Hi,

My laptop is doing very strange things and it looks like there is some malware that I can not get rid of. Could you please check my logs and tell me what to do? The uninstall manager log is in .jpg because I can not save the log...

First of all Did you reboot the system after running the MBA-M program?
Also TURN OFF that SpyBot TeaTimer program and leave it off. It can interfere with any fixes done.
Open Spybot, Choose Advanced Mode. Then click Tools. On the left side click Resident. Take the checkmark OUT of TeaTimer. Close the program and Reboot the computer. Then run a new MBA-M scan, fix everything found. Run a new HJT scan. Post back here with both logs. Please DON'T attach them. Please copy/paste each log.
Judy

After trying for some time to start in normal mode, I had to do the MBA-M in safe mode... I hope it of use anyway...

Malwarebytes' Anti-Malware 1.28
Versión de la Base de Datos: 1253
Windows 5.1.2600 Service Pack 3

10/25/2008 4:58:56 PM
mbam-log-2008-10-25 (16-58-56).txt

Tipo de examen : Examen Completo (C:\|D:\|)
Objetos examinados: 73483
Tiempo transcurrido: 1 hour(s), 13 minute(s), 31 second(s)

Procesos en Memoria Infectados: 0
Módulos en Memoria Infectados: 1
Claves del Registro Infectadas: 7
Valores del Registro Infectados: 0
Elementos de Datos del Registro Infectados: 2
Carpetas Infectadas: 0
Ficheros Infectados: 8

Procesos en Memoria Infectados:
(No se han detectado elementos maliciosos)

Módulos en Memoria Infectados:
C:\WINDOWS\system32\iifdddEt.dll (Trojan.Vundo.H) -> Delete on reboot.

Claves del Registro Infectadas:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1eabadd2-1c9c-4c56-a5b4-b23837b34e09} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1eabadd2-1c9c-4c56-a5b4-b23837b34e09} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Valores del Registro Infectados:
(No se han detectado elementos maliciosos)

Elementos de Datos del Registro Infectados:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iifdddet -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\iifdddet -> Delete on reboot.

Carpetas Infectadas:
(No se han detectado elementos maliciosos)

Ficheros Infectados:
C:\WINDOWS\system32\iifdddEt.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\tEdddfii.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\tEdddfii.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\alvwllvn.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nvllwvla.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrador\Configuración local\Archivos temporales de Internet\Content.IE5\6NGNSTOD\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS4064.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\TDSS9f2d.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.





Logfile of HijackThis v1.99.1
Scan saved at 5:37:04 PM, on 10/25/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Archivos de programa\Google\Update\GoogleUpdate.exe
C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\RAMASST.exe
C:\HJT\HijackThis.exe


R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsue.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
O2 - BHO: {ec584d1b-a865-16b9-5124-c806d82ba0d9} - {9d0ab28d-608c-4215-9b61-568ab1d485ce} - C:\WINDOWS\system32\pkdkdn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Archivos de programa\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [THotkey] C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E963EE0-F698-40FA-8DE4-BBBC3D2D2899}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: pkdkdn.dll
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: ssqPgGXr - C:\WINDOWS\SYSTEM32\ssqPgGXr.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Update Service (gupdate1c8e071a1913dc0) (gupdate1c8e071a1913dc0) - Unknown owner - C:\Archivos de programa\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe

Sorry I posted it twice...

You need to delete that old version of HiJackThis and download and scan with the newest version which is version 2.0.2
http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis

OK done!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:04:19 PM, on 10/27/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Archivos de programa\Google\Update\GoogleUpdate.exe
C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\Eset\nod32kui.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsue.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: (no name) - {998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
O2 - BHO: {ec584d1b-a865-16b9-5124-c806d82ba0d9} - {9d0ab28d-608c-4215-9b61-568ab1d485ce} - C:\WINDOWS\system32\pkdkdn.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Archivos de programa\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
O4 - HKLM\..\Run: [nod32kui] "C:\Archivos de programa\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Archivos de programa\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [THotkey] C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Cursors" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Srchasst" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\msagent" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\Oobe" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Help\Tours" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_07] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Connection Wizard" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_08] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\system32\NtmsData" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_09] cmd.exe /c md "%SystemDrive%\WINDOWS\Temp" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_10] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_11] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_12] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_13] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_14] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'SERVICIO LOCAL')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Servicio de red')
O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] rundll32 advpack.dll,DelNodeRunDLL32 "C:\WINDOWS\Cursors" (User 'Servicio de red')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.5.0_07\bin\ssv.dll
O9 - Extra button: Referencia - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\ARCHIV~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E963EE0-F698-40FA-8DE4-BBBC3D2D2899}: NameServer = 208.67.222.222,208.67.220.220
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\ARCHIV~1\ARCHIV~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: pkdkdn.dll
O20 - Winlogon Notify: ssqPgGXr - C:\WINDOWS\SYSTEM32\ssqPgGXr.dll
O23 - Service: DVD-RAM_Service - Matsu****a Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Google Update Service (gupdate1c8e071a1913dc0) (gupdate1c8e071a1913dc0) - Google Inc. - C:\Archivos de programa\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Archivos de programa\Archivos comunes\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Archivos de programa\Eset\nod32krn.exe
O23 - Service: PACSPTISVR - Unknown owner - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SsBeSvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Archivos de programa\Archivos comunes\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe

--
End of file - 9220 bytes

Download ComboFix (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Click on the Save button and then when it asks you where to save it, make sure you save it directly to your Windows Desktop.
Once the download is complete you will see the Combofix on the desktop.


Close all open Windows including this one.
Close or disable all running Antivirus, Antispyware, and Firewall programs as they may interfere with the proper running of ComboFix.
Doubleclick the combofix icon on the desktop to run the program.




Windows will issue a prompt asking whether you wish to run the program, click Run
You will then see a Disclaimer screen asking you to agree to the disclaimer. Press the number 1 key to accept the disclaimer.

Now just sit back and allow the program to run

Please note, that once you start ComboFix you should not click anywhere on the ComboFix window as it can cause the program to stall. In fact, when ComboFix is running, do not touch your computer at all and just take a break as it may take a while for it to complete.

When ComboFix has finished running, you will see a screen stating that it is preparing the log report.
This can take a while, so please be patient. If you see your Windows desktop disappear, do not worry. This is normal and ComboFix will restore your desktop before it is finished. Eventually you will see a new screen that states the program is almost finished and telling you the programs log file, or report, will be located at C:\ComboFix.txt.

When all is complete then please post back here with that log.

I post 2 logs because I realized right after the first scan that I forgot to disable the antivirus...

ComboFix 08-10-28.01 - Administrador 2008-10-28 20:36:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.239 [GMT 1:00]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\ComboFix.exe
* Resident AV is active


ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrador\Datos de programa\.#
C:\WINDOWS\system32\bofnkqeq.ini
C:\WINDOWS\system32\bpkkgxnx.ini
C:\WINDOWS\system32\czzong.dll
C:\WINDOWS\system32\doxugwve.dll
C:\WINDOWS\system32\evwguxod.ini
C:\WINDOWS\system32\gjglpngb.dll
C:\WINDOWS\system32\gtyaowxn.dll
C:\WINDOWS\system32\hgGwWQjJ.dll
C:\WINDOWS\system32\iaklkwob.ini
C:\WINDOWS\system32\iuzgoo.dll
C:\WINDOWS\system32\jkkLCvvw.dll
C:\WINDOWS\system32\mendevlc.ini
C:\WINDOWS\system32\mTuDLkkj.ini
C:\WINDOWS\system32\mTuDLkkj.ini2
C:\WINDOWS\system32\mujyrp.dll
C:\WINDOWS\system32\pkdkdn.dll
C:\WINDOWS\system32\pmnkIXOf.dll
C:\WINDOWS\system32\pwnlhwug.dll
C:\WINDOWS\system32\qaioiron.dll
C:\WINDOWS\system32\qeqknfob.dll
C:\WINDOWS\system32\smcflf.dll
C:\WINDOWS\system32\ssqPgGXr.dll
C:\WINDOWS\system32\uplvmraw.dll
C:\WINDOWS\system32\vtUlJcCv.dll
C:\WINDOWS\system32\windows_update.exe
C:\WINDOWS\system32\xxywUOgH.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Servicios )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Service_TDSSserv


(((((((((((((((((( Archivos creados desde 2008-09-28 - 2008-10-28 )))))))))))))))))))))))))))))))))
.

2008-10-28 20:39 . 2008-10-28 20:41 396 --ahs---- C:\WINDOWS\system32\mTuDLkkj.ini
2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\sgnxfoif.dll
2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\jgqaho.dll
2008-10-27 20:05 . 2008-10-27 20:05 267,776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll
2008-10-27 20:04 . 2008-10-27 20:04 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-10-27 20:03 . 2008-10-27 20:03 812,344 --a------ C:\HJTInstall.exe
2008-10-12 12:25 . 2008-10-12 12:25 <DIR> d-------- C:\Program Files
2008-10-12 10:29 . 2008-10-12 12:24 <DIR> d-------- C:\Archivos de programa\EsetOnlineScanner
2008-10-12 09:44 . 2008-10-12 09:45 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware
2008-10-12 09:44 . 2008-09-09 23:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-12 09:44 . 2008-09-09 23:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-12 09:28 . 2008-10-12 09:28 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa\Malwarebytes
2008-10-12 09:27 . 2008-10-12 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
2008-10-11 20:22 . 2008-10-11 20:22 95 --a------ C:\WINDOWS\wininit.ini
2008-10-11 19:48 . 2008-10-11 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
2008-10-11 19:48 . 2008-10-11 19:48 <DIR> d-------- C:\Archivos de programa\Spybot - Search & Destroy
2008-10-09 17:05 . 2008-10-09 17:05 <DIR> d-------- C:\Archivos de programa\ScanSoft
2008-10-09 17:00 . 2008-10-09 17:01 <DIR> d-------- C:\Archivos de programa\Microsoft AutoRoute
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\restore
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\srchasst
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\msagent
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\Archivos de programa\microsoft frontpage
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\oobe
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\es
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\bits
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\l2schemas
2008-10-07 20:23 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-07 20:16 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\EHome
2008-10-05 22:10 . 2008-10-05 22:10 <DIR> d-------- C:\Archivos de programa\ElcomSoft
2008-10-05 21:44 . 2008-10-05 21:44 99 --a------ C:\pdfinfo.ini
2008-10-05 21:44 . 2008-10-05 21:45 81 --a------ C:\WINDOWS\winDecrypt.INI
2008-10-05 21:42 . 2008-10-05 21:42 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat
2008-10-05 21:42 . 2008-10-05 21:54 36 --a------ C:\WINDOWS\verypdf.ini
2008-10-05 21:41 . 2008-10-12 09:10 <DIR> d-------- C:\Archivos de programa\PDF Password Remover v2.5
2008-10-05 20:03 . 2008-04-14 03:18 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-10-05 20:02 . 2008-04-14 03:18 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2008-10-05 20:01 . 2008-04-14 03:18 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-10-05 20:01 . 2008-04-13 19:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
2008-10-05 20:01 . 2008-04-13 19:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
2008-10-05 20:01 . 2008-04-14 03:18 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 19:36 --------- d-----w C:\Archivos de programa\Eset
2008-10-27 19:06 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Google Updater
2008-10-12 08:10 --------- d-----w C:\Archivos de programa\Google
2008-10-10 22:38 90,112 ----a-w C:\WINDOWS\DUMP6d24.tmp
2008-10-10 22:37 98,304 ----a-w C:\WINDOWS\DUMP2334.tmp
2008-10-10 22:36 98,304 ----a-w C:\WINDOWS\DUMP3407.tmp
2008-10-10 21:11 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\uTorrent
2008-10-07 19:43 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd9725.sys
2008-09-30 18:13 --------- d-----w C:\Archivos de programa\Picasa2
2008-09-17 17:17 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-09-16 21:08 --------- d-----w C:\Archivos de programa\uTorrent
2008-09-04 18:19 --------- d-----w C:\Archivos de programa\Pando Networks
2008-08-05 20:05 53,248 ----a-w C:\WINDOWS\system32\suppdll.dll
2008-08-05 20:05 35,363 ----a-w C:\WINDOWS\system32\windrvNT.sys
.

((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2A1F85C5-E150-4939-AAAB-38C245BED4CE}]
2008-10-27 20:05 267776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7564a552-336f-41d4-b91a-1d409d5bb548}]
2008-10-28 20:42 113152 --a------ C:\WINDOWS\system32\djntzp.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Archivos de programa\Eset\nod32kui.exe" [2008-06-04 921600]
"SoundMAXPnP"="C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 126976]
"THotkey"="C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe" [2004-12-14 368640]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Men£ Inicio\Programas\Inicio\
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-06-05 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jgqaho.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkkLDuTm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
"C:\\Archivos de programa\\Pando Networks\\Pando\\pando.exe"=
"C:\\Archivos de programa\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\Malwarebytes' Anti-Malware\\mbam.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57214:TCP"= 57214:TCP:Pando P2P TCP Listening Port
"57214:UDP"= 57214:UDP:Pando P2P UDP Listening Port
"4662:TCP"= 4662:TCP:uTORRENT

S2 gupdate1c8e071a1913dc0;Google Update Service (gupdate1c8e071a1913dc0);C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 133104]
S3 iscFlash;iscFlash;C:\WINDOWS\Temp\isc10tmp\iscflash.sys [ ]
S3 mpr_freader;MPR FileReader Driver;C:\Archivos de programa\Multi Password Recovery\mpr_freader.sys [ ]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e6caec0-3340-11dd-ab62-963b1372dd69}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e6caec2-3340-11dd-ab62-963b1372dd69}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
Contenido de carpeta 'Tareas Programadas'

2008-10-28 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
- C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 23:42]
.
- - - - HUÉRFANOS ELIMINADOS - - - -

BHO-{998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll
BHO-{BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6} - (no file)
HKLM-Run-Tvs - C:\Program Files\Toshiba\Tvs\TvsTray.exe
HKLM-Run-64769aed - C:\WINDOWS\system32\qeqknfob.dll
ShellExecuteHooks-{998DAE3E-7D4F-4952-A71F-467D8FE64407} - C:\WINDOWS\system32\ssqPgGXr.dll


.
------- Análisis Suplementario -------
.
FireFox -: Profile - C:\Documents and Settings\Administrador\Datos de programa\Mozilla\Firefox\Profiles\n1ai0fhk.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
FF -: plugin - C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Archivos de programa\Google\Google Earth Plugin\npgeplugin.dll
FF -: plugin - C:\Archivos de programa\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
FF -: plugin - C:\Archivos de programa\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava11.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava12.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava13.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava14.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava32.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJPI150_07.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPOJI610.dll
FF -: plugin - C:\Archivos de programa\Mozilla Firefox\plugins\npPandoWebInst.dll
FF -: plugin - C:\Archivos de programa\Picasa2\npPicasa2.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 20:40:47
Windows 5.1.2600 Service Pack 3 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...


C:\sccfg.sys 370 bytes
C:\WINDOWS\system32\vscvswrh.dll 113152 bytes executable

el escaneo se completo con exito
archivos ocultos: 2

**************************************************************************
.
--------------------- DLLs cargados bajo los procesos en ejecución ---------------------

PROCESOS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\jkkLDuTm.dll
-> C:\Archivos de programa\Eset\pr_imon.dll

PROCESOS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\iqkautwf.dll
-> C:\WINDOWS\system32\jkkLDuTm.dll
.
------------------------ Otros procesos en ejecución ------------------------
.
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Tiempo completado: 2008-10-28 20:43:21 - Reiniciando la máquina
ComboFix-quarantined-files.txt 2008-10-28 19:43:13

Pre-Run: 3,005,747,200 bytes libres
Post-Run: 3,519,385,600 bytes libres

245 --- E O F --- 2008-10-09 17:30:22













ComboFix 08-10-28.01 - Administrador 2008-10-28 20:56:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.242 [GMT 1:00]
Se ejecuta desde: C:\Documents and Settings\Administrador\Escritorio\ComboFix.exe
* Resident AV is active


ADVERTENCIA - ESTE EQUIPO NO TIENE INSTALADA LA CONSOLA DE RECUPERACION!
.

(((((((((((((((((((((((((((((((((((( Otras eliminaciones )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\fwtuakqi.ini
C:\WINDOWS\system32\iqkautwf.dll
C:\WINDOWS\system32\mTuDLkkj.ini
C:\WINDOWS\system32\mTuDLkkj.ini2

.
(((((((((((((((((( Archivos creados desde 2008-09-28 - 2008-10-28 )))))))))))))))))))))))))))))))))
.

2008-10-28 20:59 . 2008-10-28 21:00 494 --ahs---- C:\WINDOWS\system32\mTuDLkkj.ini
2008-10-28 20:42 . 2008-10-28 20:42 113,152 --a------ C:\WINDOWS\system32\vscvswrh.dll
2008-10-28 20:42 . 2008-10-28 20:42 113,152 --a------ C:\WINDOWS\system32\djntzp.dll
2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\sgnxfoif.dll
2008-10-28 20:14 . 2008-10-28 20:14 113,152 --a------ C:\WINDOWS\system32\jgqaho.dll
2008-10-27 20:05 . 2008-10-27 20:05 267,776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll
2008-10-27 20:04 . 2008-10-27 20:04 <DIR> d-------- C:\Archivos de programa\Trend Micro
2008-10-27 20:03 . 2008-10-27 20:03 812,344 --a------ C:\HJTInstall.exe
2008-10-12 12:25 . 2008-10-12 12:25 <DIR> d-------- C:\Program Files
2008-10-12 10:29 . 2008-10-12 12:24 <DIR> d-------- C:\Archivos de programa\EsetOnlineScanner
2008-10-12 09:44 . 2008-10-12 09:45 <DIR> d-------- C:\Archivos de programa\Malwarebytes' Anti-Malware
2008-10-12 09:44 . 2008-09-09 23:04 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-10-12 09:44 . 2008-09-09 23:03 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-10-12 09:28 . 2008-10-12 09:28 <DIR> d-------- C:\Documents and Settings\Administrador\Datos de programa\Malwarebytes
2008-10-12 09:27 . 2008-10-12 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Malwarebytes
2008-10-11 20:22 . 2008-10-11 20:22 95 --a------ C:\WINDOWS\wininit.ini
2008-10-11 19:48 . 2008-10-11 19:53 <DIR> d-------- C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy
2008-10-11 19:48 . 2008-10-11 19:48 <DIR> d-------- C:\Archivos de programa\Spybot - Search & Destroy
2008-10-09 17:05 . 2008-10-09 17:05 <DIR> d-------- C:\Archivos de programa\ScanSoft
2008-10-09 17:00 . 2008-10-09 17:01 <DIR> d-------- C:\Archivos de programa\Microsoft AutoRoute
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\xircom
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\system32\restore
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\srchasst
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\WINDOWS\msagent
2008-10-07 20:43 . 2008-10-07 20:43 <DIR> d-------- C:\Archivos de programa\microsoft frontpage
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\oobe
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\es
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\system32\bits
2008-10-07 20:26 . 2008-10-07 20:26 <DIR> d-------- C:\WINDOWS\l2schemas
2008-10-07 20:23 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-10-07 20:16 . 2008-10-07 20:27 <DIR> d-------- C:\WINDOWS\EHome
2008-10-05 22:10 . 2008-10-05 22:10 <DIR> d-------- C:\Archivos de programa\ElcomSoft
2008-10-05 21:44 . 2008-10-05 21:44 99 --a------ C:\pdfinfo.ini
2008-10-05 21:44 . 2008-10-05 21:45 81 --a------ C:\WINDOWS\winDecrypt.INI
2008-10-05 21:42 . 2008-10-05 21:42 1,024 --a------ C:\WINDOWS\system32\pwdremover.dat
2008-10-05 21:42 . 2008-10-05 21:54 36 --a------ C:\WINDOWS\verypdf.ini
2008-10-05 21:41 . 2008-10-12 09:10 <DIR> d-------- C:\Archivos de programa\PDF Password Remover v2.5
2008-10-05 20:03 . 2008-04-14 03:18 4,274,816 --------- C:\WINDOWS\system32\nv4_disp.dll
2008-10-05 20:02 . 2008-04-14 03:18 1,888,992 --------- C:\WINDOWS\system32\ati3duag.dll
2008-10-05 20:01 . 2008-04-14 03:18 136,192 --------- C:\WINDOWS\system32\aaclient.dll
2008-10-05 20:01 . 2008-04-13 19:36 44,928 --------- C:\WINDOWS\system32\drivers\agpcpq.sys
2008-10-05 20:01 . 2008-04-13 19:36 42,368 --------- C:\WINDOWS\system32\drivers\agp440.sys
2008-10-05 20:01 . 2008-04-14 03:18 4,255 --------- C:\WINDOWS\system32\drivers\adv01nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,967 --------- C:\WINDOWS\system32\drivers\adv02nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,775 --------- C:\WINDOWS\system32\drivers\adv11nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,711 --------- C:\WINDOWS\system32\drivers\adv09nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,647 --------- C:\WINDOWS\system32\drivers\adv07nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,615 --------- C:\WINDOWS\system32\drivers\adv05nt5.dll
2008-10-05 20:01 . 2008-04-14 03:18 3,135 --------- C:\WINDOWS\system32\drivers\adv08nt5.dll

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 19:36 --------- d-----w C:\Archivos de programa\Eset
2008-10-27 19:06 --------- d-----w C:\Documents and Settings\All Users\Datos de programa\Google Updater
2008-10-12 08:10 --------- d-----w C:\Archivos de programa\Google
2008-10-10 22:38 90,112 ----a-w C:\WINDOWS\DUMP6d24.tmp
2008-10-10 22:37 98,304 ----a-w C:\WINDOWS\DUMP2334.tmp
2008-10-10 22:36 98,304 ----a-w C:\WINDOWS\DUMP3407.tmp
2008-10-10 21:11 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\uTorrent
2008-10-07 19:43 96,384 ----a-w C:\WINDOWS\system32\drivers\sptd9725.sys
2008-09-30 18:13 --------- d-----w C:\Archivos de programa\Picasa2
2008-09-17 17:17 --------- d-----w C:\Documents and Settings\Administrador\Datos de programa\Ahead
2008-09-16 21:08 --------- d-----w C:\Archivos de programa\uTorrent
2008-09-04 18:19 --------- d-----w C:\Archivos de programa\Pando Networks
2008-08-05 20:05 53,248 ----a-w C:\WINDOWS\system32\suppdll.dll
2008-08-05 20:05 35,363 ----a-w C:\WINDOWS\system32\windrvNT.sys
.

((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7564a552-336f-41d4-b91a-1d409d5bb548}]
2008-10-28 20:42 113152 --a------ C:\WINDOWS\system32\djntzp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A23CABA5-C51E-4CB5-A23B-ADFA4D8D9FCF}]
2008-10-27 20:05 267776 --a------ C:\WINDOWS\system32\jkkLDuTm.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nod32kui"="C:\Archivos de programa\Eset\nod32kui.exe" [2008-06-04 921600]
"SoundMAXPnP"="C:\Archivos de programa\Analog Devices\SoundMAX\SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-10-08 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-10-08 126976]
"THotkey"="C:\Archivos de programa\Toshiba\Toshiba Applet\thotkey.exe" [2004-12-14 368640]
"64769aed"="C:\WINDOWS\system32\jkiagxlr.dll" [2008-10-28 75264]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]

C:\Documents and Settings\All Users\Men£ Inicio\Programas\Inicio\
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2008-06-05 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableStatusMessages"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDesktopCleanupWizard"= 1 (0x1)
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoResolveTrack"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):58,50,69,7a,65,5f,4c,6f,67,6f,6e,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=jgqaho.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.X264"= x264vfw.dll
"VIDC.3iv2"= 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\jkkLDuTm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"DisableUnicastResponsesToMulticastBroadcast"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Archivos de programa\\Skype\\Phone\\Skype.exe"=
"C:\\Archivos de programa\\Pando Networks\\Pando\\pando.exe"=
"C:\\Archivos de programa\\uTorrent\\uTorrent.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Archivos de programa\\Malwarebytes' Anti-Malware\\mbam.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"57214:TCP"= 57214:TCP:Pando P2P TCP Listening Port
"57214:UDP"= 57214:UDP:Pando P2P UDP Listening Port
"4662:TCP"= 4662:TCP:uTORRENT

S2 gupdate1c8e071a1913dc0;Google Update Service (gupdate1c8e071a1913dc0);C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 133104]
S3 iscFlash;iscFlash;C:\WINDOWS\Temp\isc10tmp\iscflash.sys [ ]
S3 mpr_freader;MPR FileReader Driver;C:\Archivos de programa\Multi Password Recovery\mpr_freader.sys [ ]
S3 USBSTOR;Dispositivo de almacenamiento masivo de datos USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e6caec0-3340-11dd-ab62-963b1372dd69}]
\Shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e6caec2-3340-11dd-ab62-963b1372dd69}]
\Shell\AutoRun\command - F:\AutoRun.exe
.
Contenido de carpeta 'Tareas Programadas'

2008-10-28 C:\WINDOWS\Tasks\GoogleUpdateTaskMachine.job
- C:\Archivos de programa\Google\Update\GoogleUpdate.exe [2008-08-29 23:42]
.
.
------- Análisis Suplementario -------
.
FireFox -: Profile - C:\Documents and Settings\Administrador\Datos de programa\Mozilla\Firefox\Profiles\n1ai0fhk.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
FF -: plugin - C:\Archivos de programa\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
FF -: plugin - C:\Archivos de programa\Google\Google Earth Plugin\npgeplugin.dll
FF -: plugin - C:\Archivos de programa\Google\Google Updater\2.2.1273.1045\npCIDetect12.dll
FF -: plugin - C:\Archivos de programa\Google\Update\1.2.131.25\npGoogleOneClick6.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava11.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava12.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava13.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava14.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJava32.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPJPI150_07.dll
FF -: plugin - C:\Archivos de programa\Java\jre1.5.0_07\bin\NPOJI610.dll
FF -: plugin - C:\Archivos de programa\Mozilla Firefox\plugins\npPandoWebInst.dll
FF -: plugin - C:\Archivos de programa\Picasa2\npPicasa2.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 21:00:07
Windows 5.1.2600 Service Pack 3 NTFS

escaneando procesos ocultos ...

escaneando entradas ocultas de autostart ...

escaneando archivos ocultos ...


C:\sccfg.sys 370 bytes
C:\WINDOWS\system32\mTuDLkkj.ini 411483 bytes
C:\WINDOWS\system32\rlxgaikj.ini
C:\WINDOWS\system32\jkiagxlr.dll

el escaneo se completo con exito
archivos ocultos: 4

**************************************************************************
.
--------------------- DLLs cargados bajo los procesos en ejecución ---------------------

PROCESOS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\jkkLDuTm.dll
-> C:\Archivos de programa\Eset\pr_imon.dll

PROCESOS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\jkkLDuTm.dll
-> C:\WINDOWS\system32\jkiagxlr.dll
.
------------------------ Otros procesos en ejecución ------------------------
.
C:\WINDOWS\system32\DVDRAMSV.exe
C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Archivos de programa\Eset\nod32krn.exe
C:\Archivos de programa\CyberLink\Shared files\RichVideo.exe
C:\Archivos de programa\Analog Devices\SoundMAX\SMAgent.exe
C:\Archivos de programa\toshiba\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
.
**************************************************************************
.
Tiempo completado: 2008-10-28 21:02:18 - Reiniciando la máquina
ComboFix-quarantined-files.txt 2008-10-28 20:02:10
ComboFix2.txt 2008-10-28 19:43:22

Pre-Run: 3,526,914,048 bytes libres
Post-Run: 3,516,989,440 bytes libres

218 --- E O F --- 2008-10-09 17:30:22

Hate to ask this but is there some way you can post these logs in English? My Spanish is limited to high school Spanish classes...many years ago.

It is not a problem :)


ComboFix 08-10-28.01 - Administrator 2008-10-28 20:36:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.239 [1:00 GMT]
It runs from: C: \ Documents and Settings \ Administrator \ Desktop \ ComboFix.exe
* Resident AV is activated


WARNING - THIS TEAM HAS NOT install the Recovery Console!
.

Other (((((((((((((((((((((((((((((((((((( eliminations )))))))))))) )))))))))))))))))))))))))))))))))))))
.

C: \ Documents and Settings \ Administrator \ Application Data \. #
C: \ WINDOWS \ system32 \ bofnkqeq.ini
C: \ WINDOWS \ system32 \ bpkkgxnx.ini
C: \ WINDOWS \ system32 \ czzong.dll
C: \ WINDOWS \ system32 \ doxugwve.dll
C: \ WINDOWS \ system32 \ evwguxod.ini
C: \ WINDOWS \ system32 \ gjglpngb.dll
C: \ WINDOWS \ system32 \ gtyaowxn.dll
C: \ WINDOWS \ system32 \ hgGwWQjJ.dll
C: \ WINDOWS \ system32 \ iaklkwob.ini
C: \ WINDOWS \ system32 \ iuzgoo.dll
C: \ WINDOWS \ system32 \ jkkLCvvw.dll
C: \ WINDOWS \ system32 \ mendevlc.ini
C: \ WINDOWS \ system32 \ mTuDLkkj.ini
C: \ WINDOWS \ system32 \ mTuDLkkj.ini2
C: \ WINDOWS \ system32 \ mujyrp.dll
C: \ WINDOWS \ system32 \ pkdkdn.dll
C: \ WINDOWS \ system32 \ pmnkIXOf.dll
C: \ WINDOWS \ system32 \ pwnlhwug.dll
C: \ WINDOWS \ system32 \ qaioiron.dll
C: \ WINDOWS \ system32 \ qeqknfob.dll
C: \ WINDOWS \ system32 \ smcflf.dll
C: \ WINDOWS \ system32 \ ssqPgGXr.dll
C: \ WINDOWS \ system32 \ uplvmraw.dll
C: \ WINDOWS \ system32 \ vtUlJcCv.dll
C: \ WINDOWS \ system32 \ windows_update.exe
C: \ WINDOWS \ system32 \ xxywUOgH.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers / Services )))))))) )))))))))))))))))))))))))))))))))))))))))
.

------- \ Legacy_TDSSSERV
------- \ Service_TDSSserv


(((((((((((((((((( Files created from 2008-09-28 - 2008-10-28 )))))))))))))))))) )))))))))))))))
.

2008-10-28 20:39. 2008-10-28 20:41 396 - AHS ---- C: \ WINDOWS \ system32 \ mTuDLkkj.ini
2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ sgnxfoif.dll
2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ jgqaho.dll
2008-10-27 20:05. 2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll
2008-10-27 20:04. 2008-10-27 20:04 <DIR> d -------- C: \ Program Files \ Trend Micro
2008-10-27 20:03. 2008-10-27 20:03 812344 - a ------ C: \ HJTInstall.exe
2008-10-12 12:25. 2008-10-12 12:25 <DIR> d -------- C: \ Program Files
2008-10-12 10:29. 2008-10-12 12:24 <DIR> d -------- C: \ Program Files \ EsetOnlineScanner
2008-10-12 09:44. 2008-10-12 09:45 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware
2008-10-12 09:44. 2008-09-09 23:04 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys
2008-10-12 09:44. 2008-09-09 23:03 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys
2008-10-12 09:28. 2008-10-12 09:28 <DIR> d -------- C: \ Documents and Settings \ Administrator \ Application Data \ Malwarebytes
2008-10-12 09:27. 2008-10-12 09:27 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
2008-10-11 20:22. 2008-10-11 20:22 95 - a ------ C: \ WINDOWS \ Wininit.ini
2008-10-11 19:48. 2008-10-11 19:53 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy
2008-10-11 19:48. 2008-10-11 19:48 <DIR> d -------- C: \ Program Files \ Spybot - Search & Destroy
2008-10-09 17:05. 2008-10-09 17:05 <DIR> d -------- C: \ Program Files \ ScanSoft
2008-10-09 17:00. 2008-10-09 17:01 <DIR> d -------- C: \ Program Files \ Microsoft AutoRoute
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ Xircom
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ restore
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ srchasst
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ msagent
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ Program Files \ microsoft frontpage
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ OOBE
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ is
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ bits
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ l2schemas
2008-10-07 20:23. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ ServicePackFiles
2008-10-07 20:16. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ EHome
2008-10-05 22:10. 2008-10-05 22:10 <DIR> d -------- C: \ Program Files \ ElcomSoft
2008-10-05 21:44. 2008-10-05 21:44 99 - a ------ C: \ pdfinfo.ini
2008-10-05 21:44. 2008-10-05 21:45 81 - a ------ C: \ WINDOWS \ winDecrypt.INI
2008-10-05 21:42. 2008-10-05 21:42 1024 - a ------ C: \ WINDOWS \ system32 \ pwdremover.dat
2008-10-05 21:42. 2008-10-05 21:54 36 - a ------ C: \ WINDOWS \ verypdf.ini
2008-10-05 21:41. 2008-10-12 09:10 <DIR> d -------- C: \ Program Files \ PDF Password Remover v2.5
2008-10-05 20:03. 2008-04-14 03:18 4274816 --------- C: \ WINDOWS \ system32 \ nv4_disp.dll
2008-10-05 20:02. 2008-04-14 03:18 1888992 --------- C: \ WINDOWS \ system32 \ ati3duag.dll
2008-10-05 20:01. 2008-04-14 03:18 136192 --------- C: \ WINDOWS \ system32 \ aaclient.dll
2008-10-05 20:01. 2008-04-13 19:36 44928 --------- C: \ WINDOWS \ system32 \ drivers \ agpcpq.sys
2008-10-05 20:01. 2008-04-13 19:36 42368 --------- C: \ WINDOWS \ system32 \ drivers \ Agp440.sys
2008-10-05 20:01. 2008-04-14 03:18 4255 --------- C: \ WINDOWS \ system32 \ drivers \ adv01nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3967 --------- C: \ WINDOWS \ system32 \ drivers \ adv02nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3775 --------- C: \ WINDOWS \ system32 \ drivers \ adv11nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3711 --------- C: \ WINDOWS \ system32 \ drivers \ adv09nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3647 --------- C: \ WINDOWS \ system32 \ drivers \ adv07nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3615 --------- C: \ WINDOWS \ system32 \ drivers \ adv05nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3135 --------- C: \ WINDOWS \ system32 \ drivers \ adv08nt5.dll

.
(((((((((((((((((((((((((((((((((((((( Report Find3M )))))))))) )))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 19:36 --------- ----- w d C: \ Program Files \ Eset
2008-10-27 19:06 --------- ----- w d C: \ Documents and Settings \ All Users \ Application Data \ Google Updater
2008-10-12 08:10 --------- ----- w d C: \ Program Files \ Google
2008-10-10 22:38 90,112 ---- aw C: \ WINDOWS \ DUMP6d24.tmp
2008-10-10 22:37 98,304 ---- aw C: \ WINDOWS \ DUMP2334.tmp
2008-10-10 22:36 98,304 ---- aw C: \ WINDOWS \ DUMP3407.tmp
2008-10-10 21:11 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ uTorrent
2008-10-07 19:43 96384 ---- aw C: \ WINDOWS \ system32 \ drivers \ sptd9725.sys
2008-09-30 18:13 --------- ----- w d C: \ Program Files \ Picasa2
2008-09-17 17:17 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ Ahead
2008-09-16 21:08 --------- ----- w d C: \ Program Files \ uTorrent
2008-09-04 18:19 --------- ----- w d C: \ Program Files \ Pando Networks
2008-08-05 20:05 53248 ---- aw C: \ WINDOWS \ system32 \ suppdll.dll
2008-08-05 20:05 35363 ---- aw C: \ WINDOWS \ system32 \ windrvNT.sys
.

((((((((((((((((((((((((((((((((( Loading Points Reg )))))))))))))) ))))))))))))))))))))))))))))))))))))
.
.
* Note * empty entries & legitimate default entries are not displayed
REGEDIT4

[HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (2A1F85C5-E150-4939-AAAB-38C245BED4CE)]
2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll

[HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (7564a552-336f-41d4-b91a-1d409d5bb548)]
2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll

[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curren ntVersion \ Run]
"ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
"nod32kui" = "C: \ Program Files \ Eset \ nod32kui.exe" [2008-06-04 921600]
"SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ SoundMAX \ SMax4PNP.exe" [2004-10-14 1388544]

"IgfxTray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2004-10-08 155,648]
"HotKeysCmds" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2004-10-08 126,976]
"THotkey" = "C: \ Program Files \ Toshiba \ Toshiba Applet \ thotkey.exe" [2004-12-14 368,640]

[HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
"CTFMON.EXE" = "C: \ WINDOWS \ system32 \ CTFMON.EXE" [2008-04-14 15360]

C: \ Documents and Settings \ All Users \ Start Menu £ \ Programs \ Startup \
RAMASST.lnk - C: \ WINDOWS \ system32 \ RAMASST.exe [2008-06-05 155648]

[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ system]
"DisableStatusMessages" = 0 (0x0)

[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ explorer]
"NoDesktopCleanupWizard" = 1 (0x1)
"ForceClassicControlPanel" = 1 (0x1)

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ policies \ explorer]
"NoSMHelp" = 1 (0x1)
"NoSMConfigurePrograms" = 1 (0x1)
"NoSMMyPictures" = 1 (0x1)
"NoResolveTrack" = 1 (0x1)
"NoResolveSearch" = 1 (0x1)

[HKEY_USERS \. Default \ software \ microsoft \ windows \ cur rentversion \ policies \ explorer]
"NoSMHelp" = 1 (0x1)
"NoSMConfigurePrograms" = 1 (0x1)
"NoSMMyPictures" = 1 (0x1)
"NoResolveTrack" = 1 (0x1)
"NoResolveSearch" = 1 (0x1)

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
"UIHost" = hex (2): 58,50,69,7 a, 65.5 f, 4c, 6f, 67.6 f, 6e, 2 e, 65,78,65,00

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows]
"AppInit_DLLs" = jgqaho.dll

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ drivers32]
"VIDC.X264" = x264vfw.dll
"VIDC.3iv2" = 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE \ system \ currentcontrolset \ contro l \ lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C: \ WINDOWS \ system32 \ jkkLDuTm

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile]
"DisableUnicastResponsesToMulticastBroadcast" = 0 (0x0)

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ AuthorizedApplications \ List]
"% windir% \ \ system32 \ \ Sessmgr.exe" =
"C: \ \ Program Files \ \ Skype \ Phone \ \ Skype.exe" =
"C: \ \ Program Files \ \ Pando Networks \ \ Pando \ \ pando.exe" =
"C: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" =
"% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" =
"C: \ \ Program Files \ \ Malwarebytes' Anti-Malware \ \ mbam.exe" =

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ GloballyOpenPorts \ List]
"57214: TCP" = 57214: TCP: Pando P2P Listening TCP Port
"57214: UDP" = 57214: UDP: Pando P2P UDP Port Listening
"4662: TCP" = 4662: TCP: uTORRENT

S2 gupdate1c8e071a1913dc0; Google Update Service (gupdate1c8e071a1913dc0); C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 133104]
S3 iscFlash; iscFlash; C: \ WINDOWS \ Temp \ isc10tmp \ iscflas h.sys []
S3 mpr_freader; MPR FileReader Driver; C: \ Program Files \ Multi Password Recovery \ mpr_freader.sys []
S3 USBSTOR; Device USB mass storage of data; C: \ WINDOWS \ system32 \ DRIVERS \ USBSTOR.SYS [2008-04-13 26368]

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec0-3340-11dd-ab62-963b1372dd69)]
\ Shell \ AutoRun \ command - F: \ Autorun.exe

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec2-3340-11dd-ab62-963b1372dd69)]
\ Shell \ AutoRun \ command - F: \ Autorun.exe
.
Content folder 'Scheduled Tasks'

2008-10-28 C: \ WINDOWS \ Tasks \ GoogleUpdateTaskMachine.job
- C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 23:42]
.
- - - - ORPHANS Remove - - - --

BHO-(998DAE3E-7D4F-4952-A71F-467D8FE64407) - C: \ WINDOWS \ system32 \ ssqPgGXr.dll
(-BHO BAB92735-70EB-4008-9F8E-A4DF5D9BC2A6) - (no file)
HKLM-Run-TVS - C: \ Program Files \ Toshiba \ TVS \ TvsTray.exe
HKLM-Run-64769aed - C: \ WINDOWS \ system32 \ qeqknfob.dll
ShellExecuteHooks (-998DAE3E-7D4F-4952-A71F-467D8FE64407) - C: \ WINDOWS \ system32 \ ssqPgGXr.dll


.
------- ------- Supplemental Analysis
.
FireFox -: Profile - C: \ Documents and Settings \ Administrator \ Application Data \ Mozilla \ Firefox \ Profiles \ n1ai0fhk.default \
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
FF -: plugin - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ Browser \ nppdf32.dll
FF -: plugin - C: \ Program Files \ Google \ Google Earth Plugin \ npgeplugin.dll
FF -: plugin - C: \ Program Files \ Google \ Google Updater \ 2.2.1273.1045 \ npCIDetect12.dll
FF -: plugin - C: \ Program Files \ Google \ Update \ 1.2.131.25 \ npGoogleOneClick 6.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava11.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava12.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava13.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava14.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava32.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJPI150_07.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPOJI610.dll
FF -: plugin - C: \ Program Files \ Mozilla Firefox \ plugins \ npPandoWebInst.dll
FF -: plugin - C: \ Program Files \ Picasa2 \ npPicasa2.dll
.

************************************************** ************************

catchman 0.3.1367 W2K/XP/Vista - rootkit / stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 20:40:47
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C: \ sccfg.sys 370 bytes
C: \ WINDOWS \ system32 \ vscvswrh.dll 113,152 byte executable

The scan was completed successfully
Hidden Files: 2

************************************************** ************************
.
--------------------- DLLs loaded under running processes ---------------------

PROCESS: C: \ WINDOWS \ system32 \ lsass.exe
-> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
-> C: \ Program Files \ Eset \ pr_imon.dll

PROCESS: C: \ WINDOWS \ explorer.exe
-> C: \ WINDOWS \ system32 \ iqkautwf.dll
-> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
.
Other processes running ------------------------ ---------------------- --
.
C: \ WINDOWS \ system32 \ DVDRAMSV.exe
C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
C: \ Program Files \ Eset \ nod32krn.exe
C: \ Program Files \ CyberLink \ Shared files \ RichVideo.exe
C: \ Program Files \ Analog Devices \ SoundMAX \ SMAgent.exe
C: \ Program Files \ toshiba \ TOSHIBA Applet \ TAPPSRV.exe
C: \ WINDOWS \ system32 \ wdfmgr.exe
C: \ WINDOWS \ system32 \ rundll32.exe
C: \ WINDOWS \ system32 \ wscntfy.exe
C: \ WINDOWS \ system32 \ rundll32.exe
.
************************************************** ************************
.
Time completed: 2008-10-28 20:43:21 - Rebooting the machine
ComboFix-quarantined-files.txt 2008-10-28 19:43:13

Pre-Run: 3,005,747,200 bytes free
Post-Run: 3,519,385,600 bytes free

245 E O F --- --- 2008-10-09 17:30:22













ComboFix 08-10-28.01 - Administrator 2008-10-28 20:56:40.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.34.3082.18.242 [1:00 GMT]
It runs from: C: \ Documents and Settings \ Administrator \ Desktop \ ComboFix.exe
* Resident AV is activated


WARNING - THIS TEAM HAS NOT install the Recovery Console!
.

Other (((((((((((((((((((((((((((((((((((( eliminations )))))))))))) )))))))))))))))))))))))))))))))))))))
.

C: \ WINDOWS \ system32 \ fwtuakqi.ini
C: \ WINDOWS \ system32 \ iqkautwf.dll
C: \ WINDOWS \ system32 \ mTuDLkkj.ini
C: \ WINDOWS \ system32 \ mTuDLkkj.ini2

.
(((((((((((((((((( Files created from 2008-09-28 - 2008-10-28 )))))))))))))))))) )))))))))))))))
.

2008-10-28 20:59. 2008-10-28 21:00 494 - AHS ---- C: \ WINDOWS \ system32 \ mTuDLkkj.ini
2008-10-28 20:42. 2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ vscvswrh.dll
2008-10-28 20:42. 2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll
2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ sgnxfoif.dll
2008-10-28 20:14. 2008-10-28 20:14 113152 - a ------ C: \ WINDOWS \ system32 \ jgqaho.dll
2008-10-27 20:05. 2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll
2008-10-27 20:04. 2008-10-27 20:04 <DIR> d -------- C: \ Program Files \ Trend Micro
2008-10-27 20:03. 2008-10-27 20:03 812344 - a ------ C: \ HJTInstall.exe
2008-10-12 12:25. 2008-10-12 12:25 <DIR> d -------- C: \ Program Files
2008-10-12 10:29. 2008-10-12 12:24 <DIR> d -------- C: \ Program Files \ EsetOnlineScanner
2008-10-12 09:44. 2008-10-12 09:45 <DIR> d -------- C: \ Program Files \ Malwarebytes' Anti-Malware
2008-10-12 09:44. 2008-09-09 23:04 38528 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbamswissarmy.sys
2008-10-12 09:44. 2008-09-09 23:03 17200 - a ------ C: \ WINDOWS \ system32 \ drivers \ mbam.sys
2008-10-12 09:28. 2008-10-12 09:28 <DIR> d -------- C: \ Documents and Settings \ Administrator \ Application Data \ Malwarebytes
2008-10-12 09:27. 2008-10-12 09:27 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Malwarebytes
2008-10-11 20:22. 2008-10-11 20:22 95 - a ------ C: \ WINDOWS \ Wininit.ini
2008-10-11 19:48. 2008-10-11 19:53 <DIR> d -------- C: \ Documents and Settings \ All Users \ Application Data \ Spybot - Search & Destroy
2008-10-11 19:48. 2008-10-11 19:48 <DIR> d -------- C: \ Program Files \ Spybot - Search & Destroy
2008-10-09 17:05. 2008-10-09 17:05 <DIR> d -------- C: \ Program Files \ ScanSoft
2008-10-09 17:00. 2008-10-09 17:01 <DIR> d -------- C: \ Program Files \ Microsoft AutoRoute
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ Xircom
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ system32 \ restore
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ srchasst
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ WINDOWS \ msagent
2008-10-07 20:43. 2008-10-07 20:43 <DIR> d -------- C: \ Program Files \ microsoft frontpage
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ OOBE
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ is
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ system32 \ bits
2008-10-07 20:26. 2008-10-07 20:26 <DIR> d -------- C: \ WINDOWS \ l2schemas
2008-10-07 20:23. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ ServicePackFiles
2008-10-07 20:16. 2008-10-07 20:27 <DIR> d -------- C: \ WINDOWS \ EHome
2008-10-05 22:10. 2008-10-05 22:10 <DIR> d -------- C: \ Program Files \ ElcomSoft
2008-10-05 21:44. 2008-10-05 21:44 99 - a ------ C: \ pdfinfo.ini
2008-10-05 21:44. 2008-10-05 21:45 81 - a ------ C: \ WINDOWS \ winDecrypt.INI
2008-10-05 21:42. 2008-10-05 21:42 1024 - a ------ C: \ WINDOWS \ system32 \ pwdremover.dat
2008-10-05 21:42. 2008-10-05 21:54 36 - a ------ C: \ WINDOWS \ verypdf.ini
2008-10-05 21:41. 2008-10-12 09:10 <DIR> d -------- C: \ Program Files \ PDF Password Remover v2.5
2008-10-05 20:03. 2008-04-14 03:18 4274816 --------- C: \ WINDOWS \ system32 \ nv4_disp.dll
2008-10-05 20:02. 2008-04-14 03:18 1888992 --------- C: \ WINDOWS \ system32 \ ati3duag.dll
2008-10-05 20:01. 2008-04-14 03:18 136192 --------- C: \ WINDOWS \ system32 \ aaclient.dll
2008-10-05 20:01. 2008-04-13 19:36 44928 --------- C: \ WINDOWS \ system32 \ drivers \ agpcpq.sys
2008-10-05 20:01. 2008-04-13 19:36 42368 --------- C: \ WINDOWS \ system32 \ drivers \ Agp440.sys
2008-10-05 20:01. 2008-04-14 03:18 4255 --------- C: \ WINDOWS \ system32 \ drivers \ adv01nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3967 --------- C: \ WINDOWS \ system32 \ drivers \ adv02nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3775 --------- C: \ WINDOWS \ system32 \ drivers \ adv11nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3711 --------- C: \ WINDOWS \ system32 \ drivers \ adv09nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3647 --------- C: \ WINDOWS \ system32 \ drivers \ adv07nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3615 --------- C: \ WINDOWS \ system32 \ drivers \ adv05nt5.dll
2008-10-05 20:01. 2008-04-14 03:18 3135 --------- C: \ WINDOWS \ system32 \ drivers \ adv08nt5.dll

.
(((((((((((((((((((((((((((((((((((((( Report Find3M )))))))))) )))))))))))))))))))))))))))))))))))))))))
.
2008-10-28 19:36 --------- ----- w d C: \ Program Files \ Eset
2008-10-27 19:06 --------- ----- w d C: \ Documents and Settings \ All Users \ Application Data \ Google Updater
2008-10-12 08:10 --------- ----- w d C: \ Program Files \ Google
2008-10-10 22:38 90,112 ---- aw C: \ WINDOWS \ DUMP6d24.tmp
2008-10-10 22:37 98,304 ---- aw C: \ WINDOWS \ DUMP2334.tmp
2008-10-10 22:36 98,304 ---- aw C: \ WINDOWS \ DUMP3407.tmp
2008-10-10 21:11 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ uTorrent
2008-10-07 19:43 96384 ---- aw C: \ WINDOWS \ system32 \ drivers \ sptd9725.sys
2008-09-30 18:13 --------- ----- w d C: \ Program Files \ Picasa2
2008-09-17 17:17 --------- ----- w d C: \ Documents and Settings \ Administrator \ Application Data \ Ahead
2008-09-16 21:08 --------- ----- w d C: \ Program Files \ uTorrent
2008-09-04 18:19 --------- ----- w d C: \ Program Files \ Pando Networks
2008-08-05 20:05 53248 ---- aw C: \ WINDOWS \ system32 \ suppdll.dll
2008-08-05 20:05 35363 ---- aw C: \ WINDOWS \ system32 \ windrvNT.sys
.

((((((((((((((((((((((((((((((((( Loading Points Reg )))))))))))))) ))))))))))))))))))))))))))))))))))))
.
.
* Note * empty entries & legitimate default entries are not displayed
REGEDIT4

[HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (7564a552-336f-41d4-b91a-1d409d5bb548)]
2008-10-28 20:42 113152 - a ------ C: \ WINDOWS \ system32 \ djntzp.dll

[HKEY_LOCAL_MACHINE \ ~ \ Browser Helper Objects \ (A23CABA5-C51E-4CB5-A23B-ADFA4D8D9FCF)]
2008-10-27 20:05 267776 - a ------ C: \ WINDOWS \ system32 \ jkkLDuTm.dll

[HKEY_CURRENT_USER \ SOFTWARE \ Microsoft \ Windows \ Curren ntVersion \ Run]
"ctfmon.exe" = "C: \ WINDOWS \ system32 \ ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ Curr entVersion \ Run]
"nod32kui" = "C: \ Program Files \ Eset \ nod32kui.exe" [2008-06-04 921600]
"SoundMAXPnP" = "C: \ Program Files \ Analog Devices \ SoundMAX \ SMax4PNP.exe" [2004-10-14 1388544]
"IgfxTray" = "C: \ WINDOWS \ system32 \ igfxtray.exe" [2004-10-08 155,648]
"HotKeysCmds" = "C: \ WINDOWS \ system32 \ hkcmd.exe" [2004-10-08 126,976]
"THotkey" = "C: \ Program Files \ Toshiba \ Toshiba Applet \ thotkey.exe" [2004-12-14 368,640]
"64769aed" = "C: \ WINDOWS \ system32 \ jkiagxlr.dll" [2008-10-28 75264]

[HKEY_USERS \. DEFAULT \ Software \ Microsoft \ Windows \ Cur rentVersion \ Run]
"CTFMON.EXE" = "C: \ WINDOWS \ system32 \ CTFMON.EXE" [2008-04-14 15360]

C: \ Documents and Settings \ All Users \ Start Menu £ \ Programs \ Startup \
RAMASST.lnk - C: \ WINDOWS \ system32 \ RAMASST.exe [2008-06-05 155648]

[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ system]
"DisableStatusMessages" = 0 (0x0)

[HKEY_LOCAL_MACHINE \ software \ microsoft \ windows \ curr entversion \ policies \ explorer]
"NoDesktopCleanupWizard" = 1 (0x1)
"ForceClassicControlPanel" = 1 (0x1)

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ policies \ explorer]
"NoSMHelp" = 1 (0x1)
"NoSMConfigurePrograms" = 1 (0x1)
"NoSMMyPictures" = 1 (0x1)
"NoResolveTrack" = 1 (0x1)
"NoResolveSearch" = 1 (0x1)

[HKEY_USERS \. Default \ software \ microsoft \ windows \ cur rentversion \ policies \ explorer]
"NoSMHelp" = 1 (0x1)
"NoSMConfigurePrograms" = 1 (0x1)
"NoSMMyPictures" = 1 (0x1)
"NoResolveTrack" = 1 (0x1)
"NoResolveSearch" = 1 (0x1)

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon]
"UIHost" = hex (2): 58,50,69,7 a, 65.5 f, 4c, 6f, 67.6 f, 6e, 2 e, 65,78,65,00

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ windows]
"AppInit_DLLs" = jgqaho.dll

[HKEY_LOCAL_MACHINE \ Software \ Microsoft \ Windows NT \ CurrentVersion \ drivers32]
"VIDC.X264" = x264vfw.dll
"VIDC.3iv2" = 3ivxVfWCodec.dll

[HKEY_LOCAL_MACHINE \ system \ currentcontrolset \ contro l \ lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C: \ WINDOWS \ system32 \ jkkLDuTm

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile]
"DisableUnicastResponsesToMulticastBroadcast" = 0 (0x0)

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ AuthorizedApplications \ List]
"% windir% \ \ system32 \ \ Sessmgr.exe" =
"C: \ \ Program Files \ \ Skype \ Phone \ \ Skype.exe" =
"C: \ \ Program Files \ \ Pando Networks \ \ Pando \ \ pando.exe" =
"C: \ \ Program Files \ \ uTorrent \ \ uTorrent.exe" =
"% windir% \ \ Network Diagnostic \ \ xpnetdiag.exe" =
"C: \ \ Program Files \ \ Malwarebytes' Anti-Malware \ \ mbam.exe" =

[HKLM \ ~ \ services \ sharedaccess \ parameters \ firewallpo licy \ StandardProfile \ GloballyOpenPorts \ List]
"57214: TCP" = 57214: TCP: Pando P2P Listening TCP Port
"57214: UDP" = 57214: UDP: Pando P2P UDP Port Listening
"4662: TCP" = 4662: TCP: uTORRENT

S2 gupdate1c8e071a1913dc0; Google Update Service (gupdate1c8e071a1913dc0); C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 133104]
S3 iscFlash; iscFlash; C: \ WINDOWS \ Temp \ isc10tmp \ iscflas h.sys []
S3 mpr_freader; MPR FileReader Driver; C: \ Program Files \ Multi Password Recovery \ mpr_freader.sys []
S3 USBSTOR; Device USB mass storage of data; C: \ WINDOWS \ system32 \ DRIVERS \ USBSTOR.SYS [2008-04-13 26368]

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec0-3340-11dd-ab62-963b1372dd69)]
\ Shell \ AutoRun \ command - F: \ Autorun.exe

[HKEY_CURRENT_USER \ software \ microsoft \ windows \ curre ntversion \ explorer \ mountpoints2 \ (9e6caec2-3340-11dd-ab62-963b1372dd69)]
\ Shell \ AutoRun \ command - F: \ Autorun.exe
.
Content folder 'Scheduled Tasks'

2008-10-28 C: \ WINDOWS \ Tasks \ GoogleUpdateTaskMachine.job
- C: \ Program Files \ Google \ Update \ GoogleUpdate.exe [2008-08-29 23:42]
.
.
------- ------- Supplemental Analysis
.
FireFox -: Profile - C: \ Documents and Settings \ Administrator \ Application Data \ Mozilla \ Firefox \ Profiles \ n1ai0fhk.default \
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.google.es
FF -: plugin - C: \ Program Files \ Adobe \ Acrobat 7.0 \ Reader \ Browser \ nppdf32.dll
FF -: plugin - C: \ Program Files \ Google \ Google Earth Plugin \ npgeplugin.dll
FF -: plugin - C: \ Program Files \ Google \ Google Updater \ 2.2.1273.1045 \ npCIDetect12.dll
FF -: plugin - C: \ Program Files \ Google \ Update \ 1.2.131.25 \ npGoogleOneClick 6.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava11.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava12.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava13.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava14.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJava32.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPJPI150_07.dll
FF -: plugin - C: \ Program Files \ Java \ jre1.5.0_07 \ bin \ NPOJI610.dll
FF -: plugin - C: \ Program Files \ Mozilla Firefox \ plugins \ npPandoWebInst.dll
FF -: plugin - C: \ Program Files \ Picasa2 \ npPicasa2.dll
.

************************************************** ************************

catchman 0.3.1367 W2K/XP/Vista - rootkit / stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-10-28 21:00:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C: \ sccfg.sys 370 bytes
C: \ WINDOWS \ system32 \ mTuDLkkj.ini 411,483 bytes
C: \ WINDOWS \ system32 \ rlxgaikj.ini
C: \ WINDOWS \ system32 \ jkiagxlr.dll

The scan was completed successfully
Hidden Files: 4

************************************************** ************************
.
--------------------- DLLs loaded under running processes ---------------------

PROCESS: C: \ WINDOWS \ system32 \ lsass.exe
-> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
-> C: \ Program Files \ Eset \ pr_imon.dll

PROCESS: C: \ WINDOWS \ explorer.exe
-> C: \ WINDOWS \ system32 \ jkkLDuTm.dll
-> C: \ WINDOWS \ system32 \ jkiagxlr.dll
.
Other processes running ------------------------ ---------------------- --
.
C: \ WINDOWS \ system32 \ DVDRAMSV.exe
C: \ Program Files \ Google \ Common \ Google Updater \ GoogleUpdaterService.exe
C: \ Program Files \ Eset \ nod32krn.exe
C: \ Program Files \ CyberLink \ Shared files \ RichVideo.exe
C: \ Program Files \ Analog Devices \ SoundMAX \ SMAgent.exe
C: \ Program Files \ toshiba \ TOSHIBA Applet \ TAPPSRV.exe
C: \ WINDOWS \ system32 \ wdfmgr.exe
C: \ WINDOWS \ system32 \ wscntfy.exe
C: \ WINDOWS \ system32 \ rundll32.exe
C: \ WINDOWS \ system32 \ rundll32.exe
.
************************************************** ************************
.
Time completed: 2008-10-28 21:02:18 - Rebooting the machine
ComboFix-quarantined-files.txt 2008-10-28 20:02:10
ComboFix2.txt 2008-10-28 19:43:22

Pre-Run: 3,526,914,048 bytes free
Post-Run: 3,516,989,440 bytes free

218 E O F --- --- 2008-10-09 17:30:22