Hej og tak
Jeg har kørt hele proceduren igennem. Det ser umiddelbart ud som om det kører bedre nu, men HiJackThis loggen finder stadig de onde O2 og O20 - nu står der bare file missing ved dem. Er alt OK nu? Logs herunder.
Mht. til SP1, så er det kun fordi jeg har oplevet så mange problemer i forbindelse med opdateringer af alt muligt, at jeg nu lever 100% efter "If it ain't broke, don't fix it". Og SP1 har kørt upåklageligt i årevis (-: Men nu prøver jeg at følge dit råd.
-----
ComboFix 08-05-19.4 - Anders O 2008-05-20 14:50:55.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1030.18.2671 [GMT 2:00]
Running from: C:\Documents and Settings\Anders O\Skrivebord\AntiTrojan\ComboFix.exe
* Created a new restore point
* Resident AV is active
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bjdexmhm.dll
C:\WINDOWS\system32\cgafcghs.ini
C:\WINDOWS\system32\kikimkwc.dll
C:\WINDOWS\system32\knfdrnmu.ini
C:\WINDOWS\system32\ktgqhyde.dll
C:\WINDOWS\system32\pqmxyibo.ini
C:\WINDOWS\system32\pyeotufj.ini
C:\WINDOWS\system32\qjvjychn.ini
C:\WINDOWS\system32\TCfgNXyb.ini
C:\WINDOWS\system32\TCfgNXyb.ini2
C:\WINDOWS\system32\ubbvauhr.dll
C:\WINDOWS\system32\xfbhaegu.ini
C:\WINDOWS\system32\xtoslghm.ini
.
((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
.
2008-05-20 13:21 . 2008-05-20 13:21 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-20 13:20 . 2008-05-20 13:20 <DIR> d-------- C:\Programmer\SUPERAntiSpyware
2008-05-20 13:20 . 2008-05-20 13:20 <DIR> d-------- C:\Documents and Settings\Anders O\Application Data\SUPERAntiSpyware.com
2008-05-20 13:11 . 2008-05-20 13:11 <DIR> d-------- C:\Programmer\CCleaner
2008-05-19 14:15 . 2008-05-19 15:05 <DIR> d-------- C:\!KillBox
2008-05-16 16:00 . 2008-05-16 16:00 <DIR> d-------- C:\Programmer\Spybot - Search & Destroy
2008-05-16 16:00 . 2008-05-16 16:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-16 12:04 . 2008-05-16 12:04 90,624 --------- C:\WINDOWS\system32\nhcyjvjq.dll
2008-05-16 12:01 . 2008-05-16 12:01 19 --a------ C:\WINDOWS\system32\58267ee0
2008-05-16 11:58 . 2008-05-16 11:58 125,952 --a------ C:\WINDOWS\system32\kgsdyddd.dll
2008-05-14 09:26 . 2008-05-14 09:26 133,632 --a------ C:\WINDOWS\system32\aqmtajds.dll
2008-05-14 09:20 . 2008-05-14 09:20 114,176 --------- C:\WINDOWS\system32\obiyxmqp.dll
2008-05-14 09:18 . 2008-05-14 09:18 123,392 --a------ C:\WINDOWS\system32\djuiqgep.dll
2008-05-13 16:01 . 2008-05-13 16:01 131,584 --a------ C:\WINDOWS\system32\tovnmrjx.dll
2008-05-13 15:58 . 2008-05-13 15:58 125,952 --a------ C:\WINDOWS\system32\svovshlh.dll
2008-05-09 15:10 . 2008-05-09 15:10 133,120 --a------ C:\WINDOWS\system32\fxvicevk.dll
2008-05-09 15:01 . 2008-05-09 15:01 123,392 --a------ C:\WINDOWS\system32\lywibmwj.dll
2008-05-09 14:00 . 2008-05-09 14:00 133,120 --a------ C:\WINDOWS\system32\pooilenw.dll
2008-05-09 13:52 . 2008-05-09 13:52 123,392 --a------ C:\WINDOWS\system32\ialnjuyq.dll
2008-05-09 06:59 . 2008-05-09 06:59 132,096 --a------ C:\WINDOWS\system32\mnttffae.dll
2008-05-09 06:53 . 2008-05-19 13:18 109,816 --a------ C:\WINDOWS\BM5b155ff2.xml
2008-05-05 10:51 . 2008-05-07 10:32 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-05 10:51 . 2008-05-05 10:51 37,888 --a------ C:\WINDOWS\system32\rar.exe
2008-05-05 10:04 . 2002-08-29 01:48 14,208 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-05-05 10:04 . 2002-08-29 01:48 14,208 --a--c--- C:\WINDOWS\system32\dllcache\usbscan.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-20 11:20 --------- d-----w C:\Programmer\Fælles filer\Wise Installation Wizard
2008-05-20 11:06 --------- d-----w C:\Programmer\eMule
2008-05-16 12:22 --------- d-----w C:\Programmer\SummaSummarum
2008-05-13 14:11 --------- d-----w C:\Programmer\Eset
2008-05-09 11:04 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2008-05-09 11:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-05 14:52 34,816 ----a-w C:\WINDOWS\system32\WinUpdating.exe
2007-04-19 12:59 72,776 ----a-w C:\Documents and Settings\Anders O\Application Data\GDIPFONTCACHEV1.DAT
.
[code]<pre>
----a-r 316,075 2005-08-07 16:56:08 C:\Photoshop CS2 Plug-ins\photoshop cs2 filtri\Adobe Photoshop CS2 Jpeg2000 Plugin\Internet Explorer JPEG2000 Plug-in .exe
</pre>[/code]
------- Sigcheck -------
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0B9947A9-12A2-4F38-B385-351803798AAE}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{52705A00-5C30-4E97-A297-F39831EFA151}]
C:\WINDOWS\System32\byXNgfCT.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Programmer\Messenger\msmsgs.exe" [2002-08-20 16:08 1511453]
"swg"="C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 09:28 68856]
"SpybotSD TeaTimer"="C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"SUPERAntiSpyware"="C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-02-29 16:03 1481968]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2006-06-28 08:54 16248320 C:\WINDOWS\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2006-08-08 15:54 1519616 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2006-08-08 15:54 86016]
"Acrobat Assistant 7.0"="C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 03:12 483328]
"QuickTime Task"="C:\Programmer\QuickTime\qttask.exe" [2006-10-25 19:58 282624]
"nod32kui"="C:\Programmer\Eset\nod32kui.exe" [2006-11-13 16:33 921600]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2006-08-08 15:54 7630848]
C:\Documents and Settings\Anders O\Menuen Start\Programmer\Start\
Last.fm Helper.lnk - C:\Programmer\Last.fm\LastFMHelper.exe [2007-07-30 19:07:57 106496]
C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2006-11-12 13:49:50 25214]
Adobe Gamma Loader.lnk - C:\Programmer\F‘lles filer\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-13 18:14:51 113664]
Color Calibration.lnk - C:\Programmer\SEC\MT4.0\GammaTray.exe [2006-11-14 14:50:51 36864]
Microsoft Office.lnk - C:\Programmer\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"WinUpdating"= WinUpdating.exe
"Windows Printing Driver"= WinSpooler.exe
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Programmer\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\fccdbCRi]
fccdbCRi.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^Last.fm Helper.lnk]
path=C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\Last.fm Helper.lnk
backup=C:\WINDOWS\pss\Last.fm Helper.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^LightSurf.lnk]
path=C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\LightSurf.lnk
backup=C:\WINDOWS\pss\LightSurf.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menuen Start^Programmer^Start^MagicTune4.0.lnk]
path=C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\MagicTune4.0.lnk
backup=C:\WINDOWS\pss\MagicTune4.0.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-10-30 10:36 256576 C:\Programmer\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2002-08-20 16:08 1511453 C:\Programmer\Messenger\msmsgs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2006-08-08 15:54 7630848 C:\WINDOWS\System32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
-ra------ 2006-05-16 12:04 2879488 C:\WINDOWS\SkyTel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-07-12 04:00 132496 C:\Programmer\Java\jre1.6.0_02\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2007-07-30 09:28 68856 C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"IDriverT"=3 (0x3)
"gusvc"=3 (0x3)
"Atmcigwdetdm"=3 (0x3)
"Adobe LM Service"=3 (0x3)
*Newly Created Service* - ALG
*Newly Created Service* - IPNAT
.
Contents of the 'Scheduled Tasks' folder
"2008-04-20 11:51:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Programmer\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-05-20 14:54:43
Windows 5.1.2600 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP.NEW 3568 bytes
scan completed successfully
hidden files: 1
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Programmer\Eset\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmer\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
.
**************************************************************************
.
Completion time: 2008-05-20 14:57:26 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-20 12:57:21
Pre-Run: 41,483,083,776 byte ledig
Post-Run: 41,451,876,352 byte ledig
167
---------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:45:19, on 20-05-2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmer\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
C:\Programmer\QuickTime\qttask.exe
C:\Programmer\Eset\nod32kui.exe
C:\Programmer\Messenger\msmsgs.exe
C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Programmer\SEC\MT4.0\GammaTray.exe
C:\Programmer\Last.fm\LastFMHelper.exe
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\MICROS~2\Office10\OUTLOOK.EXE
C:\Programmer\Microsoft Office\Office10\WINWORD.EXE
C:\Programmer\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Anders O\Skrivebord\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Hyperlinks
O2 - BHO: (no name) - {0B9947A9-12A2-4F38-B385-351803798AAE} - (no file)
O2 - BHO: (no name) - {52705A00-5C30-4E97-A297-F39831EFA151} - C:\WINDOWS\System32\byXNgfCT.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programmer\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programmer\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {DD4A65C7-61D7-445F-BCF1-5065F765EAF9} - [SASInprocServer32] (file missing)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programmer\google\googletoolbar2.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programmer\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmer\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [nod32kui] "C:\Programmer\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmer\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Programmer\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programmer\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Programmer\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Policies\Explorer\Run: [WinUpdating] WinUpdating.exe
O4 - HKCU\..\Policies\Explorer\Run: [Windows Printing Driver] WinSpooler.exe
O4 - Startup: Last.fm Helper.lnk = C:\Programmer\Last.fm\LastFMHelper.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Adobe Gamma Loader.lnk = ?
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Programmer\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Convert link target to Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF -
res://C:\Programmer\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmer\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programmer\Spybot - Search & Destroy\SDHelper.dll
O16 - DPF: {D8575CE3-3432-4540-88A9-85A1325D3375} (e-Safekey) -
https://netbank.danskebank.dk/html/activex/e-Safekey/DB/e-Safekey.cabO20 - Winlogon Notify: fccdbCRi - fccdbCRi.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Programmer\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmer\Fælles filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Programmer\iPod\bin\iPodService.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Programmer\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
-----
SUPERAntiSpyware Scan Log
http://www.superantispyware.comGenerated 05/20/2008 at 01:52 PM
Application Version : 4.0.1154
Core Rules Database Version : 3464
Trace Rules Database Version: 1455
Scan type : Complete Scan
Total Scan Time : 00:23:49
Memory items scanned : 160
Memory threats detected : 2
Registry items scanned : 4256
Registry threats detected : 12
File items scanned : 13282
File threats detected : 15
Trojan.Vundo-Variant/Small-GEN
C:\WINDOWS\SYSTEM32\FCCDBCRI.DLL
C:\WINDOWS\SYSTEM32\FCCDBCRI.DLL
Software\Microsoft\Windows NT\CurrentVersion\WinLogon\Notify\fccdbCRi
Adware.Vundo Variant/Resident
C:\WINDOWS\SYSTEM32\BYXNGFCT.DLL
C:\WINDOWS\SYSTEM32\BYXNGFCT.DLL
Adware.Vundo Variant
HKLM\Software\Classes\CLSID\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}
HKCR\CLSID\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}
HKCR\CLSID\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}\InprocServer32
HKCR\CLSID\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}
HKCR\CLSID\{DD4A65C7-61D7-445F-BCF1-5065F765EAF9}
Trojan.Vundo-Variant/Small
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52705A00-5C30-4E97-A297-F39831EFA151}
HKCR\CLSID\{52705A00-5C30-4E97-A297-F39831EFA151}
HKCR\CLSID\{52705A00-5C30-4E97-A297-F39831EFA151}\InprocServer32
HKCR\CLSID\{52705A00-5C30-4E97-A297-F39831EFA151}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\AWTTRQQN.DLL
C:\WINDOWS\SYSTEM32\EFCBQQRO.DLL
C:\WINDOWS\SYSTEM32\HGGVWTTQ.DLL
C:\WINDOWS\SYSTEM32\IIFFGYON.DLL
C:\WINDOWS\SYSTEM32\KHFDWXWN.DLL
C:\WINDOWS\SYSTEM32\KHFEVWUK.DLL
C:\WINDOWS\SYSTEM32\QOMCCYRH.DLL
C:\WINDOWS\SYSTEM32\QOMDBRLE.DLL
C:\WINDOWS\SYSTEM32\RQRLDWUK.DLL
C:\WINDOWS\SYSTEM32\RQRQNOHE.DLL
C:\WINDOWS\SYSTEM32\TUVTMLDE.DLL
C:\WINDOWS\SYSTEM32\TUVTRIHH.DLL
C:\WINDOWS\SYSTEM32\URQQQOIG.DLL
