Removal of packed.monder

View previous topic View next topic Go down

Removal of packed.monder

Post by gnath on Sun Sep 20, 2009 2:37 pm

Can you please help with the removal of the above.

I have created a log file using hijack this and am pasting it here.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:01:37 PM, on 9/20/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgfws8.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
C:\WINDOWS\system32\svchost.exe
C:\Tally9 bap\tallylicserver.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\RTHDCPL.EXE
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
E:\Program Files\Ask & Record Toolbar\FLVSrvc.exe
E:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
E:\Program Files\Conceptworld\NoteZilla\NoteZilla.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
E:\Program Files\IObit\Advanced SystemCare 3\AWC.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Documents and Settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
E:\Program Files\SugarSync\SugarSyncManager.exe
C:\Documents and Settings\GNATH\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
E:\Program Files\Quick To-Do Pro\qtodopro.exe
E:\Program Files\Conceptworld\RecentX\RecentX.exe
E:\Program Files\Moss Bay Software\Subliminal Power\SubliminalPower.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Outlook Express\msimn.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\SpywareDetector\MaxWatchDogService.exe
C:\Program Files\SpywareDetector\MaxActMon.exe
C:\Program Files\SpywareDetector\MaxSDUI.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\SpywareDetector\MaxSDTray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
R3 - URLSearchHook: (no name) - *{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
O2 - BHO: CmjBrowserHelperObject Object - {07A11D74-9D25-4fea-A833-8B0D76A5577A} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFree.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Annotis Mail IE Context Menu Extension - {5F186CB1-08C6-4034-8529-CDC625463D99} - E:\PROGRA~1\Emeris\Annotis\SHARED~1\ANNSHE~1.DLL
O2 - BHO: RoboForm - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll
O3 - Toolbar: Ask && Record Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFree.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [ToolBoxFX] "C:\Program Files\HP\ToolBoxFX\bin\HPTLBXFX.exe" /enum:on /alerts:on /notifications:on /fl:on /fr:on /appData:on
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Ask and Record FLV Service] "E:\Program Files\Ask & Record Toolbar\FLVSrvc.exe" /run
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SDActiveMonitor] C:\Program Files\SpywareDetector\MaxSDTray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [NoteZilla] E:\Program Files\Conceptworld\NoteZilla\NoteZilla.exe
O4 - HKCU\..\Run: [Advanced SystemCare 3] "E:\Program Files\IObit\Advanced SystemCare 3\AWC.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [SugarSync] "E:\Program Files\SugarSync\SugarSyncManager.exe" -startInTray
O4 - Startup: Quick To-Do Pro.lnk = E:\Program Files\Quick To-Do Pro\qtodopro.exe
O4 - Startup: RecentX.lnk = E:\Program Files\Conceptworld\RecentX\RecentX.exe
O4 - Startup: SubliminalPower.lnk = E:\Program Files\Moss Bay Software\Subliminal Power\SubliminalPower.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Crawler Search - tbr:iemenu
O8 - Extra context menu item: Customize Menu - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]
O8 - Extra context menu item: Fill Forms - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - [You must be registered and logged in to see this link.] Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Send to Mindjet MindManager - {941E1A34-C6AF-4baa-A973-224F9C3E04BF} - C:\Program Files\Mindjet\MindManager 7\Mm7InternetExplorer.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - E:\Program Files\PlotSoft\PDFill\DownloadPDF.exe
O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O15 - Trusted IP range: [You must be registered and logged in to see this link.]
O16 - DPF: {14E35D5F-DEBA-4DB3-B2ED-17542BA12D1F} (CV781Object Object) - [You must be registered and logged in to see this link.]
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O17 - HKLM\System\CCS\Services\Tcpip\..\{8D7A5078-211D-4A42-9224-E783E38DD68B}: NameServer = 202.56.230.6,202.56.215.6
O17 - HKLM\System\CS1\Services\Tcpip\..\{4A613618-F925-4F4B-BD63-D92421AE2F38}: NameServer = 202.56.230.6,202.56.215.6
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - C:\PROGRA~1\Crawler\Toolbar\ctbr.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgfws8.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.8.809.23506 (GoogleDesktopManager-092308-165331) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MaxWatchDogService - Max Secure Software - C:\Program Files\SpywareDetector\MaxWatchDogService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
O23 - Service: Tally License Server (TallyLicenseServer) - Unknown owner - C:\Tally9 bap\tallylicserver.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 14801 bytes

Regards,

Gautam

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Sun Sep 20, 2009 9:07 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 6:27 am

Didn't work. What I seem to be getting is frequent Web Shield alerts from AVG as below. Please help. Thanks, Gautam

[You must be registered and logged in to see this link.]

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 8:35 am

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Ask Toolbar

That picture looks like it's showing a URL, can you post that URL here, I'd like to check that file.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 8:55 am

Thanks, have removed the Ask Toolbar. The alert I get mention that the following accessed file is infected:

dnusax.com/ic2.exe

I was unable to find the above exe file though.

Regards,

Gautam

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 9:00 am

The alerts are still there! Many thanks for your attention and help.

Regards,

Gautam

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 9:35 am

Hello.
The link works right now, so something is trying to download that file. Lets see if we can find it.

  • Open HijackThis.
  • When Hijack This opens, click "Open the Misc Tools section"
  • Then select "Open Uninstall Manager"
  • Click on "Save List..." (generates uninstall_list.txt)
  • Click Save, copy and paste the results in your next post.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 11:16 am

Done the needful. Many thanks, Gautam

1Click DVDTOIPOD 1.1.5.0
2007 Microsoft Office system
32 Bit HP BiDi Channel Components Installer
AccelMan 3.5
Acrobat.com
Acrobat.com
ActionOutline Pro 2.1 (Full)
Adobe AIR
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 9
Advanced SystemCare 3
AFPL Ghostscript 8.53
AFPL Ghostscript Fonts
AI RoboForm (All Users)
Annotis (TM) Mail
Apple Mobile Device Support
Apple Software Update
Attachment Extractor for Outlook Express v.1.4.2
AVG 8.5
Bonjour
CDisplay 1.8
Crawler Toolbar with Web Security Guard
Critical Update for Windows Media Player 11 (KB959772)
Cucusoft DVD to iPod + iPod Video Converter Suite 7.19.7.12
Data Doctor-Audio Splitter
Digital Photo Viewer 3.01
Direct WAV MP3 Splitter 2.4
Dr. Robert Anthony's INTENTION ACTIVATOR 1.0
DVD Decrypter (Remove Only)
DVD Shrink 3.2
FLV Player 2.0 (build 25)
FoxyTunes for Firefox
Free Mp3 Wma Converter V 1.7.3
Freecorder 2.3 (with Skype Call Recording)
Freecorder Toolbar
Google Desktop
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
GroupMail :: Personal Edition
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
HP Customer Participation Program 9.0
HP LaserJet M1522 MFP Series 3.0
HP Update
HPSSupply
Intel(R) Graphics Media Accelerator Driver
Intel(R) Network Connections 12.4.38.0
IrfanView (remove only)
iTunes
Java 2 Runtime Environment, SE v1.4.1_07
Java Web Start
Java(TM) 6 Update 15
LegalSounds Music Downloader 1.4
Line Reader 1.0
Malwarebytes' Anti-Malware
MapXL Maps Of India CD
MediaWidget 5.0
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2000 Premium
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual J# 2.0 Redistributable Package
Mindjet MindManager Pro 7
Motivator
Mozilla Firefox (3.5.3)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
MSXML 6.0 Parser (KB933579)
Nero 7 Essentials
NoteZilla 7.0
OE-Mail Recovery 1.7
Outlook Express Backup V6.5
Palm Desktop
Pdf995
PDFill PDF Editor with FREE PDF Writer and Tools
PDFill PDF Writer
PDF-XChange 3.0
Picasa 3
PowerDVD
Quick To-Do Pro
QuickPar 0.9
QuickTime
Realtek High Definition Audio Driver
RecentX 2.0
Registry Mechanic 8.0
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Skype™ 4.0
Smart Defrag 1.11
Smileycons 6.0.1
SolidConverterPDF
Spyware Detector
Subliminal $SUBLIMINAL_VERSION
Super Flexible File Synchronizer v4.00
System Requirements Lab
Tally 9
TuneUp Utilities 2007
Turbo Navigator 1.46 RC2
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
UseNeXT
Video Viewer
ViewSonic Monitor Drivers
ViewSonic Windows XP Signed Files
Winamp Toolbar for Internet Explorer
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
XviD MPEG-4 Codec
YouSendIt Express
YouSendIt Express
ZoneAlarm Security Suite

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 12:27 pm

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

    Crawler Toolbar with Web Security Guard
    Java 2 Runtime Environment, SE v1.4.1_07
    Java Web Start
    Java(TM) 6 Update 15
    Registry Mechanic 8.0
    Smileycons 6.0.1

Do you know what this IP adress is?

202.56.215.6

Is this your ISP? I checked it and it traces back to India. Let me know.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 12:42 pm

Many thanks - have removed the programs. The IP is the address of my DNS server. Lets hope this works. Regards, Gautam

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 12:47 pm

Hello.

  • Download combofix from here
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]

    1. If you are using Firefox, make sure that your download settings are as follows:

    * Tools->Options->Main tab
    * Set to "Always ask me where to Save the files".

    2. During the download, rename Combofix to svchost as follows:





    3. It is important you rename Combofix during the download, but not after.
    4. Please do not rename Combofix to other names, but only to the one indicated.
    5. Close any open browsers.
    6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

  • We need to disable your local AV (Anti-virus) before running Combofix.
  • See [You must be registered and logged in to see this link.] for how to disable your AV.
  • Double click on ComboFix.exe.
  • Follow the prompts. NOTE:
  • ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
    ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***

    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.


  • The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.



  • Allow ComboFix to download the Recovery Console.
  • Accept the End-User License Agreement.
  • The Recovery Console will be installed.
  • You will then get this next prompt that asks if you want to continue the malware scan, select yes



  • Allow combofix to run
  • Post C:\combofix.txt back here.

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 1:43 pm

Many thanks. All done per yr instructions. Here is the log file:

ComboFix 09-09-20.01 - Gautam Nath 09/21/2009 18:48.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3060.1753 [GMT 5.5:30]
Running from: c:\documents and settings\GNATH\Desktop\ComboFix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.
/wow section - STAGE 10


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\GNATH\Application Data\inst.exe
c:\documents and settings\GNATH\My Documents\Feb0307.reg
c:\documents and settings\GNATH\My Documents\GNAug2105.reg
c:\documents and settings\GNATH\My Documents\GNdec6.reg
c:\documents and settings\GNATH\My Documents\GNdec8.reg
c:\documents and settings\GNATH\My Documents\GNMar27.reg
c:\windows\Alcmtr.exe
c:\windows\system\SysSD.dll
c:\windows\wpd99.drv

----- BITS: Possible infected sites -----

[You must be registered and logged in to see this link.]
.
((((((((((((((((((((((((( Files Created from 2009-08-21 to 2009-09-21 )))))))))))))))))))))))))))))))
.

2009-09-21 09:33 . 2009-09-21 09:33 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-09-21 03:29 . 2009-09-21 03:29 -------- d-----w- c:\documents and settings\GNATH\Application Data\Malwarebytes
2009-09-21 03:28 . 2009-09-10 09:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-21 03:28 . 2009-09-21 03:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-21 03:28 . 2009-09-10 09:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-20 14:31 . 2009-09-20 14:31 -------- d-----w- c:\program files\Trend Micro
2009-09-20 13:51 . 2009-09-21 08:57 -------- d-----w- c:\program files\SpywareDetector
2009-09-09 03:35 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 13:31 . 2009-03-28 04:29 -------- d-----w- c:\documents and settings\GNATH\Application Data\Skype
2009-09-21 13:31 . 2009-03-28 04:30 -------- d-----w- c:\documents and settings\GNATH\Application Data\skypePM
2009-09-21 13:30 . 2008-08-23 11:26 333016352 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-21 13:30 . 2008-08-24 18:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-21 13:24 . 2008-08-23 11:26 4466024 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-21 13:24 . 2008-09-22 15:53 -------- d-----w- c:\documents and settings\GNATH\Application Data\UseNeXT
2009-09-21 13:15 . 2009-09-20 10:07 94208 ---ha-w- C:\BIT3B3.tmp
2009-09-21 12:33 . 2008-08-24 14:10 -------- d-----w- c:\program files\Java
2009-09-21 12:33 . 2008-08-22 11:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-21 09:39 . 2008-08-24 14:16 -------- d-----w- c:\documents and settings\GNATH\Application Data\SolidDocuments
2009-09-21 09:38 . 2009-02-07 09:13 153514 ----a-w- c:\windows\hppins08.dat
2009-09-21 09:33 . 2009-02-07 09:21 -------- d-----w- c:\program files\HP
2009-09-21 06:08 . 2008-10-05 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-09-20 13:19 . 2008-09-27 18:28 -------- d-----w- c:\documents and settings\GNATH\Application Data\BitTorrent
2009-09-20 07:21 . 2008-12-26 06:22 -------- d-----w- c:\program files\VideoViewer
2009-09-15 01:42 . 2008-08-23 11:24 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-08-31 17:53 . 2008-08-24 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\1Click DVDTOIPOD
2009-08-16 15:56 . 2008-08-24 14:46 -------- d-----w- c:\documents and settings\GNATH\Application Data\YouSendIt
2009-08-16 07:38 . 2008-08-24 14:27 -------- d-----w- c:\documents and settings\GNATH\Application Data\Apple Computer
2009-08-16 07:30 . 2008-08-24 14:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-08-16 07:25 . 2009-08-16 07:24 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-16 07:24 . 2009-08-16 07:24 -------- d-----w- c:\program files\iPod
2009-08-16 07:24 . 2008-08-24 14:25 -------- d-----w- c:\program files\Common Files\Apple
2009-08-16 07:22 . 2009-08-16 07:22 -------- d-----w- c:\program files\Bonjour
2009-08-16 07:18 . 2009-08-16 07:17 -------- d-----w- c:\program files\QuickTime
2009-08-15 03:44 . 2008-08-22 12:52 84536 ----a-w- c:\documents and settings\GNATH\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-15 03:25 . 2009-08-15 03:25 -------- d-----w- c:\program files\MSBuild
2009-08-15 03:25 . 2009-08-15 03:25 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 19:14 . 2009-08-09 19:14 -------- d-----w- c:\documents and settings\GNATH\Application Data\Flexigen
2009-08-09 19:13 . 2009-08-09 19:13 -------- d-----w- c:\program files\Flexigen
2009-08-08 06:25 . 2009-08-08 06:25 -------- d-----w- c:\documents and settings\LocalService\Application Data\SolidDocuments
2009-08-05 09:01 . 2006-02-28 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:06 . 2008-11-09 10:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-29 04:06 . 2008-11-09 10:40 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-29 04:06 . 2008-11-09 10:40 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-28 18:53 . 2009-07-28 18:52 -------- d-----w- c:\program files\Freecorder
2009-07-24 23:53 . 2009-03-07 20:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 18:13 . 2006-02-28 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-09 06:46 . 2009-08-16 07:15 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-07-09 06:46 . 2008-08-24 14:26 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-07-03 17:09 . 2006-02-28 12:00 915456 ----a-w- c:\windows\system32\wininet.dll
2009-03-01 18:59 . 2009-03-01 18:59 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-02-07 09:28 . 2009-02-07 09:28 608 --sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
"{57BCA5FA-5DBB-45A2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2009-07-02 04:48 2215960 ----a-w- c:\program files\Freecorder\tbFree.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 06:28 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFree.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFree.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{A759AFF6-5851-457D-A540-F4ECED148351}"
[HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-14 39408]
"NoteZilla"="e:\program files\Conceptworld\NoteZilla\NoteZilla.exe" [2008-11-11 1717024]
"Advanced SystemCare 3"="e:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-04-16 24264488]
"Google Update"="c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-30 133104]
"SugarSync"="e:\program files\SugarSync\SugarSyncManager.exe" [2009-05-22 8192000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-18 135168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-18 2022680]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-18 159744]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2007-10-03 53248]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-01 30192]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="e:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"SDActiveMonitor"="c:\program files\SpywareDetector\MaxSDTray.exe" [2009-08-10 570800]
"Malwarebytes Anti-Malware (reboot)"="e:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-18 16859648]

c:\documents and settings\GNATH\Start Menu\Programs\Startup\
Quick To-Do Pro.lnk - e:\program files\Quick To-Do Pro\qtodopro.exe [2009-3-1 1598976]
RecentX.lnk - e:\program files\Conceptworld\RecentX\RecentX.exe [2009-8-6 1016608]
SubliminalPower.lnk - e:\program files\Moss Bay Software\Subliminal Power\SubliminalPower.exe [2008-8-24 217088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2005-5-8 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{1214FBE7-4464-4A7E-9958-B5851A7A30A3}"= "e:\program files\Conceptworld\RecentX\RXShell.dll" [2008-06-12 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-29 04:06 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"
"Smileycons"=e:\program files\Smileycons\smileycons.exe
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"pdfSaver3"="c:\program files\Mindjet\MindManager 7\PDF-XChange\pdfSaver\pdfSaver3.exe"
"YouSendIt.exe"=e:\program files\YouSendIt\Express\YouSendIt.exe -ui none

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MMReminderService"=c:\program files\Mindjet\MindManager 7\MMReminderService.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" "c:\program files\HP\HP UT\"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Tally9 bap\\tally9.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"e:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\HP\\hp laserjet m1522\\Fax Config utility1.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/9/2008 4:10 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/9/2008 4:11 PM 108552]
R1 SDManager;SDManager;c:\program files\SpywareDetector\SDManager.sys [9/20/2009 7:21 PM 15872]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [4/27/2009 8:19 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/20/2009 1:12 PM 297752]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [4/27/2009 8:18 AM 1370488]
R2 MaxWatchDogService;MaxWatchDogService;c:\program files\SpywareDetector\MaxWatchDogService.exe [9/20/2009 7:21 PM 409008]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [11/9/2008 6:06 PM 29208]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2/7/2009 2:41 PM 20504]
S2 TallyLicenseServer;Tally License Server;c:\tally9 bap\tallylicserver.exe [9/26/2008 1:58 PM 892928]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [11/9/2008 6:06 PM 29208]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/2/2009 12:29 AM 30192]
S3 SDActMon;SDActMon;c:\program files\SpywareDetector\SDActMon.sys [9/20/2009 7:21 PM 27056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 01:21]

2009-09-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 07:04]

2009-09-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1214440339-839522115-1003Core.job
- c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-30 15:06]

2009-09-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1214440339-839522115-1003UA.job
- c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-30 15:06]

2009-09-20 c:\windows\Tasks\SmartDefrag.job
- e:\program files\IObit\IObit SmartDefrag\IObit SmartDefrag.exe [2009-04-19 12:45]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Fill Forms - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: {8D7A5078-211D-4A42-9224-E783E38DD68B} = 202.56.230.6,202.56.215.6
DPF: {14E35D5F-DEBA-4DB3-B2ED-17542BA12D1F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: e:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: e:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: e:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 100
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.switch.threshold - 750000
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-*{1392b8d2-5c05-419f-a8f6-b9f15a596612} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
Notify-SDNotify - c:\program files\SpywareDetector\SDNotify.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-09-21 19:00
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1757981266-1214440339-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{04AB8369-2147-F345-0AF2-B93C279705BA}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oamfdjbdaapefjafohjddpephknejc"=hex:64,61,6d,68,65,68,64,61,00,60
"oaipdokoafebhmbkplhdkpehojioij"=hex:6a,61,6d,68,67,68,6f,6f,67,6a,6e,66,6f,6f,
6d,6a,6f,69,6c,6d,00,fd
"nakpfmccaiegbdganbnjaidmljoj"=hex:6a,61,6d,68,67,68,6f,6f,67,6a,6e,66,6f,6f,
6d,6a,6f,69,6c,6d,00,fd

[HKEY_USERS\S-1-5-21-1757981266-1214440339-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B61E5FAC-A4E7-E6AF-FAE8-470B68BDF756}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"oamookhllihiehpfahmpcjpbhipion"=hex:6a,61,69,6c,61,65,69,6c,68,6e,6a,69,70,66,
61,62,64,70,6e,6c,00,00
"nacodinlkbaddpnlnbkjpkklancm"=hex:6a,61,69,6c,62,65,68,6c,61,6d,62,67,64,63,
68,6e,6a,67,6a,67,00,00
"abinfhmbbpojdepcfhnboaplplbjoaddil"=hex:6c,61,6e,63,6c,6b,6d,63,6f,65,6a,62,
66,67,67,67,65,6b,6a,66,6c,6b,68,6a,00,33
"majnmgadnbjdldggdopnbhdjlp"=hex:6f,61,6d,6c,6b,6c,6c,6d,69,62,6d,63,6f,68,66,
69,69,67,66,64,66,67,63,70,70,64,6f,69,6c,6a,00,2f
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3480)
c:\windows\system32\WININET.dll
e:\program files\SugarSync\SugarSyncShellExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\SpywareDetector\MaxActMon.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\program files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\program files\Skype\Phone\Skype.exe
c:\program files\iPod\bin\iPodService.exe
c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2009-09-21 19:04 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-21 13:34

Pre-Run: 46,602,207,232 bytes free
Post-Run: 46,664,404,992 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

344 --- E O F --- 2009-09-09 18:25

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 2:14 pm


  1. Close any open browsers.
  2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  3. Open notepad and copy/paste the text in the quotebox below into it:

    RegNull::
    [HKEY_USERS\S-1-5-21-1757981266-1214440339-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{04AB8369-2147-F345-0AF2-B93C279705BA}*]
    [HKEY_USERS\S-1-5-21-1757981266-1214440339-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B61E5FAC-A4E7-E6AF-FAE8-470B68BDF756}*]
  4. Save this as CFScript.txt, in the same location as ComboFix.exe



  5. Referring to the picture above, drag CFScript into ComboFix.exe
  6. When finished, it shall produce a log for you at C:\ComboFix.txt
  7. Please post the contents of the log in your next reply.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 2:49 pm

Many thanks. Here are the contents of the log file. I haven't seen the virus alert since the last combofix operation. Looks like its gone! Regards, Gautam



ComboFix 09-09-20.01 - Gautam Nath 09/21/2009 20:09.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3060.2306 [GMT 5.5:30]
Running from: c:\documents and settings\GNATH\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\GNATH\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: ZoneAlarm Security Suite Antivirus *On-access scanning disabled* (Outdated) {5D467B10-818C-4CAB-9FF7-6893B5B8F3CF}
FW: AVG Firewall *enabled* {8decf618-9569-4340-b34a-d78d28969b66}
FW: ZoneAlarm Security Suite Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((( Files Created from 2009-08-21 to 2009-09-21 )))))))))))))))))))))))))))))))
.

2009-09-21 09:33 . 2009-09-21 09:33 -------- d-----w- c:\documents and settings\All Users\Application Data\HPSSUPPLY
2009-09-21 03:29 . 2009-09-21 03:29 -------- d-----w- c:\documents and settings\GNATH\Application Data\Malwarebytes
2009-09-21 03:28 . 2009-09-10 09:24 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-21 03:28 . 2009-09-21 03:28 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-21 03:28 . 2009-09-10 09:23 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-20 14:31 . 2009-09-20 14:31 -------- d-----w- c:\program files\Trend Micro
2009-09-20 13:51 . 2009-09-21 08:57 -------- d-----w- c:\program files\SpywareDetector
2009-09-09 03:35 . 2009-06-21 21:44 153088 -c----w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-21 14:43 . 2009-03-28 04:29 -------- d-----w- c:\documents and settings\GNATH\Application Data\Skype
2009-09-21 14:43 . 2008-08-23 11:26 333127456 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-21 14:05 . 2008-09-02 10:07 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\SolidDocuments
2009-09-21 13:31 . 2009-03-28 04:30 -------- d-----w- c:\documents and settings\GNATH\Application Data\skypePM
2009-09-21 13:30 . 2008-08-24 18:16 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-09-21 13:24 . 2008-08-23 11:26 4466024 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-21 13:24 . 2008-09-22 15:53 -------- d-----w- c:\documents and settings\GNATH\Application Data\UseNeXT
2009-09-21 13:15 . 2009-09-20 10:07 94208 ---ha-w- C:\BIT3B3.tmp
2009-09-21 12:33 . 2008-08-24 14:10 -------- d-----w- c:\program files\Java
2009-09-21 12:33 . 2008-08-22 11:45 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-09-21 09:39 . 2008-08-24 14:16 -------- d-----w- c:\documents and settings\GNATH\Application Data\SolidDocuments
2009-09-21 09:38 . 2009-02-07 09:13 153514 ----a-w- c:\windows\hppins08.dat
2009-09-21 09:33 . 2009-02-07 09:21 -------- d-----w- c:\program files\HP
2009-09-21 06:08 . 2008-10-05 12:08 -------- d-----w- c:\documents and settings\All Users\Application Data\pdf995
2009-09-20 13:19 . 2008-09-27 18:28 -------- d-----w- c:\documents and settings\GNATH\Application Data\BitTorrent
2009-09-20 07:21 . 2008-12-26 06:22 -------- d-----w- c:\program files\VideoViewer
2009-09-15 01:42 . 2008-08-23 11:24 4212 ---h--w- c:\windows\system32\zllictbl.dat
2009-08-31 17:53 . 2008-08-24 17:49 -------- d-----w- c:\documents and settings\All Users\Application Data\1Click DVDTOIPOD
2009-08-16 15:56 . 2008-08-24 14:46 -------- d-----w- c:\documents and settings\GNATH\Application Data\YouSendIt
2009-08-16 07:38 . 2008-08-24 14:27 -------- d-----w- c:\documents and settings\GNATH\Application Data\Apple Computer
2009-08-16 07:30 . 2008-08-24 14:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-08-16 07:25 . 2009-08-16 07:24 -------- d-----w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-16 07:24 . 2009-08-16 07:24 -------- d-----w- c:\program files\iPod
2009-08-16 07:24 . 2008-08-24 14:25 -------- d-----w- c:\program files\Common Files\Apple
2009-08-16 07:22 . 2009-08-16 07:22 -------- d-----w- c:\program files\Bonjour
2009-08-16 07:18 . 2009-08-16 07:17 -------- d-----w- c:\program files\QuickTime
2009-08-15 03:44 . 2008-08-22 12:52 84536 ----a-w- c:\documents and settings\GNATH\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-15 03:25 . 2009-08-15 03:25 -------- d-----w- c:\program files\MSBuild
2009-08-15 03:25 . 2009-08-15 03:25 -------- d-----w- c:\program files\Reference Assemblies
2009-08-09 19:14 . 2009-08-09 19:14 -------- d-----w- c:\documents and settings\GNATH\Application Data\Flexigen
2009-08-09 19:13 . 2009-08-09 19:13 -------- d-----w- c:\program files\Flexigen
2009-08-08 06:25 . 2009-08-08 06:25 -------- d-----w- c:\documents and settings\LocalService\Application Data\SolidDocuments
2009-08-05 09:01 . 2006-02-28 12:00 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-29 04:06 . 2008-11-09 10:41 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-07-29 04:06 . 2008-11-09 10:40 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-07-29 04:06 . 2008-11-09 10:40 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-07-28 18:53 . 2009-07-28 18:52 -------- d-----w- c:\program files\Freecorder
2009-07-24 23:53 . 2009-03-07 20:13 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-07-17 19:01 . 2006-02-28 12:00 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-13 18:13 . 2006-02-28 12:00 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-09 06:46 . 2009-08-16 07:15 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-07-09 06:46 . 2008-08-24 14:26 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-07-03 17:09 . 2006-02-28 12:00 915456 ------w- c:\windows\system32\wininet.dll
2009-03-01 18:59 . 2009-03-01 18:59 122880 ----a-w- c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-02-07 09:28 . 2009-02-07 09:28 608 --sha-w- c:\windows\system32\winzvprt5.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]
2009-07-02 04:48 2215960 ----a-w- c:\program files\Freecorder\tbFree.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-09-02 06:28 1107200 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
"{1392b8d2-5c05-419f-a8f6-b9f15a596612}"= "c:\program files\Freecorder\tbFree.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-09-02 1107200]
"{1392B8D2-5C05-419F-A8F6-B9F15A596612}"= "c:\program files\Freecorder\tbFree.dll" [2009-07-02 2215960]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CLASSES_ROOT\clsid\{1392b8d2-5c05-419f-a8f6-b9f15a596612}]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncBackedUp]
@="{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}"
[HKEY_CLASSES_ROOT\CLSID\{0C4A258A-3F3B-4FFF-80A7-9B3BEC139472}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncPending]
@="{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}"
[HKEY_CLASSES_ROOT\CLSID\{62CCD8E3-9C21-41E1-B55E-1E26DFC68511}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncRoot]
@="{A759AFF6-5851-457D-A540-F4ECED148351}"
[HKEY_CLASSES_ROOT\CLSID\{A759AFF6-5851-457D-A540-F4ECED148351}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SugarSyncShared]
@="{1574C9EF-7D58-488F-B358-8B78C1538F51}"
[HKEY_CLASSES_ROOT\CLSID\{1574C9EF-7D58-488F-B358-8B78C1538F51}]
2009-05-22 16:21 139264 ----a-w- e:\program files\SugarSync\SugarSyncShellExt.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-14 39408]
"NoteZilla"="e:\program files\Conceptworld\NoteZilla\NoteZilla.exe" [2008-11-11 1717024]
"Advanced SystemCare 3"="e:\program files\IObit\Advanced SystemCare 3\AWC.exe" [2009-01-09 2262352]
"Skype"="c:\program files\Skype\\Phone\Skype.exe" [2009-04-16 24264488]
"Google Update"="c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-30 133104]
"SugarSync"="e:\program files\SugarSync\SugarSyncManager.exe" [2009-05-22 8192000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-18 135168]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-09-18 2022680]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 919016]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-18 159744]
"ToolBoxFX"="c:\program files\HP\ToolBoxFX\bin\HPTLBXFX.exe" [2007-10-03 53248]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-03-01 30192]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="e:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"SDActiveMonitor"="c:\program files\SpywareDetector\MaxSDTray.exe" [2009-08-10 570800]
"Malwarebytes Anti-Malware (reboot)"="e:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2008-03-18 16859648]

c:\documents and settings\GNATH\Start Menu\Programs\Startup\
Quick To-Do Pro.lnk - e:\program files\Quick To-Do Pro\qtodopro.exe [2009-3-1 1598976]
RecentX.lnk - e:\program files\Conceptworld\RecentX\RecentX.exe [2009-8-6 1016608]
SubliminalPower.lnk - e:\program files\Moss Bay Software\Subliminal Power\SubliminalPower.exe [2008-8-24 217088]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [2005-5-8 65588]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{1214FBE7-4464-4A7E-9958-B5851A7A30A3}"= "e:\program files\Conceptworld\RecentX\RXShell.dll" [2008-06-12 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-07-29 04:06 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"RoboForm"="c:\program files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe"
"BitTorrent DNA"="c:\program files\DNA\btdna.exe"
"Smileycons"=e:\program files\Smileycons\smileycons.exe
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background
"pdfSaver3"="c:\program files\Mindjet\MindManager 7\PDF-XChange\pdfSaver\pdfSaver3.exe"
"YouSendIt.exe"=e:\program files\YouSendIt\Express\YouSendIt.exe -ui none

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MMReminderService"=c:\program files\Mindjet\MindManager 7\MMReminderService.exe
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
"Adobe Reader Speed Launcher"="e:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
"Persistence"=c:\windows\system32\igfxpers.exe
"HP Software Update"=c:\program files\HP\HP Software Update\HPWuSchd2.exe
"HPUsageTracking"="c:\program files\HP\HP UT\bin\hppusg.exe" "c:\program files\HP\HP UT\"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Nero\\Nero 7\\Nero Home\\NeroHome.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Tally9 bap\\tally9.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"e:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\HP\\hp laserjet m1522\\Fax Config utility1.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"e:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [11/9/2008 4:10 PM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [11/9/2008 4:11 PM 108552]
R1 SDManager;SDManager;c:\program files\SpywareDetector\SDManager.sys [9/20/2009 7:21 PM 15872]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [4/27/2009 8:19 AM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2/20/2009 1:12 PM 297752]
R2 avgfws8;AVG8 Firewall;c:\progra~1\AVG\AVG8\avgfws8.exe [4/27/2009 8:18 AM 1370488]
R2 MaxWatchDogService;MaxWatchDogService;c:\program files\SpywareDetector\MaxWatchDogService.exe [9/20/2009 7:21 PM 409008]
R3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [11/9/2008 6:06 PM 29208]
R3 HPFXFAX;HPFXFAX;c:\windows\system32\drivers\hpfxfax.sys [2/7/2009 2:41 PM 20504]
S2 TallyLicenseServer;Tally License Server;c:\tally9 bap\tallylicserver.exe [9/26/2008 1:58 PM 892928]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [11/9/2008 6:06 PM 29208]
S3 GoogleDesktopManager-092308-165331;Google Desktop Manager 5.8.809.23506;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [3/2/2009 12:29 AM 30192]
S3 SDActMon;SDActMon;c:\program files\SpywareDetector\SDActMon.sys [9/20/2009 7:21 PM 27056]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-18 c:\windows\Tasks\1-Click Maintenance.job
- c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe [2006-12-19 01:21]

2009-09-17 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 07:04]

2009-09-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1214440339-839522115-1003Core.job
- c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-30 15:06]

2009-09-21 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-1214440339-839522115-1003UA.job
- c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-30 15:06]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uDefault_Search_URL = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Customize Menu - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Fill Forms - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
IE: RoboForm Toolbar - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
IE: Save Forms - [You must be registered and logged in to see this link.] files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
TCP: {8D7A5078-211D-4A42-9224-E783E38DD68B} = 202.56.230.6,202.56.215.6
DPF: {14E35D5F-DEBA-4DB3-B2ED-17542BA12D1F} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Yahoo! Search
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - prefs.js: keyword.URL - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll
FF - component: c:\documents and settings\GNATH\Application Data\Mozilla\Firefox\Profiles\0hticlqa.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils2.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils3.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\IGeared_tavgp_xputils35.dll
FF - component: c:\program files\AVG\AVG8\Toolbar\Firefox\avg@igeared\components\xpavgtbapi.dll
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - component: c:\program files\Mozilla Firefox\extensions\browserhighlighter@ebay.com\components\Shim.dll
FF - component: c:\program files\Siber Systems\AI RoboForm\Firefox\components\rfproxy_31.dll
FF - plugin: c:\documents and settings\GNATH\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: e:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: e:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: e:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections-per-server - 6
FF - user.js: content.max.tokenizing.time - 1500000
FF - user.js: content.notify.interval - 750000
FF - user.js: nglayout.initialpaint.delay - 100
FF - user.js: network.http.max-persistent-connections-per-server - 3
FF - user.js: content.switch.threshold - 750000
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-*{57BCA5FA-5DBB-45A2-B558-1755C3F6253B} - (no file)



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-09-21 20:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3528)
c:\windows\system32\WININET.dll
e:\program files\SugarSync\SugarSyncShellExt.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.3053_x-ww_b80fa8ca\MSVCR80.dll
c:\progra~1\WINDOW~2\wmpband.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
Completion time: 2009-09-21 20:14
ComboFix-quarantined-files.txt 2009-09-21 14:44
ComboFix2.txt 2009-09-21 13:34

Pre-Run: 46,735,798,272 bytes free
Post-Run: 46,714,331,136 bytes free

276 --- E O F --- 2009-09-09 18:25

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 5:04 pm

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 5:13 pm

Perfectly. Thank you so much, I really appreciate your help and have made a small donation.

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by Belahzur on Mon Sep 21, 2009 5:17 pm

Hello.
I removed your Paypal message, don't post that because it has your transaction ID in it.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34916
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : XP SP3 Media Centre
Points Points : 245069
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Removal of packed.monder

Post by gnath on Mon Sep 21, 2009 5:20 pm

Many thanks for that too!

gnath
Novice
Novice

Posts Posts : 10
Joined Joined : 2009-09-20
OS OS : XP
Points Points : 26352
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum