We’d like to remind Forumites to please avoid political debate on the Forum.
This is to keep it a safe and useful space for MoneySaving discussions. Threads that are – or become – political in nature may be removed in line with the Forum’s rules. Thank you for your understanding.
📨 Have you signed up to the Forum's new Email Digest yet? Get a selection of trending threads sent straight to your inbox daily, weekly or monthly!
The Forum now has a brand new text editor, adding a bunch of handy features to use when creating posts. Read more in our how-to guide
Delicate situation
Comments
-
Open notepad and copy/paste the text in RED below
File::
c:\windows\system32\drivers\senekadjqviovh.sys
c:\windows\system32\drivers\senekatykvvkmn.sys
c:\windows\system32\drivers\senekawfgtwnyx.sys
c:\windows\system32\drivers\senekaijnfthfq.sys
c:\windows\system32\drivers\senekaavymxehh.sys
c:\windows\system32\drivers\senekaooedbmrr.sys
c:\windows\system32\drivers\senekawoumvqrd.sys
c:\windows\system32\senekantjkvdks.dll
c:\windows\system32\senekababwuxbc.dat
c:\windows\system32\senekamqsioror.dll
c:\windows\system32\senekaiqhwqwho.dll
c:\windows\system32\senekarbpxuiqa.dat
c:\windows\system32\senekamlrrnusb.dll
c:\windows\system32\senekartqipfti.dat
c:\windows\system32\senekaqxeiseec.dll
c:\windows\system32\senekakfpyrbqy.dll
c:\windows\system32\senekanojuwpib.dat
c:\windows\system32\senekaadgixldo.dat
c:\windows\system32\senekaduxvnwte.dll
c:\windows\system32\senekaxtuicxjk.dll
c:\windows\system32\senekanyrbvpwi.dat
c:\windows\system32\senekahfgtbdjb.dll
c:\windows\system32\senekavxeixexy.dll
c:\windows\system32\senekalqitnxnw.dll
c:\windows\system32\senekagwwykmov.dat
c:\windows\system32\senekamyfyeppa.dat
c:\windows\system32\senekallssvpie.dll
c:\windows\system32\senekalnstnqqh.dll
c:\windows\system32\senekaoibpxmtb.dll
c:\windows\system32\senekayqgwbitu.dll
c:\windows\system32\senekawuyueteg.dat
c:\windows\system32\senekantixriba.dll
c:\windows\system32\senekapqqomkbp.dll
c:\windows\system32\senekasirmwowu.dll
c:\windows\system32\senekayqrxuiqo.dll
c:\windows\system32\tibepozi.exe
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
Then reboot and run a FRESH hijack log
Then run a KASPERSKY ONLINE SCAN (click to scan 'MY COMPUTER')
http://www.kaspersky.co.uk/kos_trialpay_offer:idea:0 -
ComboFix 09-04-13.A2 - andy 2009-04-15 20:10.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.502.243 [GMT 1:00]
Running from: c:\documents and settings\TEMP\My Documents\QWERTY.EXE
Command switches used :: c:\documents and settings\andy.ANDY-491HIJ81VU.000\Desktop\CFScript.txt
AV: AntiVir Desktop *On-access scanning disabled* (Outdated)
FILE ::
c:\windows\system32\drivers\senekaavymxehh.sys
c:\windows\system32\drivers\senekadjqviovh.sys
c:\windows\system32\drivers\senekaijnfthfq.sys
c:\windows\system32\drivers\senekaooedbmrr.sys
c:\windows\system32\drivers\senekatykvvkmn.sys
c:\windows\system32\drivers\senekawfgtwnyx.sys
c:\windows\system32\drivers\senekawoumvqrd.sys
c:\windows\system32\senekaadgixldo.dat
c:\windows\system32\senekababwuxbc.dat
c:\windows\system32\senekaduxvnwte.dll
c:\windows\system32\senekagwwykmov.dat
c:\windows\system32\senekahfgtbdjb.dll
c:\windows\system32\senekaiqhwqwho.dll
c:\windows\system32\senekakfpyrbqy.dll
c:\windows\system32\senekallssvpie.dll
c:\windows\system32\senekalnstnqqh.dll
c:\windows\system32\senekalqitnxnw.dll
c:\windows\system32\senekamlrrnusb.dll
c:\windows\system32\senekamqsioror.dll
c:\windows\system32\senekamyfyeppa.dat
c:\windows\system32\senekanojuwpib.dat
c:\windows\system32\senekantixriba.dll
c:\windows\system32\senekantjkvdks.dll
c:\windows\system32\senekanyrbvpwi.dat
c:\windows\system32\senekaoibpxmtb.dll
c:\windows\system32\senekapqqomkbp.dll
c:\windows\system32\senekaqxeiseec.dll
c:\windows\system32\senekarbpxuiqa.dat
c:\windows\system32\senekartqipfti.dat
c:\windows\system32\senekasirmwowu.dll
c:\windows\system32\senekavxeixexy.dll
c:\windows\system32\senekawuyueteg.dat
c:\windows\system32\senekaxtuicxjk.dll
c:\windows\system32\senekayqgwbitu.dll
c:\windows\system32\senekayqrxuiqo.dll
c:\windows\system32\tibepozi.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\drivers\senekaavymxehh.sys
c:\windows\system32\drivers\senekadjqviovh.sys
c:\windows\system32\drivers\senekaijnfthfq.sys
c:\windows\system32\drivers\senekaooedbmrr.sys
c:\windows\system32\drivers\senekatykvvkmn.sys
c:\windows\system32\drivers\senekawfgtwnyx.sys
c:\windows\system32\drivers\senekawoumvqrd.sys
c:\windows\system32\senekaadgixldo.dat
c:\windows\system32\senekaaqyotptd.dll
c:\windows\system32\senekababwuxbc.dat
c:\windows\system32\senekaduxvnwte.dll
c:\windows\system32\senekagwwykmov.dat
c:\windows\system32\senekahfgtbdjb.dll
c:\windows\system32\senekaiqhwqwho.dll
c:\windows\system32\senekakfpyrbqy.dll
c:\windows\system32\senekallssvpie.dll
c:\windows\system32\senekalnstnqqh.dll
c:\windows\system32\senekalqitnxnw.dll
c:\windows\system32\senekamlrrnusb.dll
c:\windows\system32\senekamqsioror.dll
c:\windows\system32\senekamtvscvns.dll
c:\windows\system32\senekamyfyeppa.dat
c:\windows\system32\senekanojuwpib.dat
c:\windows\system32\senekantixriba.dll
c:\windows\system32\senekantjkvdks.dll
c:\windows\system32\senekanyrbvpwi.dat
c:\windows\system32\senekaoibpxmtb.dll
c:\windows\system32\senekapqqomkbp.dll
c:\windows\system32\senekaqhwbuwip.dll
c:\windows\system32\senekaqjlbauij.dll
c:\windows\system32\senekaqxeiseec.dll
c:\windows\system32\senekarbpxuiqa.dat
c:\windows\system32\senekarqrscpxr.db
c:\windows\system32\senekartqipfti.dat
c:\windows\system32\senekasirmwowu.dll
c:\windows\system32\senekasownycns.dat
c:\windows\system32\senekavxeixexy.dll
c:\windows\system32\senekawuyueteg.dat
c:\windows\system32\senekaxryyftci.dat
c:\windows\system32\senekaxtuicxjk.dll
c:\windows\system32\senekayqgwbitu.dll
c:\windows\system32\senekayqrxuiqo.dll
c:\windows\system32\tibepozi.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
\Service_SENEKA
\Service_SENEKA
((((((((((((((((((((((((( Files Created from 2009-03-15 to 2009-04-15 )))))))))))))))))))))))))))))))
.
2009-04-15 19:20 . 2009-04-15 19:20
d-sh--w C:\FOUND.006
2009-04-15 19:14 . 2009-04-15 19:14 1444 ----a-w c:\windows\system32\senekaydcqkcwp.dat
2009-04-15 12:03 . 2001-08-17 21:36 5632 ----a-w c:\windows\system32\ptpusb.dll
2009-04-15 12:03 . 2008-04-13 17:45 15104 ----a-w c:\windows\system32\drivers\usbscan.sys
2009-04-15 12:03 . 2008-04-13 17:45 15104 ----a-w c:\windows\system32\dllcache\usbscan.sys
2009-04-15 12:03 . 2008-04-13 23:12 159232 ----a-w c:\windows\system32\ptpusd.dll
2009-04-13 20:14 . 2009-02-13 10:31 55640 ----a-w c:\windows\system32\drivers\avgntflt.sys
2009-04-13 20:13 . 2009-04-13 20:14
d
w c:\program files\Avira
2009-04-13 20:13 . 2009-04-13 20:14
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Avira
2009-04-13 17:46 . 2009-04-13 17:46
d
w c:\documents and settings\andy.ANDY-491HIJ81VU.000
2009-04-13 17:44 . 2009-04-13 17:44
d
w c:\documents and settings\TEMP.ANDY-491HIJ81VU
2009-04-13 12:20 . 2009-04-13 12:20 0 ----a-w c:\windows\system32\drivers\senekaqpomcowu.sys
2009-04-13 12:20 . 2009-04-13 12:20 0 ----a-w c:\windows\system32\drivers\senekapjortnku.sys
2009-04-13 09:26 . 2009-04-13 09:26
d
w c:\documents and settings\TEMP
2009-04-12 15:16 . 2009-04-12 15:16
d
w c:\program files\Trend Micro
2009-04-12 14:58 . 2009-03-09 19:06 15688 ----a-w c:\windows\system32\lsdelete.exe
2009-04-12 13:58 . 2009-04-12 13:58
d
w c:\program files\Disk Cleaner
2009-04-09 21:08 . 2009-03-09 19:06 64160 ----a-w c:\windows\system32\drivers\Lbd.sys
2009-04-09 20:58 . 2009-04-09 20:58
d--h--w c:\documents and settings\All Users.WINDOWS\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-04-09 20:58 . 2009-04-09 20:58
d
w c:\program files\Lavasoft
2009-04-09 20:58 . 2009-04-09 20:58
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2009-04-09 20:34 . 2009-04-09 20:34
d
w c:\documents and settings\All Users.WINDOWS\Application Data\MSN6
2009-04-09 19:24 . 2009-04-06 14:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-04-09 19:24 . 2009-04-06 14:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-09 19:24 . 2009-04-09 19:24
d
w c:\program files\Malwarebytes' Anti-Malware
2009-04-09 19:24 . 2009-04-09 19:24
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Malwarebytes
2009-04-08 07:58 . 2009-04-08 07:58 155 ----a-w c:\windows\system32\SelfDel.bat
2009-04-07 20:24 . 2009-04-07 20:24
d
w c:\program files\Norton AntiVirus
2009-04-07 20:22 . 2009-04-07 20:22
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Symantec
2009-04-07 20:22 . 2009-04-07 20:22
d
w c:\program files\Common Files\Symantec Shared
2009-04-07 20:20 . 2009-04-07 20:21 6 ----a-w C:\ISACER.ID
2009-04-07 20:04 . 2009-04-07 20:04
d-sh--w c:\windows\system32\config\systemprofile\Application Data\wsnpoem
2009-04-07 18:57 . 2009-04-07 18:57 56320 ----a-w c:\windows\system32\ldr_CRYPTED.exe
2009-03-25 19:17 . 2009-03-25 19:17 372736 ----a-w c:\windows\system32\DiskCleanerLM.ocx
2009-03-25 19:13 . 2009-03-25 19:13 372736 ----a-w c:\windows\system32\RegistryHelperLM.ocx
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-15 19:20 . 2009-04-12 15:10 7970 ----a-w C:\aaw7boot.log
2009-03-11 20:19 . 2009-03-11 20:19
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Microsoft Help
2009-02-23 18:33 . 2009-02-23 18:34 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009022320090224\index.dat
2009-02-23 18:33 . 2009-02-23 18:34 32768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009020920090216\index.dat
2009-02-23 14:30 . 2009-02-13 19:14 76487 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-02-23 14:22 . 2003-03-31 11:00 250048 --sha-r C:\ntldr
2009-02-22 07:58 . 2009-02-22 07:58
d
w c:\program files\iPod To Computer Transfer
2009-02-21 20:09 . 2009-02-21 20:09
d
w c:\program files\AudioShell
2009-02-19 16:44 . 2009-02-19 16:44 53733 ----a-w C:\Sponsor_Form_(2).pdf
2009-02-19 16:36 . 2009-02-19 16:36
d
w c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-02-19 16:34 . 2009-02-19 16:34 3369578 ----a-w C:\Hereford_Half_Marathon_Final.pdf
2009-02-16 14:24 . 2009-02-16 14:24
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Skype
2009-02-15 19:50 . 2009-02-15 19:50
d
w c:\program files\Adobe Media Player
2009-02-15 19:10 . 2009-02-15 19:10
d
w c:\documents and settings\All Users.WINDOWS\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-15 19:09 . 2009-02-15 19:09
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Apple Computer
2009-02-15 19:08 . 2009-02-15 19:08
d
w c:\documents and settings\All Users.WINDOWS\Application Data\Apple
2009-02-15 18:43 . 2009-02-15 18:43 3086960 ----a-w C:\Windows6.0-KB942288-v2-x64.msu
2009-02-15 18:38 . 2009-02-15 18:38 3327000 ----a-w C:\WindowsXP-KB942288-v3-x86.exe
2009-02-15 18:31 . 2009-02-15 18:33 69076264 ----a-w C:\iTunesSetup.exe
2009-02-15 17:05 . 2009-01-14 17:59 26 ----a-w C:\md5key.txt
2009-02-13 19:59 . 2009-02-13 19:51 373 ----a-w C:\Shortcut to Chipset Driver Intel Ver.8.0.1.1002.lnk
2009-02-13 19:12 . 2009-02-13 19:11 21640 ----a-w c:\windows\system32\emptyregdb.dat
2009-02-09 10:13 . 2009-02-16 14:49 1846784
w c:\windows\system32\dllcache\win32k.sys
2009-02-09 10:13 . 2003-03-31 11:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-03 19:21 . 2009-01-16 13:00 70448 ----a-w c:\documents and settings\Andy.HUGHESHOMECOMPU\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-01-16 20:35 . 2009-02-16 14:49 3594752
w c:\windows\system32\dllcache\mshtml.dll
2009-01-16 07:48 . 2009-01-16 07:48 0 ----a-w c:\documents and settings\Andy.HUGHESHOMECOMPU\Application Data\wklnhst.dat
.
((((((((((((((((((((((((((((( [EMAIL="SnapShot@2009-04-13_13.15.24.39"]SnapShot@2009-04-13_13.15.24.39[/EMAIL] )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 01:19 . 2007-11-07 01:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
- 2003-03-31 11:00 . 2009-04-13 12:15 63196 c:\windows\system32\perfc009.dat
+ 2003-03-31 11:00 . 2009-04-15 19:14 63196 c:\windows\system32\perfc009.dat
+ 2009-04-15 12:03 . 2008-04-13 17:45 15104 c:\windows\system32\drivers\usbscan.sys
+ 2009-04-13 20:14 . 2009-02-13 10:50 28376 c:\windows\system32\drivers\ssmdrv.sys
+ 2009-04-13 20:14 . 2009-02-13 13:22 95576 c:\windows\system32\drivers\avipbb.sys
+ 2009-04-13 20:14 . 2009-02-13 10:29 22360 c:\windows\system32\drivers\avgntmgr.sys
+ 2009-04-13 20:14 . 2009-02-13 10:31 55640 c:\windows\system32\drivers\avgntflt.sys
+ 2009-04-13 20:14 . 2009-02-13 10:17 45416 c:\windows\system32\drivers\avgntdd.sys
+ 2009-04-15 12:03 . 2008-04-13 17:45 15104 c:\windows\system32\dllcache\usbscan.sys
- 2009-02-13 19:21 . 2009-04-13 09:26 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-13 19:21 . 2009-04-15 19:09 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-02-13 19:21 . 2009-04-13 09:26 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-13 19:21 . 2009-04-15 19:09 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-02-13 19:21 . 2009-04-13 09:26 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-13 19:21 . 2009-04-15 19:09 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-03-11 20:25 . 2009-04-05 16:37 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 35088 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 18704 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 20240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe
+ 2009-04-15 12:03 . 2001-08-17 21:36 5632 c:\windows\system32\ptpusb.dll
+ 2009-04-15 12:03 . 2008-04-13 23:12 159232 c:\windows\system32\ptpusd.dll
+ 2003-03-31 11:00 . 2009-04-15 19:14 402274 c:\windows\system32\perfh009.dat
- 2003-03-31 11:00 . 2009-04-13 12:15 402274 c:\windows\system32\perfh009.dat
- 2009-02-13 19:04 . 2009-04-06 07:08 273376 c:\windows\system32\FNTCACHE.DAT
+ 2009-02-13 19:04 . 2009-04-15 07:14 273376 c:\windows\system32\FNTCACHE.DAT
+ 2009-03-11 20:19 . 2009-04-14 19:25 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
- 2009-03-11 20:19 . 2009-04-05 16:36 217864 c:\windows\Installer\{90120000-006E-0409-0000-0000000FF1CE}\misc.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 888080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 272648 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 922384 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 845584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 217864 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 184080 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 159504 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 1172240 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe
+ 2009-03-11 20:25 . 2009-04-14 19:26 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
- 2009-03-11 20:25 . 2009-04-05 16:37 1165584 c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-22 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_03\bin\jusched.exe" [2009-02-13 32881]
"LManager"="c:\progra~1\LAUNCH~1\LManager.exe" [2006-07-20 593920]
"AzMixerSel"="c:\program files\Realtek\InstallShield\AzMixerSel.exe" [2006-08-16 53248]
"igfxtray"="c:\windows\System32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\System32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\System32\igfxpers.exe" [2006-03-23 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-04-14 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-04-14 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-04-14 569413]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"tsnp2std"="c:\windows\tsnp2std.exe" [2006-07-07 258048]
"snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"SkyTel"="SkyTel.EXE" [2006-08-16 c:\windows\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-08-16 c:\windows\RTHDCPL.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\outlook.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\groove.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\onenote.exe"=
"c:\\Program Files\\iPod\\BIN\\iPodService.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\EvtEng.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-03-09 64160]
S2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-03-05 108289]
S2 EAPPkt;Realtek EAPPkt Protocol;c:\windows\system32\DRIVERS\EAPPkt.sys [2005-04-01 66048]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]
.
Contents of the 'Scheduled Tasks' folder
2009-04-12 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 20:06]
.
.
Supplementary Scan
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-15 20:21
Windows 5.1.2600 Service Pack 3 FAT NTAPI
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Other Running Processes
.
c:\windows\system32\savedump.exe
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\LAUNCH MANAGER\LMANAGER.EXE
c:\windows\SYSTEM32\IGFXSRVC.EXE
c:\windows\System32\igfxext.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\windows\System32\wbem\unsecapp.exe
c:\docume~1\ANDYAN~1.000\LOCALS~1\Temp\RtkBtMnt.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-15 20:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-15 19:24
ComboFix2.txt 2009-04-13 12:16
Pre-Run: 14,843,060,224 bytes free
Post-Run: 14,324,645,888 bytes free
307 --- E O F --- 2009-03-11 14:47I owe many thanks to free-easy-money.com !:beer:0 -
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:27:37, on 15/04/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\igfxsrvc.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\tsnp2std.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\igfxext.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\DOCUME~1\ANDYAN~1.000\LOCALS~1\Temp\RtkBtMnt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [AzMixerSel] C:\Program Files\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe
O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - (no file)
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
--
End of file - 8163 bytesI owe many thanks to free-easy-money.com !:beer:0 -
Make sure to delete and re download combofix.0
-
thomas01155 wrote: »Make sure to delete and re download combofix.
I had to do that before I did the above. Do I need to do it again ? Laptop seems to be working fine now thanks to all of your helpI owe many thanks to free-easy-money.com !:beer:0 -
You have a very old version of java prone to infection. Download and install the latest version http://www.java.com/en/
Then download javara this removes the old versions of java http://sourceforge.net/project/downloading.php?groupname=javara&filename=JavaRa.zip&use_mirror=kent unzip,open java run, select your language then press remove old versions and wait till it finishes.
Yes run Combofix.
Oh and update Malwarebytes and run a quick scan.0 -
hopefully thanks to you lot I'm nearly done. Really appreciate your help. One last thing - I now seem to have a 'D Drive which I didnt seem to have beofre. Its called PQSERVICE. The only prob is that I get a bubble every now and again saying that I am running out od disk space in this drive. Any suggestionsI owe many thanks to free-easy-money.com !:beer:0
-
PQSERVICE http://forum.notebookreview.com/showthread.php?t=11584
seems to be related to restoring the computer like a factory restore.
Delete any files you don't need and uninstall any programs you don't use start>control panel> add and remove programs.0 -
Open notepad and copy/paste the text in RED below
File::
c:\windows\system32\senekaydcqkcwp.dat
c:\windows\system32\drivers\senekaqpomcowu.sys
c:\windows\system32\drivers\senekapjortnku.sys
c:\windows\system32\SelfDel.bat
c:\windows\system32\DiskCleanerLM.ocx
c:\windows\system32\RegistryHelperLM.ocx
c:\windows\system32\ldr_CRYPTED.exe
Save this as "CFScript"
Then drag the CFScript into ComboFix.exe as you see in the screenshot below.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
***PLEASE RUN THE KASPERSKY SCAN I ASKED FOR***:idea:0
This discussion has been closed.
Confirm your email address to Create Threads and Reply
Categories
- All Categories
- 353.5K Banking & Borrowing
- 254.2K Reduce Debt & Boost Income
- 455.1K Spending & Discounts
- 246.6K Work, Benefits & Business
- 603K Mortgages, Homes & Bills
- 178.1K Life & Family
- 260.6K Travel & Transport
- 1.5M Hobbies & Leisure
- 16K Discuss & Feedback
- 37.7K Read-Only Boards