 18:55:01	729,088	-c--a-w	C:\WINDOWS\iun6002.exe
2007-04-21 22:44:40	--------	d-----w	C:\Program Files\Mozilla Sunbird
2007-04-21 12:03:26	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\SlySoft
2007-04-21 11:44:36	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\ImgBurn
2007-04-21 10:15:48	--------	d-----w	C:\Program Files\ImgBurn
2007-04-18 16:12:23	2,854,400	----a-w	C:\WINDOWS\system32\msi.dll
2007-04-14 15:52:10	--------	d-----w	C:\Program Files\Plato Video To 3GP Converter
2007-04-14 15:36:42	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\CitrixWire
2007-04-13 15:58:58	--------	d--h--w	C:\Program Files\InstallShield Installation Information
2007-04-12 13:38:13	--------	d-----w	C:\Program Files\DivX
2007-04-11 17:29:11	--------	d-----w	C:\Program Files\PacificPoker
2007-04-09 14:01:11	--------	d-----w	C:\Program Files\MP3 Player Utilities 3.66
2007-04-08 20:06:22	--------	d-----w	C:\DOCUME~1\James\APPLIC~1\Video DVD Maker FREE
2007-04-08 08:36:06	--------	d-----w	C:\Program Files\DVD Shrink
2007-04-06 10:27:14	25,844	----a-w	C:\WINDOWS\system32\awvvu.exe
2007-04-06 10:22:14	8,425	----a-w	C:\WINDOWS\system32\ddcyywx.dll
2007-04-06 10:21:45	25,844	----a-w	C:\WINDOWS\system32\vtutt.exe
2007-04-06 10:16:42	8,425	----a-w	C:\WINDOWS\system32\geedaax.dll
2007-04-03 13:00:18	--------	d-----w	C:\Program Files\uTorrent
2007-03-27 07:55:23	200,704	----a-w	C:\WINDOWS\system32\ssldivx.dll
2007-03-27 07:55:23	1,044,480	----a-w	C:\WINDOWS\system32\libdivx.dll
2007-03-17 13:43:01	292,864	----a-w	C:\WINDOWS\system32\winsrv.dll
2007-03-09 13:40:31	655	----a-w	C:\WINDOWS\eReg.dat
2007-03-08 15:36:28	577,536	----a-w	C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28	40,960	----a-w	C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28	281,600	----a-w	C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48	1,843,584	----a-w	C:\WINDOWS\system32\win32k.sys
2006-04-27 09:24:24	2,945,024	--sha-r	C:\WINDOWS\system32\Smab.dll
2005-10-24 11:13:58	66,560	--sha-r	C:\WINDOWS\MOTA113.exe
2005-10-13 21:27:00	422,400	--sha-r	C:\WINDOWS\x2.64.exe
2005-10-07 19:14:52	308,224	--sha-r	C:\WINDOWS\system32\avisynth.dll
2005-07-14 11:31:20	27,648	-csha-r	C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 14:32:28	616,448	--sha-r	C:\WINDOWS\system32\cygwin1.dll
2005-06-21 21:37:42	45,568	--sha-r	C:\WINDOWS\system32\cygz.dll
2005-05-13 17:12:00	217,073	--sha-r	C:\WINDOWS\meta4.exe
2005-02-28 12:16:22	240,128	-csha-r	C:\WINDOWS\system32\x.264.exe
2004-01-25 00:00:00	70,656	--sha-r	C:\WINDOWS\system32\yv12vfw.dll
2004-01-25 00:00:00	70,656	--sha-r	C:\WINDOWS\system32\i420vfw.dll

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO_1.1.4.29.dll [2007-04-29 10:29]
{4B646AFB-9341-4330-8FD1-C32485AEE619}=C:\WINDOWS\system32\wxyuftmx.dll [2007-05-25 19:53]
{62D18F27-803B-4982-A48C-15D56770C72F}=C:\WINDOWS\system32\vtsqo.dll [2007-05-25 14:53]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{78BD2971-EB54-4EE9-95F2-F6321B16AC85}=C:\WINDOWS\SYSTEM32\byxyxvt.dll [2007-05-25 14:47]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-07-07 12:29]
{9394EDE7-C8B5-483E-8773-474BF36AF6E4}=C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll [2004-08-13 17:42]
{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}=C:\Program Files\MSN Apps\MSN Toolbar\MSN Toolbar\01.02.5000.1021\en-gb\msntb.dll [2006-01-17 17:04]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-24 08:20]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 20:42]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 16:42]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 18:17]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-03-10 15:39]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3"="C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [2006-04-16 13:13]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [2005-02-26 01:28]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE" [2005-01-04 11:50]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2007-04-11 18:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"SchedulingAgent"=C:\WINDOWS\system32\mstask.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoClose"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{78BD2971-EB54-4EE9-95F2-F6321B16AC85}"="C:\WINDOWS\SYSTEM32\byxyxvt.dll" [2007-05-25 14:47]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\byxyxvt]
byxyxvt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\iphump]
iphump.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtsqo]
C:\WINDOWS\system32\vtsqo.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\System32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
"NvMediaCenter"=RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"WinampAgent"=C:\Program Files\Winamp\winampa.exe
"nwiz"=nwiz.exe /install

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e5b3ca6-a3ba-11db-8cb9-0030bdaff000}]
Auto\command- infrom.exe
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL infrom.exe

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

backup-20070526-094312-355 
O11 - Options group: [INTERNATIONAL] International*

backup-20070526-094312-266 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

backup-20070526-094312-451 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

backup-20070526-094312-181 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

backup-20070526-094312-214 
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

backup-20070526-094312-674 
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.co.uk/0SEENGB/SAOS01
Contents of the 'Scheduled Tasks' folder
2007-05-26 09:24:10 C:\WINDOWS\tasks\Pareto UNS.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-26 17:30:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

********************************************************************

Completion time: 2007-05-26 17:41:20 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-05-26 17:41

--- E O F ---
(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\WinFlyer32.dll
C:\WINDOWS\system32\ophkbkkr.dll
C:\WINDOWS\system32\rlbcktgm.dll
C:\WINDOWS\system32\rkkbkhpo.ini
C:\WINDOWS\system32\oqstv.bak1
C:\WINDOWS\system32\oqstv.bak2
C:\WINDOWS\system32\oqstv.ini
C:\WINDOWS\system32\oqstv.ini2
C:\WINDOWS\system32\oqstv.tmp
C:\WINDOWS\system32\oqstv.bak1
C:\WINDOWS\system32\oqstv.bak2
C:\WINDOWS\system32\oqstv.ini
C:\WINDOWS\system32\oqstv.ini2
C:\WINDOWS\system32\oqstv.tmp

* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

"C:\WINDOWS\system32\1169736936.exe"
"C:\DOCUME~1\James\Desktop.\internet explorer.lnk"
"C:\WINDOWS\system32\win32.dll"
"C:\Temp\tn3"
"C:\WINDOWS\system32\drivers\core.sys"

((((((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_CORE
-------\LEGACY_NTIO256
-------\core
-------\ntio256

((((((((((((((((((((((((((((((( Files Created from 26/0-01-07 to 26/05/2007 ))))))))))))))))))))))))))))))))))


----------



## jimj2k (May 25, 2007)

wow, i've just noticed both "run" and task manager are back, yay! thankyou very much though any clues on how to get the shutdown button back. and do you know any way of telling if theres any of the virus still there? cheers


----------



## dvk01 (Dec 14, 2002)

run wpfind again and post it's log please


----------

