11 replies to this topic

[havoc]

Not sure what happened to my other post.. But i just re ran malwarebytes again and this is the new log.. went from the few in my last post to a multiple amount of virus's along with xp delux protector popped up.. I havent' downloaded anything new since reinstalling window's not sure where they are coming from..Anyway here is the new log thanks for any help


Malwarebytes' Anti-Malware 1.38
Database version: 2374
Windows 5.1.2600 Service Pack 2

7/5/2009 10:48:54 PM
mbam-log-2009-07-05 (22-48-54).txt

Scan type: Quick Scan
Objects scanned: 88306
Time elapsed: 4 minute(s), 16 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 4
Registry Keys Infected: 16
Registry Values Infected: 10
Registry Data Items Infected: 4
Folders Infected: 0
Files Infected: 30

Memory Processes Infected:
c:\WINDOWS\pp10.exe (Worm.Koobface) -> Unloaded process successfully.
c:\WINDOWS\ld12.exe (Worm.KoobFace) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\mkfght1.dll (Spyware.OnlineGames) -> Delete on reboot.
c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\gdi32lib.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\afmain4.dll (Spyware.OnlineGames) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drv (Rootkit.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{b360243e-09e8-402f-8721-00b6798089ad} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{4b66e1df-4de3-4cda-83b5-11673eadab0b} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{9692be2f-eb8f-49d9-a11c-c24c1ef734d5} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3113c6d7-d1bf-4096-94fe-5df265ac881d} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\XP Deluxe Protector (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vmwareapp.vmware (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\vmwareapp.vmware.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\drvdrv (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRVDRV (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_DRV (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pp (Worm.Koobface) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ertyuop (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{bb4c402f-882a-4526-8c08-51278ea437c1} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kava (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cdoosoft (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\scui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\don't load\wscui.cpl (Hijack.SecurityCenter) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xpprotect (Rogue.DeluxeProtector) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost\drv (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gdi32lib.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\mkfght1.dll (Spyware.OnlineGames) -> Delete on reboot.
c:\WINDOWS\pp10.exe (Worm.Koobface) -> Quarantined and deleted successfully.
c:\program files\drv\drv.dll (Rootkit.Agent) -> Delete on reboot.
C:\WINDOWS\system32\rttrwq.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\afmain4.dll (Spyware.OnlineGames) -> Delete on reboot.
c:\WINDOWS\system32\mkfght0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\autorun.inf (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\il0byu3h.com (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\Temp\32n1.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\Temp\32n2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\Temp\32n3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\DHBGV97V\zz[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\OW9GU7XN\pdrv[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\P3ZIMJQV\pp.10[1].exe (Worm.Koobface) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\local settings\temporary internet files\Content.IE5\Q9E4SS2Z\gdi32lib[1].dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kavo0.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kavo.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\WINDOWS\ld12.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\Documents and Settings\Brian\Local Settings\Temp\olhrwef.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\afmain0.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\afmain1.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\afmain2.dll (Trojan.Agent) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\afmain3.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\AhnRpta.exe (Trojan.Backdoor) -> Quarantined and deleted successfully.
c:\documents and settings\Brian\Start Menu\XP Deluxe Protector.LNK (Rogue.DeluxeProtector) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\e8main0.dll (Worm.Autorun) -> Quarantined and deleted successfully.
C:\WINDOWS\010112010146118114.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
c:\WINDOWS\0101120101464849.dat (Worm.KoobFace) -> Quarantined and deleted successfully.
C:\Program Files\drv\drv.sys (Trojan.Agent) -> Quarantined and deleted successfully.

[AdvancedSetup]

You need to bookmark where you post so you can come back, or subscribe to the post. Anyway, I'll delete your other post.
The scan shows stuff is coming from the Internet cache so it is from some site you're visiting.


[indent]Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.
NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.
Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the program

Additional links to download the tool:
ComboFix.exe
ComboFix.exe
ComboFix.exe


Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
• Click Yes to allow ComboFix to continue scanning for malware.
  
• When the tool is finished, it will produce a report for you.
  
• Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

[/indent]

[havoc]

Ya i was sure i know the site that the xp defender thing or w/e it was came from because i got a pop up for it and it never went away even after i restarted my computer. You said get aviera or w/e it was called? I have no anti virus installed yet. I used to use that free avg just not sure which was better before i reinstall this time... here's my combo log




ComboFix 09-07-05.01 - Brian 07/05/2009 23:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.780 [GMT -4:00]
Running from: c:\documents and settings\Brian\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\86l2qw.bat
c:\windows\system32\e1000msg.dll
c:\windows\system32\winlogonbackup.exe.exe
C:\x.bat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_AVPsys


((((((((((((((((((((((((( Files Created from 2009-06-06 to 2009-07-06 )))))))))))))))))))))))))))))))
.

2009-07-06 02:41 . 2009-07-06 02:53 -------- d-----w- c:\program files\drv
2009-07-05 20:35 . 2004-10-15 23:18 502272 ----a-w- c:\windows\system32\winlogon.exe
2009-07-05 20:32 . 2004-10-15 23:18 502272 ----a-w- c:\windows\system32\dllcache\winlogon.exe
2009-07-05 04:57 . 2009-07-05 04:57 -------- d-s---w- c:\documents and settings\Brian\UserData
2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\documents and settings\Brian\Application Data\Aim
2009-07-05 04:56 . 2009-07-05 21:24 -------- d-----w- c:\program files\Viewpoint
2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\program files\AOD
2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-07-05 04:56 . 2004-02-25 17:05 348160 ----a-w- c:\windows\system32\msvcr71.dll
2009-07-05 04:56 . 2009-07-05 04:56 -------- d-----w- c:\program files\AIM
2009-07-05 04:32 . 2009-07-05 04:32 -------- d--h--w- c:\windows\system32\GroupPolicy
2009-07-05 04:30 . 2009-07-05 04:30 107299 --sh--r- C:\xerp8nj.exe
2009-07-05 04:29 . 2009-07-05 04:29 410976 ----a-w- c:\windows\system32\deploytk.dll
2009-07-05 04:29 . 2009-07-05 04:29 -------- d-----w- c:\program files\Java
2009-07-05 04:28 . 2009-07-05 04:28 152576 ----a-w- c:\documents and settings\Brian\Application Data\Sun\Java\jre1.6.0_10\lzma.dll
2009-07-04 23:56 . 2004-05-26 21:54 15781 ----a-w- c:\windows\system32\drivers\mdc8021x.sys
2009-07-04 23:56 . 2005-02-02 01:18 17992 ----a-w- c:\windows\system32\bcm42rly.sys
2009-07-04 23:56 . 2003-11-21 05:03 651264 ----a-w- c:\windows\system32\libeay32.dll
2009-07-04 23:56 . 2003-11-21 05:03 147456 ----a-w- c:\windows\system32\ssleay32.dll
2009-07-04 23:56 . 2003-11-21 05:03 479232 ----a-w- c:\windows\system32\AegisE5.dll
2009-07-04 23:56 . 2003-10-13 22:30 94208 ----a-w- c:\windows\system32\GTW32N50.dll
2009-07-04 23:56 . 2003-09-26 05:15 15872 ----a-w- c:\windows\system32\GTNDIS5.sys
2009-07-04 23:56 . 2009-07-04 23:56 -------- d-----w- c:\program files\Linksys Wireless-G USB Wireless Network Monitor
2009-07-04 23:55 . 2009-07-04 23:55 -------- d-----w- C:\Linksys Driver
2009-07-04 23:52 . 2003-08-29 17:26 125952 ----a-w- c:\windows\system32\drivers\e1000325.sys
2009-07-04 23:52 . 2003-07-28 13:55 24064 ----a-w- c:\windows\system32\IntelNic.dll
2009-07-04 23:52 . 2003-03-03 23:26 118784 ----a-w- c:\windows\system32\Prounstl.exe
2009-07-04 23:51 . 2009-07-04 23:51 -------- d-----w- c:\program files\Intel
2009-07-04 23:49 . 2009-07-04 23:56 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-04 23:49 . 2009-07-04 23:49 -------- d-----w- c:\program files\Realtek
2009-07-04 23:49 . 2004-07-29 23:31 8845312 ------w- c:\windows\RTLCPL.exe
2009-07-04 23:49 . 2004-07-29 20:04 2216128 ------w- c:\windows\system32\drivers\RtkHDAud.Sys
2009-07-04 23:49 . 2004-07-29 01:34 2551808 ------w- c:\windows\alcwzrd.exe
2009-07-04 23:49 . 2004-07-29 00:40 77824 ------w- c:\windows\SoundMan.exe
2009-07-04 23:49 . 2004-06-29 01:50 192512 ------w- c:\windows\system32\RTCOMDLL.dll
2009-07-04 23:49 . 2004-02-27 17:10 156160 ------w- c:\windows\system32\RtlCPAPI.dll
2009-07-04 23:49 . 2009-07-04 23:49 -------- d-----w- c:\program files\Common Files\InstallShield
2009-07-04 23:49 . 2009-07-05 20:34 -------- d-----w- c:\windows\system32\DllCache
2009-07-04 21:53 . 2009-07-04 21:53 -------- d-----w- c:\documents and settings\Brian\Local Settings\Application Data\Yahoo
2009-07-04 21:53 . 2009-07-04 21:53 13104 ----a-w- c:\documents and settings\Brian\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-07-04 21:48 . 2009-07-04 21:48 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-07-04 21:47 . 2009-07-04 21:47 -------- d-----w- c:\program files\Common Files\Adobe
2009-07-04 21:43 . 2009-07-04 21:53 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-07-04 21:43 . 2009-05-27 02:50 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-07-04 21:43 . 2009-07-04 21:43 -------- d-----w- c:\program files\Yahoo!
2009-07-04 21:28 . 2005-12-18 17:30 6400 ----a-w- c:\windows\system32\drivers\splitter.sys
2009-07-04 21:28 . 2005-12-18 17:30 82944 ----a-w- c:\windows\system32\drivers\wdmaud.sys
2009-07-04 21:28 . 2005-12-18 17:30 52864 ----a-w- c:\windows\system32\drivers\DMusic.sys
2009-07-04 21:28 . 2005-12-18 17:30 54272 ----a-w- c:\windows\system32\drivers\swmidi.sys
2009-07-04 21:28 . 2005-12-18 17:30 142464 ----a-w- c:\windows\system32\drivers\aec.sys
2009-07-04 21:28 . 2005-12-18 17:30 171776 ----a-w- c:\windows\system32\drivers\kmixer.sys
2009-07-04 21:28 . 2005-12-18 17:30 2944 ----a-w- c:\windows\system32\drivers\drmkaud.sys
2009-07-04 21:28 . 2005-12-18 17:30 60800 ----a-w- c:\windows\system32\drivers\sysaudio.sys
2009-07-04 21:28 . 2005-12-18 17:30 7552 ----a-w- c:\windows\system32\drivers\MSKSSRV.sys
2009-07-04 21:28 . 2005-12-18 17:30 4992 ----a-w- c:\windows\system32\drivers\MSPQM.sys
2009-07-04 21:27 . 2005-12-18 17:30 5376 ----a-w- c:\windows\system32\drivers\MSPCLOCK.sys
2009-07-04 21:27 . 2005-12-18 17:30 4096 ----a-w- c:\windows\system32\ksuser.dll
2009-07-04 21:27 . 2005-12-18 17:30 60288 ----a-w- c:\windows\system32\drivers\drmk.sys
2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\documents and settings\Brian\Application Data\Malwarebytes
2009-07-04 21:23 . 2009-06-17 18:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-07-04 21:23 . 2009-07-04 21:23 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-04 21:23 . 2009-06-17 18:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-05 00:00 . 2009-07-04 12:53 86811 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-07-04 23:54 . 2009-07-04 23:53 -------- d-----w- c:\program files\ATI Technologies
2009-07-04 12:50 . 2009-07-04 12:50 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-07-04 12:49 . 2009-07-04 12:49 -------- d-----w- c:\program files\Windows Plus
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="c:\windows\ehome\ehtray.exe" [2004-08-10 59392]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-09-29 344064]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-05 136600]
"High Definition Audio Property Page Shortcut"="HDAudPropShortcut.exe" - c:\windows\system32\Hdaudpropshortcut.exe [2004-03-17 61952]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM\\aim.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8085:TCP"= 8085:TCP:drv

R2 WUSB54GSSVC;WUSB54GSSVC;c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe [7/4/2009 7:56 PM 41025]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.altavista.com/
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-05 23:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\netdde.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54GS.exe
c:\windows\system32\dllhost.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-07-06 23:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-07-06 03:09

Pre-Run: 27,535,749,120 bytes free
Post-Run: 27,704,389,632 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

150

[AdvancedSetup]

I would reocmmend Avira over AVG myself.
You need to install Anti-Virus A.S.A.P. :Avira AntiVir FREE

Then update it and do a FULL SYSTEM scan

[havoc]

AdvancedSetup, on Jul 5 2009, 11:56 PM, said:

I would reocmmend Avira over AVG myself.
You need to install Anti-Virus A.S.A.P. :Avira AntiVir FREE

Then update it and do a FULL SYSTEM scan

Ok downloading that now.. and did combofix everythign or you want another log after i do a full system scan with this program?

[havoc]

downloaded that and ran a scan and got a lot more off of it.... here's the log






Avira AntiVir Personal
Report file date: Monday, July 06, 2009 00:12

Scanning for 1448372 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 2) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : TONY-1602904BF7

Version information:
BUILD.DAT : 9.0.0.403 17961 Bytes 6/3/2009 17:05:00
AVSCAN.EXE : 9.0.3.6 466689 Bytes 5/11/2009 14:14:47
AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 15:58:24
LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 16:35:49
LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 15:58:52
ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36
ANTIVIR1.VDF : 7.1.4.132 5707264 Bytes 6/24/2009 04:08:53
ANTIVIR2.VDF : 7.1.4.173 306688 Bytes 7/2/2009 04:08:55
ANTIVIR3.VDF : 7.1.4.182 52224 Bytes 7/5/2009 04:08:56
Engineversion : 8.2.0.204
AEVDF.DLL : 8.1.1.1 106868 Bytes 4/30/2009 16:52:04
AESCRIPT.DLL : 8.1.2.13 426362 Bytes 7/6/2009 04:09:11
AESCN.DLL : 8.1.2.3 127347 Bytes 5/14/2009 16:02:01
AERDL.DLL : 8.1.2.2 438642 Bytes 7/6/2009 04:09:09
AEPACK.DLL : 8.1.3.18 401783 Bytes 5/27/2009 21:07:20
AEOFFICE.DLL : 8.1.0.38 196987 Bytes 7/6/2009 04:09:06
AEHEUR.DLL : 8.1.0.137 1823095 Bytes 7/6/2009 04:09:05
AEHELP.DLL : 8.1.3.6 205174 Bytes 7/6/2009 04:08:59
AEGEN.DLL : 8.1.1.48 348532 Bytes 7/6/2009 04:08:57
AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 19:32:40
AECORE.DLL : 8.1.6.12 180599 Bytes 5/27/2009 21:07:20
AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 19:32:40
AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 13:47:59
AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 15:32:15
AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 19:34:28
AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 15:32:09
AVARKT.DLL : 9.0.0.3 292609 Bytes 3/24/2009 20:05:41
AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 15:37:08
SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 20:03:49
SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 13:21:33
NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 15:32:10
RCIMAGE.DLL : 9.0.0.25 2438913 Bytes 5/15/2009 20:39:58
RCTEXT.DLL : 9.0.37.0 86785 Bytes 4/17/2009 15:19:48

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:,
Process scan........................: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium

Start of the scan: Monday, July 06, 2009 00:12

Starting search for hidden objects.
'19925' objects were checked, '0' hidden objects were found.

The scan of running processes will be started
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'msiexec.exe' - '1' Module(s) have been scanned
Scan process 'YahooMessenger.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'yupdater.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'ehmsas.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'WUSB54GS.exe' - '1' Module(s) have been scanned
Scan process 'WLService.exe' - '1' Module(s) have been scanned
Scan process 'jqs.exe' - '1' Module(s) have been scanned
Scan process 'ehSched.exe' - '1' Module(s) have been scanned
Scan process 'ehRecvr.exe' - '1' Module(s) have been scanned
Scan process 'netdde.exe' - '1' Module(s) have been scanned
Scan process 'jusched.exe' - '1' Module(s) have been scanned
Scan process 'atiptaxx.exe' - '1' Module(s) have been scanned
Scan process 'ehtray.exe' - '1' Module(s) have been scanned
Scan process 'explorer.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned
35 processes with 35 modules were scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!
Master boot sector HD1
[INFO] No virus was found!
Master boot sector HD2
[INFO] No virus was found!
Master boot sector HD3
[INFO] No virus was found!
Master boot sector HD4
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '52' files ).


Starting the file scan:

Begin scan in 'C:\'
C:\pagefile.sys
[WARNING] The file could not be opened!
[NOTE] This file is a Windows system file.
[NOTE] This file cannot be opened for scanning.
C:\xerp8nj.exe
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\Documents and Settings\Brian\Desktop\ComboFix.exe
[0] Archive type: RAR SFX (self extracting)
--> 32788R22FWJFW\n.pif
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)
C:\Qoobox\Quarantine\C\86l2qw.bat.vir
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\Qoobox\Quarantine\C\x.bat.vir
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000302.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000303.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000313.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000319.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000323.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000342.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000350.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000357.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000363.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000376.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000379.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000381.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000402.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000404.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000405.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000406.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000414.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000417.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000419.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000431.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000434.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000435.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000436.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000442.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000443.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000444.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000461.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000469.exe
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000470.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000473.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000475.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000485.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000491.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000492.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000493.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000494.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000514.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000519.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000520.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001540.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001545.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001547.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001565.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001570.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001572.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001578.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001583.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001584.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001585.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001586.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001587.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001602.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001603.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001604.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001605.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001606.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001607.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001608.exe
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001609.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001616.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001617.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001618.dll
[DETECTION] Is the TR/Trash.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001646.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001649.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001707.pif
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)

Beginning disinfection:
C:\xerp8nj.exe
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '4ac37b38.qua'!
C:\Documents and Settings\Brian\Desktop\ComboFix.exe
[NOTE] The file was moved to '4abe7b42.qua'!
C:\Qoobox\Quarantine\C\86l2qw.bat.vir
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '4abd7b09.qua'!
C:\Qoobox\Quarantine\C\x.bat.vir
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4ab37b01.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000302.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was moved to '4a817b03.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000303.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4beba134.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000313.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was moved to '4be7c014.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP2\A0000319.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49c5a674.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000323.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49c49e3c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000342.dll
[DETECTION] Is the TR/Vundo.Gen Trojan
[NOTE] The file was moved to '49c79604.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000350.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49c68fcc.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000357.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49c98794.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000363.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49cb7f5c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP3\A0000376.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49ca7724.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000379.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4bea9afc.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000381.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49cd68ec.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000402.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49cc60b4.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000404.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49cf587c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000405.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
[NOTE] The file was moved to '49ce5044.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000406.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49d1480c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000414.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49d041d4.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000417.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49d3399c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000419.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49d23164.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000431.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49d5292c.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000434.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49d422f4.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000435.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
[NOTE] The file was moved to '49d71abc.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP4\A0000436.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49d61284.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000442.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '4a817b04.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000443.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
[NOTE] The file was moved to '49d80215.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000444.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49dbfbdd.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000461.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49daf3a5.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000469.exe
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49ddeb6d.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000470.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49dce335.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000473.dll
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49dfe4fd.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000475.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49dedcc5.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000485.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '4a817b05.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000491.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49e0cc56.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000492.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
[NOTE] The file was moved to '49e3c41e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000493.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e2bde6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000494.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e5b5ae.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000514.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49e4ad76.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000519.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49e7a53e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0000520.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e69d06.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001540.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49e996ce.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001545.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49e88e96.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001547.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49eb865e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001565.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49ed7e26.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001570.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49ec77ee.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001572.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49ef6fb6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001578.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49ee677e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001583.com
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49f15f46.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001584.inf
[DETECTION] Contains recognition pattern of the INF/AutoRun.7236 INF virus
[NOTE] The file was moved to '49f0570e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001585.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '49f348d6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001586.exe
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '49f2409e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001587.dll
[DETECTION] Is the TR/Crypt.ZPACK.Gen Trojan
[NOTE] The file was moved to '49f53866.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001602.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49f4302e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001603.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49f729f6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001604.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49f621be.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001605.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49f91986.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001606.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49f8114e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001607.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49fb0916.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001608.exe
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49fa02de.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001609.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49fdfaa6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001616.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49fcf26e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001617.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49ffea36.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001618.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to '49fee3fe.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001646.bat
[DETECTION] Is the TR/Drop.Agent.ahdz Trojan
[NOTE] The file was moved to '4901dbc6.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001649.bat
[DETECTION] Is the TR/Crypt.XPACK.Gen Trojan
[NOTE] The file was moved to '4900d38e.qua'!
C:\System Volume Information\_restore{8EC8CF5E-2907-45EE-950C-1B6722131CAA}\RP5\A0001707.pif
[DETECTION] The file contains an executable program that is disguised by a harmless file extension (HIDDENEXT/Crypted)
[NOTE] The file was moved to '4905a1e6.qua'!


End of the scan: Monday, July 06, 2009 00:17
Used time: 04:32 Minute(s)

The scan has been done completely.

1642 Scanned directories
66743 Files were scanned
69 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
69 Files were moved to quarantine
0 Files were renamed
1 Files cannot be scanned
66673 Files not concerned
556 Archives were scanned
1 Warnings
70 Notes
19925 Objects were scanned with rootkit scan
0 Hidden objects were found

[AdvancedSetup]

You can remove Combofix. Click on START - RUN and type in COMBOFIX /U and allow it to remove.

[havoc]

ok.. what about the other virus's that it found? should the last 2 scan's combo fix and the avira fix everythign? or do i need to do anything else

[havoc]

Tried that combo fix remove thing didnt work

[havoc]

disregard that its not on my system anymore sorry lol

[AdvancedSetup]

You should be fine now. Just stop and restart your System Restore now and keep your Anti-Virus up to date daily and do scans periodically with it and Malwarebytes.

[AdvancedSetup]

I'll close your post so that other don't post into it and leave you with this information and suggestions.

So how did I get infected in the first place?


[indent]At this time your system appears to be clean. Nothing else in the logs indicates that you are still infected.
Now that you appear to be clean, please follow these simple steps in order to keep your computer clean and secure:

Remove all but the most recent Restore Point on Windows XP

[indent]You should Create a New Restore Point to prevent possible reinfection from an old one.
Some of the malware you picked up could have been saved in System Restore.
Since this is a protected directory your tools cannot access to delete these files, they sometimes can reinfect your system if you accidentally use an old restore point.
Setting a new restore point AFTER cleaning your system will help prevent this and enable your computer to "roll-back" to a clean working state.

The easiest and safest way to do this is:

• Go to Start > Programs > Accessories > System Tools and click "System Restore".
  
• If the shortcut is missing you can also click on START > RUN > and type in %SystemRoot%\system32\restore\rstrui.exe and click OK
  
• Choose the radio button marked "Create a Restore Point" on the first screen then click "Next".
  
• Give the new Restore Point a name, then click "Create".
  
• The new point will be stamped with the current date and time. Keep a log of this so you can find it easily should you need to use System Restore.

• Then use the Disk Cleanup to remove all but the most recently created Restore Point.
  
• Go to Start > Run and type: Cleanmgr.exe
  
• Select the drive where Windows is installed and click "Ok". Disk Cleanup will scan your files for several minutes, then open.
  
• Click the "More Options" tab, then click the "Clean up" button under System Restore.
  
• Click Ok. You will be prompted with "Are you sure you want to delete all but the most recent restore point?"
  
• Click Yes, then click Ok.
  
• Click Yes again when prompted with "Are you sure you want to perform these actions?"
  
• Disk Cleanup will remove the files and close automatically.
  
• On the Disk Cleanup tab, if the System Restore: Obsolete Data Stores entry is available remove them also.
  
• These are files that were created before Windows was reformatted or reinstalled. They are obsolete and you can delete them.

[indent] [/indent]

Additional information
Microsoft KB article: How to turn off and turn on System Restore in Windows XP
Bert Kinney's site: All about Windows System Restore[/indent]

Here are some free programs I recommend that could help you improve your computer's security.

Install SpyWare Blaster
Download it from here
Find here the tutorial on how to use Spyware Blaster here

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install FireTrust SiteHound
You can find information and download it from here

Install hpHosts
Download it from here
hpHosts is a community managed and maintained hosts file that allows an additional layer of protection against access to ad,
tracking and malicious websites. This prevents your computer from connecting to these untrusted sites
by redirecting them to 127.0.0.1 which is your own local computer.
hpHosts Support Forum

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com
Note 1: If you are running Windows XP SP2, you should upgrade to SP3.
Note 2: Users of Norton Internet Security 2008 should uninstall the software before they install Service Pack 3.
The security suite can then be reinstalled afterwards.

The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
I recommend Online Armor Free

A little outdated but good reading on how to prevent Malware

Keep safe online and happy surfing.



Since this issue is resolved I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.

The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructions


Also don't forget that we offer FREE assistance with General PC questions and repair here PC Help
If you're pleased with the product Malwarebytes and the service provided you, please let your friends, family, and co-workers know. http://www.malwarebytes.org[/indent]