Kindly be advised we cannot cancel subscriptions or issue refunds on the forum.
You may cancel your Bitdefender subscription from Bitdefender Central or by contacting Customer Support at: https://www.bitdefender.com/consumer/support/help/

Thank you for your understanding.

Please Help Removing Nt_kernel_error1256

Options
scoligirl
scoligirl
in Malware talk

Hey there,


Ive been reading through the previous threads on this but I'm getting pretty lost here. Had this malware for about 3 days and Im just getting frustrated over it.


Ive run vundofix many times, but they end up coming back over and over again. I dunno if it helps but since i have ad aware, ran that many times as well.


Even after getting rid of all the 'vundo', it comes up with this when I startup my laptop:


Error loading C:\WINDOWS\system32\oeviflekl.dll


The specified module could not be found


And here's my hijack log:


Logfile of Trend Micro HijackThis v2.0.2


Scan saved at 6:53:46 p.m., on 1/02/2008


Platform: Windows XP SP2 (WinNT 5.01.2600)


MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)


Boot mode: Normal


Running processes:


C:\WINDOWS\System32\smss.exe


C:\WINDOWS\system32\winlogon.exe


C:\WINDOWS\system32\services.exe


C:\WINDOWS\system32\lsass.exe


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\System32\svchost.exe


C:\WINDOWS\system32\ACS.exe


C:\WINDOWS\system32\spoolsv.exe


C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe


C:\WINDOWS\system32\DVDRAMSV.exe


C:\Program Files\Network Associates\Common Framework\FrameworkService.exe


C:\Program Files\Network Associates\VirusScan\Mcshield.exe


C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe


C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


C:\WINDOWS\system32\svchost.exe


C:\WINDOWS\system32\ThpSrv.exe


C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe


C:\Program Files\Viewpoint\Common\ViewpointService.exe


C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe


C:\WINDOWS\system32\CAP2RSK.EXE


C:\WINDOWS\Explorer.EXE


C:\WINDOWS\system32\hkcmd.exe


C:\WINDOWS\system320THotkey.exe


C:\WINDOWS\system32\TFNF5.exe


C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe


C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


C:\Program Files\TOSHIBA\TouchED\TouchED.Exe


C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe


C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe


C:\WINDOWS\system32\TPSMain.exe


C:\WINDOWS\system32\TPSODDCtl.exe


C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe


C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE


C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE


C:\WINDOWS\system32\dla\tfswctrl.exe


C:\WINDOWS\AGRSMMSG.exe


C:\WINDOWS\system32\thpsrv.exe


C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE


C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe


C:\WINDOWS\system32\TPSBattM.exe


C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe


C:\Program Files\Common Files\Real\Update_OB\realsched.exe


C:\Program Files\Common Files\AOL\1156161894\ee\AOLSoftware.exe


C:\Program Files\iTunes\iTunesHelper.exe


C:\WINDOWS\Fonts\svchost.exe


C:\WINDOWS\mrofinu1188.exe


C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe


C:\WINDOWS\system32\rundll32.exe


C:\Program Files\MSN Messenger\msnmsgr.exe


C:\Program Files\Dot1XCfg\Dot1XCfg.exe


C:\Program Files\Router\Router.exe


C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP2LAK.EXE


C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe


C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP2SWK.EXE


C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe


C:\WINDOWS\system32\bounce.exe


C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe


C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe


C:\Program Files\iPod\bin\iPodService.exe


C:\Program Files\MSN Messenger\usnsvc.exe


C:\WINDOWS\17PHolmes1188.exe


C:\WINDOWS\system32\rundll32.exe


C:\Program Files\Internet Explorer\iexplore.exe


C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.nz/


R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://skcproxy/proxy1.pac


R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local


R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)


O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll


O4 - HKLM\..\Run: [igfxTray] C:\WINDOWS\system32\igfxtray.exe


O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe


O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system320THotkey.exe


O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe


O4 - HKLM\..\Run: [TFNF5] TFNF5.exe


O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe


O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


O4 - HKLM\..\Run: [TouchED] C:\Program Files\TOSHIBA\TouchED\TouchED.Exe


O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe


O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"


O4 - HKLM\..\Run: [TPSMain] TPSMain.exe


O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe


O4 - HKLM\..\Run: [TFncKy] TFncKy.exe


O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon


O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service


O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe


O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe


O4 - HKLM\..\Run: [ThpSrv] c:\WINDOWS\system32\thpsrv /logon


O4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE


O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey


O4 - HKLM\..\Run: [ElbyCheckRegKill] "C:\Program Files\DVD Region Killer\ElbyCheck.exe" /L RegKill


O4 - HKLM\..\Run: [CFSServ.exe] CFSServ.exe -NoClient


O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot


O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1156161894\ee\AOLSoftware.exe


O4 - HKLM\..\Run: [iPHSend] C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe


O4 - HKLM\..\Run: [CAP2ON] C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAP2ONN.EXE


O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime


O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"


O4 - HKLM\..\Run: [Host Process] C:\WINDOWS\Fonts\svchost.exe


O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD3257


O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"


O4 - HKLM\..\Run: [902edfcd] rundll32.exe "C:\WINDOWS\system32\lknpajlr.dll",b


O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background


O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe


O4 - HKCU\..\Run: [Router] C:\Program Files\Router\Router.exe


O4 - HKUS\S-1-5-18\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'SYSTEM')


O4 - HKUS\.DEFAULT\..\RunOnce: [TSClientMSIUninstaller] cmd.exe /C "cscript %systemroot%\Installer\TSClientMsiTrans\tscuinst.vbs" (User 'Default user')


O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe


O4 - Global Startup: Canon LASER SHOT LBP-1210 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP2LAK.EXE


O4 - Global Startup: hp psc 1000 series.lnk = ?


O4 - Global Startup: hpoddt01.exe.lnk = ?


O4 - Global Startup: internet.exe


O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe


O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll


O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll


O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL


O9 - Extra button: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe


O9 - Extra 'Tools' menuitem: ProxyPal - {B0127AF2-316C-4f1d-BF35-3DE43971EEC5} - C:\WINDOWS\system32\proxypal.exe


O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe


O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll


O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www4.snapfish.co.nz/SnapfishActivia.cab


O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1201741129738


O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/Windows...ggPublisher.exe


O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwa...ash/swflash.cab


O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers...vex-2.2.2.1.cab


O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = student.sk.edu


O17 - HKLM\Software\..\Telephony: DomainName = student.sk.edu


O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = student.sk.edu


O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\ACS.exe


O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe


O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe


O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe


O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe


O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe


O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe


O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe


O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe


O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe


O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe


O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe


O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe


--


End of file - 11287 bytes


Thanks in advance

Comments

  • farbar
    farbar
    Options

    I think you should get a decent antivirus with firewall to have the basic protection. I doubt you can remove this and remain clean without it.

  • scoligirl
    scoligirl
    edited February 2008
    Options

    I dunno if it makes any difference but heres my combofix log


    ComboFix 08-02.01.5 - 10092 2008-02-01 20:52:39.1 - NTFSx86


    Running from: D:\Settings\Desktop\ComboFix.exe


    * Created a new restore point


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!


    .


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    .


    C:\WINDOWS\system32\awtqqrr.dll


    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat


    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat


    C:\Program Files\inetget2


    C:\Program Files\myglobalsearch


    C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR


    C:\Program Files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST


    C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR


    C:\Program Files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST


    C:\Program Files\myglobalsearch\bar\1.bin\M9PLUGIN.DLL


    C:\Program Files\myglobalsearch\bar\1.bin\MGSBAR.DLL


    C:\Program Files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL


    C:\Program Files\myglobalsearch\bar\Cache\01ABE0B9


    C:\Program Files\myglobalsearch\bar\Cache\01AC22FD


    C:\Program Files\myglobalsearch\bar\Cache\01AC3AE4.bin


    C:\Program Files\myglobalsearch\bar\Cache\01AC55F6.bin


    C:\Program Files\myglobalsearch\bar\Cache\01AC6917.bin


    C:\Program Files\myglobalsearch\bar\Cache\files.ini


    C:\Program Files\myglobalsearch\bar\History\search


    C:\Program Files\myglobalsearch\bar\Settings\prevcfg.htm


    C:\Program Files\Router


    C:\Program Files\Router\Router.exe


    C:\Program Files\Router\UnInstall.exe


    C:\Program Files\Temporary


    C:\WINDOWS\b122.exe


    C:\WINDOWS\b151.exe


    C:\WINDOWS\cookies.ini


    C:\WINDOWS\Fonts\a.zip


    C:\WINDOWS\Fonts\svchost.exe


    C:\WINDOWS\mrofinu1188.exe


    C:\WINDOWS\system32\awtqqrr.dll


    C:\WINDOWS\system32\lkeljveo.ini


    C:\WINDOWS\system32\mcrh.tmp


    C:\WINDOWS\system32\windows


    C:\WINDOWS\system32\xxbay.ini


    C:\WINDOWS\system32\xxbay.ini2


    C:\WINDOWS\system32\yabxx.dll


    C:\WINDOWS\Fonts\'


    ----- BITS: Possible infected sites -----


    hxxp://www.download.windowsupdate.com


    .


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    .


    -------\LEGACY_DOMAINSERVICE


    ((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))


    .


    2008-02-14 23:20 . 2008-02-14 23:20 244 --ah----- C:\sqmnoopt06.sqm


    2008-02-14 23:20 . 2008-02-14 23:20 232 --ah----- C:\sqmdata06.sqm


    2008-02-01 18:53 . 2008-02-01 18:53 <DIR> d-------- C:\Program Files\Trend Micro


    2008-02-01 08:45 . 2008-02-01 08:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!


    2008-01-31 21:25 . 2008-01-31 21:25 230 --a------ C:\WINDOWS\system32\spupdsvc.inf


    2008-01-31 19:49 . 2008-02-01 18:19 <DIR> d-------- C:\VundoFix Backups


    2008-01-31 19:17 . 2008-01-31 19:17 <DIR> d-------- C:\Program Files\Yahoo!


    2008-01-31 17:09 . 2008-01-31 19:08 <DIR> d-------- C:\Program Files\PrevxCSI


    2008-01-31 16:50 . 2008-01-31 18:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prevx


    2008-01-31 16:50 . 2008-01-31 16:51 <DIR> d-------- C:\Documents and Settings\10092\Application Data\PrevxCSI


    2008-01-31 15:35 . 2008-01-31 15:35 <DIR> d-------- C:\Program Files\MSXML 6.0


    2008-01-31 15:06 . 2007-07-10 02:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll


    2008-01-31 14:49 . 2007-07-30 19:19 25,944 --a------ C:\WINDOWS\system32\wuapi.dll.mui


    2008-01-31 07:56 . 2008-01-31 07:56 36,864 -ra------ C:\WINDOWS\mrofinu1188.exe.tmp


    2008-01-30 20:25 . 2008-01-30 20:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Broderbund LLC


    2008-01-30 18:19 . 2008-02-01 21:05 129,536 --a------ C:\WINDOWS\system32\bounce.exe


    2008-01-29 14:14 . 2008-01-29 14:14 <DIR> d-------- C:\Program Files\Dot1XCfg


    2008-01-21 00:13 . 2008-01-21 00:13 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll


    2008-01-17 11:51 . 2008-01-17 11:51 244 --ah----- C:\sqmnoopt08.sqm


    2008-01-17 11:51 . 2008-01-17 11:51 232 --ah----- C:\sqmdata08.sqm


    2008-01-16 21:19 . 2008-01-16 21:19 244 --ah----- C:\sqmnoopt07.sqm


    2008-01-16 21:19 . 2008-01-16 21:19 232 --ah----- C:\sqmdata07.sqm


    2008-01-03 21:45 . 2008-01-03 21:46 <DIR> d-------- C:\Documents and Settings\10092\Application Data\Snapfish


    .


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    2008-02-01 05:35 --------- d-----w C:\Documents and Settings\10092\Application Data\LimeWire


    2008-01-31 09:35 --------- d-----w C:\Program Files\bearshare


    2008-01-31 09:04 --------- d-----w C:\Program Files\Google


    2008-01-31 06:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


    2008-01-30 07:40 --------- d--h--w C:\Program Files\InstallShield Installation Information


    2008-01-11 08:59 --------- d-----w C:\Program Files\Windows Live Safety Center


    2007-12-27 08:29 --------- d-----w C:\Program Files\Java


    2007-12-21 04:21 --------- d-----w C:\Program Files\Broderbund


    2007-12-21 02:40 --------- d-----w C:\Program Files\DivX


    2007-12-18 10:45 --------- d-----w C:\Program Files\Apple Software Update


    2007-12-17 22:50 --------- d-----w C:\Program Files\iTunes


    2007-12-17 22:48 --------- d-----w C:\Program Files\iPod


    2007-12-17 22:39 --------- d-----w C:\Program Files\QuickTime


    2007-12-17 11:36 --------- d-----w C:\Program Files\MSN Messenger


    2007-12-17 11:36 --------- d-----w C:\Program Files\Messenger Plus! Live


    2004-11-22 00:47 7,742 ----a-w C:\Program Files\ReadmeFirst.htm


    .


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    .


    .


    *Note* empty entries & legit default entries are not shown


    REGEDIT4


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{319DB315-9719-4BE7-BBC0-BA7970ADBE9E}]


    C:\WINDOWS\system32\geedc.dll


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D6355B3-BAC8-43C4-B40B-BEF8DFEF1CF2}]


    C:\WINDOWS\system32\qomml.dll


    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54 5674352]


    "Aim6"="" []


    "Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [2008-01-29 14:14 61440]


    "Router"="C:\Program Files\Router\Router.exe" [ ]


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]


    "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-25 13:56 155648]


    "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-25 13:52 126976]


    "00THotkey"="C:\WINDOWS\system32\00THotkey.exe" [2004-06-29 14:24 258048]


    "000StTHK"="000StTHK.exe" [2001-06-24 17:28 24576 C:\WINDOWS\system32\000StTHK.exe]


    "TFNF5"="TFNF5.exe" [2004-06-28 14:22 73728 C:\WINDOWS\system32\TFNF5.exe]


    "SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2004-09-16 12:03 135168]


    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-01-22 21:09 98304]


    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-01-22 21:08 495616]


    "TouchED"="C:\Program Files\TOSHIBA\TouchED\TouchED.Exe" [2003-01-22 15:00 126976]


    "NDSTray.exe"="NDSTray.exe" []


    "TosHKCW.exe"="C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe" [2002-09-10 12:07 49152]


    "TPSMain"="TPSMain.exe" [2004-11-09 17:30 270336 C:\WINDOWS\system32\TPSMain.exe]


    "TPSODDCtl"="TPSODDCtl.exe" [2004-11-09 17:30 110592 C:\WINDOWS\system32\TPSODDCtl.exe]


    "TFncKy"="TFncKy.exe" []


    "TMESRV.EXE"="C:\Program Files\TOSHIBA\TME3\TMESRV31.exe" [2004-11-12 07:43 126976]


    "TMERzCtl.EXE"="C:\Program Files\TOSHIBA\TME3\TMERzCtl.exe" [2004-07-10 19:49 81920]


    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-09-28 22:05 127035]


    "AGRSMMSG"="AGRSMMSG.exe" [2004-07-22 17:38 88361 C:\WINDOWS\agrsmmsg.exe]


    "ThpSrv"="c:\WINDOWS\system32\thpsrv /logon" [ ]


    "ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2003-09-29 07:10 81990]


    "McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2003-09-10 03:11 135251]


    "ElbyCheckRegKill"="C:\Program Files\DVD Region Killer\ElbyCheck.exe" [2001-12-06 13:09 45056]


    "CFSServ.exe"="CFSServ.exe" []


    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-06-29 19:40 180269]


    "HostManager"="C:\Program Files\Common Files\AOL\1156161894\ee\AOLSoftware.exe" [2006-05-10 13:24 50760]


    "IPHSend"="C:\Program Files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-18 05:59 124520]


    "CAP2ON"="C:\WINDOWS\system32\Spool\Drivers\w32x86\3\CAP2ONN.EXE" [2005-06-29 10:36 22528]


    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-12-11 10:56 286720]


    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-12-11 12:10 267048]


    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 04:43 83608]


    "902edfcd"="C:\WINDOWS\system32\lknpajlr.dll" [ ]


    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]


    "TSClientMSIUninstaller"="cmd.exe" [2004-08-05 01:00 388608 C:\WINDOWS\system32\cmd.exe]


    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\


    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26 29696]


    Canon LASER SHOT LBP-1210 Status Window.LNK - C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP2LAK.EXE [2005-10-31 20:38:49 30720]


    hp psc 1000 series.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe [2002-12-02 21:08:34 147456]


    hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2002-12-02 20:56:10 40960]


    internet.exe [2008-01-30 18:18:46 172032]


    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2004-11-23 09:21:20 155648]


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]


    "ForceClassicControlPanel"= 1 (0x1)


    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]


    "{24C61C09-62C0-42ED-B640-53F7FEC9098A}"= C:\WINDOWS\system32\awtqqrr.dll [ ]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-643970264-1529554251-782984527-1622\Scripts\Logon\0\0]


    "******"=\\sweden\netlogon\settime.bat


    R0 Thpdrv;TOSHIBA HDD Protection Driver;C:\WINDOWS\system32\DRIVERS\thpdrv.sys [2004-12-01 18:49]


    R0 Thpevm;TOSHIBA HDD Protection - Shock Sensor Driver;C:\WINDOWS\system32\DRIVERS\Thpevm.SYS [2004-11-14 09:24]


    R1 TMEI3E;TMEI3E;C:\WINDOWS\system32\Drivers\TMEI3E.SYS [2004-06-17 08:08]


    R2 RapidPort2;RapidPort2;C:\WINDOWS\system32\Drivers\CAP2LPT.SYS [2005-06-29 10:36]


    R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-05 10:38]


    R3 RegKill;RegKill;C:\WINDOWS\system32\Drivers\RegKill.sys [2001-11-30 11:46]


    S3 PCX500;Cisco Wireless LAN Adapters Driver;C:\WINDOWS\system32\DRIVERS\pcx500.sys [2004-08-03 22:06]


    S3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2004-05-17 19:18]


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4b6ecbfa-5bc7-11da-85bd-000e7b0b8794}]


    \Shell\AutoRun\command - \IntelDrivers\SetupWLD.exe


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{98b813d0-49af-11da-8ed4-000e7b138c94}]


    \Shell\AutoRun\command - \IntelDrivers\SetupWLD.exe


    .


    Contents of the 'Scheduled Tasks' folder


    "2007-12-29 07:23:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"


    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe


    "2007-02-21 01:55:47 C:\WINDOWS\Tasks\Critical0.job"


    "2007-05-15 08:21:15 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1162788484.job"


    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I


    .


    **************************************************************************


    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net


    Rootkit scan 2008-02-01 21:05:22


    Windows 5.1.2600 Service Pack 2 NTFS


    scanning hidden processes ...


    scanning hidden autostart entries ...


    scanning hidden files ...


    scan completed successfully


    hidden files: 0


    **************************************************************************


    .


    ------------------------ Other Running Processes ------------------------


    .


    C:\WINDOWS\system32\ACS.exe


    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe


    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe


    C:\WINDOWS\system32\DVDRAMSV.exe


    C:\Program Files\Network Associates\Common Framework\FrameworkService.exe


    C:\Program Files\Network Associates\VirusScan\Mcshield.exe


    C:\PROGRA~1\NETWOR~1\COMMON~1\naPrdMgr.exe


    C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe


    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE


    C:\WINDOWS\system32\ThpSrv.exe


    C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe


    C:\Program Files\Viewpoint\Common\ViewpointService.exe


    C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe


    C:\WINDOWS\system32\CAP2RSK.EXE


    C:\WINDOWS\system32\hkcmd.exe


    C:\WINDOWS\system32\00THotkey.exe


    C:\WINDOWS\system32\TFNF5.exe


    C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe


    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe


    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe


    C:\Program Files\TOSHIBA\TouchED\TouchED.Exe


    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe


    C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe


    C:\WINDOWS\system32\TPSMain.exe


    C:\WINDOWS\system32\TPSODDCtl.exe


    C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe


    C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE


    C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE


    C:\WINDOWS\system32\dla\tfswctrl.exe


    C:\WINDOWS\AGRSMMSG.exe


    C:\WINDOWS\system32\thpsrv.exe


    C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE


    C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe


    C:\WINDOWS\system32\TPSBattM.exe


    C:\Program Files\TOSHIBA\ConfigFree\CFSServ.exe


    C:\Program Files\Common Files\Real\Update_OB\realsched.exe


    C:\Program Files\Common Files\AOL\1156161894\ee\AOLSoftware.exe


    C:\Program Files\iTunes\iTunesHelper.exe


    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe


    C:\WINDOWS\system32\rundll32.exe


    C:\Program Files\MSN Messenger\msnmsgr.exe


    C:\Program Files\Dot1XCfg\Dot1XCfg.exe


    C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP2LAK.EXE


    C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP2SWK.EXE


    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe


    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe


    C:\WINDOWS\system32\bounce.exe


    C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe


    C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe


    C:\Program Files\iPod\bin\iPodService.exe


    C:\Program Files\MSN Messenger\usnsvc.exe


    .


    **************************************************************************


    .


    Completion time: 2008-02-01 21:08:33 - machine was rebooted [10092]


    ComboFix-quarantined-files.txt 2008-02-01 08:08:28


    .


    2007-11-01 04:49:15 --- E O F ---


    And instead of


    Error loading C:\WINDOWS\system32\oeviflekl.dll


    The specified module could not be found


    I'm getting


    Error loading C:\WINDOWS\system32\lknpajlr.dll


    The specified module could not be found


    The laptop that i use, its like compulsary for my school cos we do all our work on it and we pretty arent supposed to get other antivirus programs installed or something. So I cant do anything without getting a decent antivirus with firewall?


    Thanks again


    EDIT: Which anti virus program/s which you recommend?

  • farbar
    farbar
    Options
    I dunno if it makes any difference but heres my combofix log


    The laptop that i use, its like compulsary for my school cos we do all our work on it and we pretty arent supposed to get other antivirus programs installed or something. So I cant do anything without getting a decent antivirus with firewall?


    Thanks again


    EDIT: Which anti virus program/s which you recommend?


    Yes it makes a difference, it makes me see things and compels me to do something about it.


    About AV obviously I am using BitDefender Internet Security 8 myself and it does the job for me.


    I suggest the following:


    1. Usninstall P2P application (utorent, Bitlord, Limewire, etc) and remove its folder from program files. You may later on install it again.


    2. Viewpoint is not a malware or spyware but is installed without the users knowledge and permission. I suggest you uninstall it via add/remove programs and remove the folder from the program files(C:\Program Files\Viewpoint).


    3. Remove old Java versions due to serious security vulnerability: Download the latest version of JRE (Java Runtime Environment (JRE) 6 Update 4) from here but not install it now: http://java.sun.com/javase/downloads/index.jsp


    4. Go to add/remove and uninstall all items with Java, JRE or J2SE in it. Then remove Java folder from the program file (C:\Program Files\java).


    5.Open a notepad (start menu-all programs-accessories-notepad)


    Copy and paste the text in the code box below into it.


    File::
    C:\WINDOWS\mrofinu1188.exe.tmp
    C:\WINDOWS\system32\oeviflekl.dll
    C:\WINDOWS\system32\oeviflekl.*
    C:\WINDOWS\system32\lknpajlr.dll
    C:\WINDOWS\system32\lknpajlr.*
    C:\WINDOWS\system32\levifleko.dll
    C:\WINDOWS\system32\rknpajll.*
    C:\WINDOWS\mrofinu1188.exe.tmp


    Click File-save as …


    Select save in:desktop


    Fill in File name: CFScript.txt


    save as type: All file types (*.*)


    *Close/disable all anti virus and anti malware programs so they do not interfere with the running of *ComboFix. After Combofix is finished turn on/enable your anti virus again.


    *Drag CFScript.txt into ComboFix.exe. You can see the image showing this here: http://www.fromsej.saknet.dk/billeder/cfscript.gif


    *ComboFix will now run a scan on your system.


    *It may reboot your system when it finishes. This is normal. Copy and paste the content of combofix.txt into your reply.


    * Reboot and make a fresh HJT log and post it along with the combofix log to your reply. Do you still get the error warning?

All Time Leaders

Categories

Defenders of the month