I have a virus/trojan/spyware or possibly all of the above.

GunJack · 2 December 2008 at 12:06AM

it would be a good idea...

Lemonade_Pockets · 2 December 2008 at 12:07AM

ComboFix 08-12-01.01 - Ben 2008-12-01 22:33:14.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.241 [GMT 0:00]
Running from: c:\documents and settings\Ben\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\program files\outlook
c:\windows\system32\bszip.dll
c:\windows\system32\install.exe
c:\windows\system32\liwoduki.dll
c:\windows\system32\taskkill.com
c:\windows\Tasks\hubsfaur.job

BITS: Possible infected sites

hxxp://childhe.com
.
((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2008-12-01 20:18 . 2008-12-01 20:18 <DIR> d

c:\program files\SUPERAntiSpyware
2008-12-01 20:18 . 2008-12-01 20:18 <DIR> d

c:\documents and settings\Ben\Application Data\SUPERAntiSpyware.com
2008-12-01 20:18 . 2008-12-01 20:18 <DIR> d

c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-01 20:07 . 2008-12-01 20:07 <DIR> d

c:\program files\Malwarebytes' Anti-Malware
2008-12-01 20:07 . 2008-12-01 20:07 <DIR> d

c:\documents and settings\Ben\Application Data\Malwarebytes
2008-12-01 20:07 . 2008-12-01 20:07 <DIR> d

c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-01 20:07 . 2008-10-22 16:27 38,496 --a

c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-01 20:07 . 2008-10-22 16:27 15,504 --a

c:\windows\system32\drivers\mbam.sys
2008-12-01 19:03 . 2008-12-01 19:11 <DIR> d

c:\program files\Spybot - Search & Destroy
2008-12-01 19:03 . 2008-12-01 20:38 <DIR> d

c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-27 23:32 . 2008-11-27 23:32 0 --a

C:\kxhvehm.exe
2008-11-27 23:31 . 2008-11-27 23:31 2 --a

C:\-130081253

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-05 23:54

d

w c:\documents and settings\Ben\Application Data\Skype
2008-12-01 22:37

d

w c:\documents and settings\All Users\Application Data\Kontiki
2008-12-01 20:17

d

w c:\program files\Common Files\Wise Installation Wizard
2008-12-01 18:35

d

w c:\documents and settings\Ben\Application Data\AVG7
2008-11-30 15:47

d

w c:\documents and settings\Family\Application Data\OpenOffice.org2
2008-11-30 15:47

d

w c:\documents and settings\Family\Application Data\AVG7
2008-11-12 17:42

d

w c:\documents and settings\Ben\Application Data\OpenOffice.org2
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-22 20:02

d

w c:\program files\Microsoft Silverlight
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2006-01-03 19495464]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\Monitor.exe" [2005-07-19 57344]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-04 68856]
"kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-06-10 3809280]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2006-01-26 180269]
"Motive SmartBridge"="c:\progra~1\BTBROA~1\Help\SMARTB~1\BTHelpNotifier.exe" [2005-06-22 417792]
"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520]
"EPSON Stylus C48 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_S4I091.EXE" [2005-05-16 99840]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"OM_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe" [2005-07-19 40960]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-04-27 282624]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-06-01 257088]
"AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-10-16 590848]
"4oD"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376]
"nwiz"="nwiz.exe" [2004-06-10 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]
"AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-02-26 219136]

c:\documents and settings\Family\Start Menu\Programs\Startup\
OpenOffice.org 2.0.lnk - c:\program files\OpenOffice.org 2.0\program\quickstart.exe [2005-12-14 61440]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Belkin Wireless USB Utility.lnk - c:\program files\Belkin\USB F5D7050\Wireless Utility\Belkinwcui.exe [2005-10-28 1404928]
Broadband Desktop Help.lnk - c:\program files\BT Broadband 2091\Help\bin\matcli.exe [2006-02-11 217088]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2006-04-14 241664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"!!5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!saswinlogon]
2008-07-23 15:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Coloreal Visual.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Coloreal Visual.lnk
backup=c:\windows\pss\Coloreal Visual.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a

2007-06-01 15:51 257088 c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--ah

2004-10-13 16:24 1694208 c:\program files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a

2004-06-10 13:52 3809280 c:\windows\system32\nvcpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a

2004-06-10 13:52 81920 c:\windows\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a

2007-04-27 08:41 282624 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Smapp]
--ah

2003-07-30 09:08 143360 c:\program files\Analog Devices\SoundMAX\SMTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--ah

2006-01-26 13:57 180269 c:\program files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"c:\\Program Files\\Kontiki\\KService.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\WINDOWS\\system32\\wuauclt.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 m5289;m5289;c:\windows\system32\DRIVERS\m5289.sys [2006-01-26 51840]
R0 uliagpkx;ULi AGP Bus Filter Driver;c:\windows\system32\DRIVERS\agpkx.sys [2006-01-26 44928]
R3 ULI5261;ULi Based Ethernet NT Driver;c:\windows\system32\DRIVERS\ULILAN.SYS [2006-01-26 28160]
S1 cffa4261;cffa4261;c:\windows\system32\drivers\cffa4261.sys []
.
Contents of the 'Scheduled Tasks' folder

2008-11-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-01-10 14:42]

2008-12-01 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20]

2008-02-26 c:\windows\Tasks\MP Scheduled Quick Scan.job
- c:\program files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe []

2008-12-01 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2007-09-26 08:53]
.
- - - - ORPHANS REMOVED - - - -

BHO-{f3172780-107f-43aa-8d94-6f0334769b81} - c:\windows\system32\wujeluhe.dll
HKLM-Run-wtRAMDAC - c:\windows\system32\wtRAMDAC.exe
HKLM-Run-lahevuboto - c:\windows\system32\yitefuko.dll
HKLM-Run-f83f1eb4 - c:\windows\system32\juposeno.dll
HKLM-Run-CPMfb0c2d28 - c:\windows\system32\kefuguhi.dll
Notify-efcARljH - efcARljH.dll

.

Supplementary Scan

.
FireFox -: Profile - c:\documents and settings\Ben\Application Data\Mozilla\Firefox\Profiles\rn39er6h.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.co.uk/
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 22:37:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.

DLLs Loaded Under Running Processes

- - - - - - - > 'winlogon.exe'(784)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.

Other Running Processes

.
c:\progra~1\Grisoft\AVG7\avgamsvr.exe
c:\progra~1\Grisoft\AVG7\avgupsvc.exe
c:\progra~1\Grisoft\AVG7\avgemc.exe
c:\program files\Kontiki\KService.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Analog Devices\SoundMAX\SMAgent.exe
c:\program files\Grisoft\AVG7\avgcc.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\BT Broadband 2091\Help\bin\mpbtn.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2008-12-01 22:39:32 - machine was rebooted [Ben]
ComboFix-quarantined-files.txt 2008-12-01 22:39:29

Pre-Run: 9,567,465,472 bytes free
Post-Run: 10,724,306,944 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

193 --- E O F --- 2008-11-12 23:24:58

Browntoa · 2 December 2008 at 9:20AM

can you see these still ??

2008-11-27 23:32 . 2008-11-27 23:32 0 --a

C:\kxhvehm.exe
2008-11-27 23:31 . 2008-11-27 23:31 2 --a

C:\-130081253

Lemonade_Pockets · 2 December 2008 at 12:16PM

Browntoa wrote: »

can you see these still ??

2008-11-27 23:32 . 2008-11-27 23:32 0 --a
C:\kxhvehm.exe
2008-11-27 23:31 . 2008-11-27 23:31 2 --a
C:\-130081253

Sorry to be stupid, i see that these are in my log.
Do i need to re-run something to get a new log???

Lemonade_Pockets · 2 December 2008 at 5:39PM

Hi just run the programme again and it produced a new log. The entries you mentioned seemed to have gone (See Below). Is there anything else i need to check. And would you consider it safe to resume using things like internet banking etc?

Lemonade_Pockets · 2 December 2008 at 5:40PM

ComboFix 08-12-01.01 - Ben 2008-12-02 16:31:21.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.195 [GMT 0:00]
Running from: c:\documents and settings\Ben\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2008-11-02 to 2008-12-02 )))))))))))))))))))))))))))))))
.

2008-12-01 20:18 . 2008-12-01 20:18 <DIR> d