I Have Also Been Hit With The Nt_kernel Error 1256

From the sounds of the many posts on this board, I will have to stand in line to obtain some help on this issue. So I will be patient, and wait my turn.......

I am not at all proficient in the how to's, so any help will have to be specific and almost keystroke by keystroke.

From the information obtained in this forum, I did run the Vundofix V6.7.7 and managed to remove all but one file. The Windows Update and Help and Support Icons are still on my desktop. Managed to remove (?) all of those pesky .tmp files. Its been cleaned up enough to make this post without the computer grinding itself to a halt.

Here is my log from the HijackThis program

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 8:59:44 PM, on 07/02/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Common Files\Command Software\dvpapi.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe

C:\Program Files\TELUS\eProtect Advisor\TEPA.exe

C:\Program Files\TELUS\TELUS Security service\Freedom.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Veoh Networks\Veoh\VeohClient.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\TELUS eCare\bin\mpbtn.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\WINDOWS\explorer.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.ca/myway

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DC

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.ca/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

O4 - HKLM\..\Run: [intelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"

O4 - HKLM\..\Run: [intelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless

O4 - HKLM\..\Run: [sigmatelSysTrayApp] stsystra.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"

O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [iSUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [PrinTray] C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe

O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe

O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall

O4 - HKLM\..\Run: [TEPA.exe] "C:\Program Files\TELUS\eProtect Advisor\TEPA.exe" /AUTORUN

O4 - HKLM\..\Run: [TELUS Security service] "C:\Program Files\TELUS\TELUS Security service\Freedom.exe"

O4 - HKLM\..\Run: [salestart] "C:\Program Files\Common Files\StorageProtector\strpmon.exe" dm=http://storageprotector.com ad=http://storageprotector.com sd=http://inspaid.storageprotector.com

O4 - HKLM\..\Run: [984e9103] rundll32.exe "C:\WINDOWS\system32\mmodmydr.dll",b

O4 - HKLM\..\RunOnce: [indexCleaner] "C:\Program Files\TELUS\TELUS Security service\IndexCleanerR.exe"

O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe

O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R

O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: TELUS eCare.lnk = C:\Program Files\TELUS eCare\bin\matcli.exe

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll

O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

End of file - 9183 bytes

Thanks in advance to the people who are much smarter than me in these issues.

Find more posts tagged with

Comments

farbar

Hi,

I suggest while waiting for somebody to help you, you can prepare your computer and equip it with what is missing on your computer:

1- An anti virus: BitDefender has a free version: http://www.bitdefender.com/PRODUCT-14-en--...ee-Edition.html

2- A firewall:Sygate Personal Firewall or ZoneLabs Zone Alarm have good free versions.

3-Antiadware and spyware:

Download Ad-Aware 2007 Free

Download Spybot - Search and Destroy

jbhstircrazy

Hi,

I suggest while waiting for somebody to help you, you can prepare your computer and equip it with what is missing on your computer:

1- An anti virus: BitDefender has a free version: http://www.bitdefender.com/PRODUCT-14-en--...ee-Edition.html

2- A firewall:Sygate Personal Firewall or ZoneLabs Zone Alarm have good free versions.

3-Antiadware and spyware:

Download Ad-Aware 2007 Free

Download Spybot - Search and Destroy

Farbar:

Thank-you for sending me this information. I will give it a try.

I have been reading alot about this subject over the past few days, and will disable the existing security software on this computer before I enable the recommended.

Presently, the security software that is loaded on the computer is from my ISP. It has an antivirus, firewall, and spyware in the package. It has caught some virus's, and cleans out a good number of spyware cookies and of the like. The firewall blocks a lot of packets (?) on a daily basis.

Further to my last posting, my son thought he would help (?) me by trying to get rid of the file that VundoFix could not eliminate. He changed the .dll to a .****** and attempted to delete it. It still would not get rid of the offending file. So he changed it back to the .dll. After that, we started to get the pop ups reappearing. I re ran the VundoFix program, and found new files. Most of them were eliminated but the first offending file is still there, along with a new one, that seems to change name every time you re-run VundoFix.

The offending file has a pathway of C:\WINDOWS\System32\hggffee.dll

I have asked my son to leave well enough alone, and let the experts handle this one. In my line of work we have a simple rule when we are trying to repair something. Rule #1 = When attempting to fix something, DON'T make it worse.

Thanks again for all the expert advice.

S@S

farbar

I don't press for the first two points as I didn't recognized your AV and firewall. But still insist on the third one.

To give you some clue as what you are dealing with you go to C:\Program Files\Trend Micro\HijackThis\HijackThis.exe, change the name of hijackthis.exe to something else like stare.exe, then double click stare.exe to make a new hijackthis log and you see the dll you could not remove and may be more start appearing on the HJT log.

I understand your son's attempt to improvise but agree with you and the rule you are applying in your work.

In any case I suggest the following:

Step 1.

Download ComboFix.exe to your desktop using this link:

bleepingcomputer

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. After Combofix is finished turn on/enable your anti virus again.

Double click on combofix.exe to run the programme & then follow the prompts.

When finished, it will produce a report for you. Please post the content of this log ("C:\ComboFix.txt") into your next post.

ComboFix may need to reboot to finish its work. Let it.

Note:Do not mouseclick combofix's window while it's running. That may cause it to stall

Step 2. Go to your firewall Internet traffic and check, note, report and remove all suspicious allowed applications.

Step3.

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.

Under Main choose: Select All

Click the Empty Selected button

step 4. Reboot and Post a new hijackthis log.

Please give me feedback about the the problems you face in doing the steps or any changes you notice.

jbhstircrazy

Farbar:

After I read your post I jumped right into step #1. I did not change the hijackthis.exe to stare.exe and run a log. If you still require this, I will repost the results. Sorry about that.

Completed the Four steps as you had requested. You were specific enough that I (and my son) could follow. Here is the information that you had requested

Step 1:

Ran ComboFix and the log is attached. When the computer automatically rebooted, my installed security service automatically rebooted also, even though I had shut it down to run ComboFix. Hope it didn't mess something up. I have also removed the name listed in the computer with ***'s

ComboFix 08-02.05.3 - **** ****** 2008-02-09 21:51:13.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.528 [GMT -7:00]

Running from: C:\Documents and Settings\**** ******\Desktop\ComboFix.exe

* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\WINDOWS\system32\ssqrq.dll

C:\Documents and Settings\All Users\Application Data\storageprotector

C:\Documents and Settings\All Users\Application Data\storageprotector\Data\ac

C:\Documents and Settings\All Users\Application Data\storageprotector\Data\em

C:\Documents and Settings\All Users\Application Data\storageprotector\Data\oid

C:\Documents and Settings\All Users\Application Data\storageprotector\Data\user

C:\Documents and Settings\**** ******\Application Data\storageprotector

C:\Documents and Settings\**** ******\Application Data\storageprotector\Logs\update.log

C:\Program Files\Common Files\StorageProtector

C:\Program Files\Common Files\StorageProtector\goaway.exe

C:\Program Files\Common Files\Yazzle1281OinAdmin.exe

C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe

C:\WINDOWS\cookies.ini

C:\WINDOWS\system32\arqbcpor.ini

C:\WINDOWS\system32\AutoRun.inf

C:\WINDOWS\system32\hbubvrni.dll

C:\WINDOWS\system32\hggffee.dll

C:\WINDOWS\system32\ighxqcvw.ini

C:\WINDOWS\system32\jldvhrhr.dll

C:\WINDOWS\system32\jouuqflu.dll

C:\WINDOWS\system32\kxksteww.ini

C:\WINDOWS\system32\mcrh.tmp

C:\WINDOWS\system32\pac.txt

C:\WINDOWS\system32\qrqss.ini

C:\WINDOWS\system32\qrqss.ini2

C:\WINDOWS\system32\rdymdomm.ini

C:\WINDOWS\system32\rhrhvdlj.ini

C:\WINDOWS\system32\ropcbqra.dll

C:\WINDOWS\system32\ssqrq.dll

C:\WINDOWS\system32\vmcsvgfw.ini

C:\WINDOWS\system32\votcybww.ini

C:\WINDOWS\system32\windows

((((((((((((((((((((((((( Files Created from 2008-01-10 to 2008-02-10 )))))))))))))))))))))))))))))))

2008-02-08 20:30 . 2008-02-08 20:30 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe

2008-02-07 20:58 . 2008-02-07 20:58 <DIR> d-------- C:\Program Files\Trend Micro

2008-02-06 21:10 . 2008-02-08 20:10 <DIR> d-------- C:\VundoFix Backups

2008-02-05 21:04 . 2008-02-05 21:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard

2008-02-05 21:03 . 2007-03-28 14:01 117,760 --a------ C:\WINDOWS\system32\hpzll5ha.dll

2008-02-05 21:01 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys

2008-02-05 21:01 . 2004-08-03 22:58 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys

2008-02-05 20:54 . 2008-02-05 20:54 <DIR> d-------- C:\Program Files\Hewlett-Packard

2008-02-05 20:46 . 2008-02-05 20:46 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard

2008-02-05 20:43 . 2007-03-08 12:20 21,568 --a------ C:\WINDOWS\system32\drivers\HPZius12.sys

2008-02-05 20:43 . 2007-03-08 12:20 16,496 --a------ C:\WINDOWS\system32\drivers\HPZipr12.sys

2008-02-05 20:42 . 2008-02-05 20:43 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE

2008-02-05 20:42 . 2007-03-17 23:11 675,840 --a------ C:\WINDOWS\system32\hpowiax3.dll

2008-02-05 20:42 . 2007-03-17 23:11 569,344 --a------ C:\WINDOWS\system32\hpotscl3.dll

2008-02-05 20:42 . 2007-03-08 12:20 364,544 --a------ C:\WINDOWS\system32\hppldcoi.dll

2008-02-05 20:42 . 2007-03-08 12:20 309,760 --a------ C:\WINDOWS\system32\difxapi.dll

2008-02-05 20:42 . 2007-03-17 23:11 303,104 --a------ C:\WINDOWS\system32\hpovst10.dll

2008-02-05 20:42 . 2007-03-30 22:07 267,864 --a------ C:\WINDOWS\system32\hpzids01.dll

2008-02-05 20:42 . 2007-03-08 12:20 49,920 --a------ C:\WINDOWS\system32\drivers\HPZid412.sys

2008-02-05 20:41 . 2008-02-05 20:41 <DIR> d-------- C:\Program Files\HP

2008-02-05 20:40 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys

2008-02-05 20:40 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys

2008-02-05 20:39 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys

2008-02-05 20:39 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys

2008-02-05 20:22 . 2008-02-05 21:07 122,771 --a------ C:\WINDOWS\hpoins14.dat

2008-02-05 20:22 . 2007-09-21 04:55 1,996 --------- C:\WINDOWS\hpomdl14.dat

2008-02-05 20:15 . 2008-02-05 20:15 90,688 --a------ C:\WINDOWS\system32\wvcqxhgi.dll

2008-02-03 21:43 . 2007-10-10 16:55 6,065,664 --------- C:\WINDOWS\system32\dllcache\ieframe.dll

2008-02-03 21:43 . 2007-06-30 20:31 2,455,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dat

2008-02-03 21:43 . 2007-06-30 20:36 991,232 --------- C:\WINDOWS\system32\dllcache\ieframe.dll.mui

2008-02-03 21:43 . 2007-10-10 16:55 459,264 --------- C:\WINDOWS\system32\dllcache\msfeeds.dll

2008-02-03 21:43 . 2007-10-10 16:55 383,488 --------- C:\WINDOWS\system32\dllcache\ieapfltr.dll

2008-02-03 21:43 . 2007-10-10 16:55 267,776 --------- C:\WINDOWS\system32\dllcache\iertutil.dll

2008-02-03 21:43 . 2007-10-10 16:55 63,488 --------- C:\WINDOWS\system32\dllcache\icardie.dll

2008-02-03 21:43 . 2007-10-10 16:55 52,224 --------- C:\WINDOWS\system32\dllcache\msfeedsbs.dll

2008-02-03 21:43 . 2007-10-10 03:59 13,824 --------- C:\WINDOWS\system32\dllcache\ieudinit.exe

2008-02-03 20:23 . 2008-02-03 20:23 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon

2008-02-03 20:21 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll

2008-02-01 22:03 . 2008-02-01 22:03 <DIR> d-------- C:\WINDOWS\system32\nGpxx01

2008-02-01 22:03 . 2008-02-03 17:53 <DIR> d-------- C:\Temp

2008-01-14 19:44 . 2008-01-14 19:44 1,158 --a------ C:\WINDOWS\mozver.dat

2008-01-12 00:56 . 2008-01-12 00:56 <DIR> d--h----- C:\WINDOWS\PIF

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2008-02-09 04:08 8,496 ----a-w C:\Documents and Settings\**** ******\Application Data\wklnhst.dat

2008-02-09 03:48 --------- d-----w C:\Program Files\Yahoo!

2008-02-09 02:05 --------- d-----w C:\Program Files\Common Files\PestPatrol

2008-02-08 22:23 --------- d-----w C:\Program Files\Common Files\Command Software

2008-02-04 00:43 --------- d-----w C:\Documents and Settings\**** ******\Application Data\uTorrent

2007-12-23 07:58 --------- d-----w C:\Documents and Settings\**** ******\Application Data\Yahoo!

2007-03-01 16:18 63,624 ----a-w C:\Documents and Settings\**** ******\Application Data\GDIPFONTCACHEV1.DAT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5187800A-5B6D-4996-BAC7-850294D477C3}]

C:\WINDOWS\system32\mljgd.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{61ADDA09-8B2B-4C80-A9A3-44F40A213035}]

C:\WINDOWS\system32\jkkjg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{879957D5-612A-4898-820E-63AE053ADE2A}]

C:\WINDOWS\system32\vturp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{960E4924-EDF9-4616-BD5E-DE763AA89A10}]

C:\WINDOWS\system32\vtstr.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 00:24 20480]

"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 17:23 102400]

"CTSyncU.exe"="C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe" [2006-06-12 13:32 700416]

"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 10:09 460784]

"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24 1694208]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 03:00 15360]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"IndexCleaner"="C:\Program Files\TELUS\TELUS Security service\IndexCleanerR.exe" [2005-05-19 14:50 53248]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 15:48 32881]

"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 09:55 667718]

"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 09:56 602182]

"SigmatelSysTrayApp"="stsystra.exe" [2005-11-16 12:35 397312 C:\WINDOWS\stsystra.exe]

"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 09:56 761947]

"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 12:43 45056]

"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 18:15 290816]

"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 18:29 49152]

"RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2006-06-14 18:53 26112]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-06-14 18:54 98304]

"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-05 23:05 127035]

"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 14:50 221184]

"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 14:50 81920]

"PrinTray"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\2\printray.exe" [2000-09-14 16:03 36864]

"Motive SmartBridge"="C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe" [2007-03-11 17:32 393216]

"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-08-12 15:16 1121792]

"TEPA.exe"="C:\Program Files\TELUS\eProtect Advisor\TEPA.exe" [2007-03-20 16:48 2061816]

"TELUS Security service"="C:\Program Files\TELUS\TELUS Security service\Freedom.exe" [2005-05-19 14:56 180278]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]

"IndexCleaner"="C:\Program Files\TELUS\TELUS Security service\IndexCleanerR.exe" [2005-05-19 14:50 53248]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-06-14 18:52:32 24576]

Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 23:01:04 83360]

TELUS eCare.lnk - C:\Program Files\TELUS eCare\bin\matcli.exe [2007-01-24 21:01:59 217088]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08

**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2008-02-09 21:57:49

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

------------------------ Other Running Processes ------------------------

C:\WINDOWS\system32\Ati2evxx.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Common Files\Command Software\dvpapi.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\Program Files\TELUS eCare\bin\mpbtn.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\system32\wscntfy.exe

**************************************************************************

Completion time: 2008-02-09 21:59:51 - machine was rebooted

ComboFix-quarantined-files.txt 2008-02-10 04:59:47

2008-02-05 05:07:25 --- E O F ---

Step 2:

Removed these suspicious files from the firewall that were allowed access

Application Layer Gateway Service that was receiving from program in C:\Windows\System32\alg.exe

Utorrent

ffinstaller

downldr

Veoh Client

Updater Sys Rep

CLI Application

Au_

Run a DLL As An App

Step 3:

Downloaded and ran ATF cleaner.

At the end of the cleaning it stated that it Freed 4,696,000 KB's

Step 4:

Rebooted and ran a new Hijackthis Scan

This is the log that followed.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:19:35 PM, on 09/02/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe

C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\CTsvcCDA.exe

C:\Program Files\Common Files\Command Software\dvpapi.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe

C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe

C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe

C:\WINDOWS\stsystra.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

C:\Program Files\Real\RealPlayer\RealPlay.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\PROGRA~1\TELUSE~1\SMARTB~1\MotiveSB.exe

C:\Program Files\TELUS\eProtect Advisor\TEPA.exe

C:\Program Files\TELUS\TELUS Security service\Freedom.exe

C:\Program Files\NetWaiting\netWaiting.exe

C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\TELUS eCare\bin\mpbtn.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\Program Files\ATI Technologies\ATI.ACE\cli.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.ca/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell.ca/myway

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1

R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: Pop-Up Blocker BHO - {3C060EA2-E6A9-4E49-A530-D4657B8C449A} - C:\Program Files\TELUS\TELUS Security service\pkR.dll

O2 - BHO: (no name) - {4D25F921-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll

O2 - BHO: (no name) - {5187800A-5B6D-4996-BAC7-850294D477C3} - C:\WINDOWS\system32\mljgd.dll (file missing)

O2 - BHO: Form Filler BHO - {56071E0D-C61B-11D3-B41C-00E02927A304} - C:\Program Files\TELUS\TELUS Security service\FreeBHOR.dll

O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll

O2 - BHO: (no name) - {61ADDA09-8B2B-4C80-A9A3-44F40A213035} - C:\WINDOWS\system32\jkkjg.dll (file missing)

O2 - BHO: (no name) - {879957D5-612A-4898-820E-63AE053ADE2A} - C:\WINDOWS\system32\vturp.dll (file missing)

O2 - BHO: (no name) - {960E4924-EDF9-4616-BD5E-DE763AA89A10} - C:\WINDOWS\system32\vtstr.dll (file missing)