backdoor.tidserv on another comp

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:21:17 PM, on 12/13/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Yosh\Desktop\Hijack(GP)This.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~2\VPTray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=24931
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\DefWatch.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IS Service (ISSVC) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\ISSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Symantec SecurePort (SymSecurePort) - Symantec Corporation - C:\Program Files\Symantec Client Security\Symantec Client Firewall\SymSPort.exe

--
End of file - 6725 bytes

Uninstall List

Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Apple Mobile Device Support
Apple Software Update
BitLord 1.1
Bonjour
Dell ResourceCD
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
iTunes
Java(TM) 6 Update 10
LimeWire 4.18.8
LiveUpdate 3.0 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional with FrontPage
Mozilla Firefox (3.0.4)
QuickTime
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
SUPERAntiSpyware Free Edition
Symantec Client Security
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Windows Live Messenger
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3

Hello.
Run combofix on this machine too.

ComboFix 08-12-13.03 - Yosh 2008-12-13 16:02:20.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1023.423 [GMT -8:00]
Running from: c:\documents and settings\Yosh\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2008-11-13 to 2008-12-13 )))))))))))))))))))))))))))))))
.

2008-12-12 19:05 . 2008-12-12 19:05 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-12 19:05 . 2008-12-12 19:05 d-------- c:\documents and settings\Yosh\Application Data\Malwarebytes
2008-12-12 19:05 . 2008-12-12 19:05 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-12 19:05 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-12 19:05 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-10 00:18 . 2008-12-10 00:26 d-------- c:\documents and settings\Yosh\Application Data\Azureus
2008-12-10 00:18 . 2008-12-10 00:18 d-------- c:\documents and settings\All Users\Application Data\Azureus
2008-12-10 00:17 . 2008-12-10 00:29 d-------- c:\program files\Vuze
2008-12-09 20:46 . 2008-12-09 20:46 d-------- c:\program files\SUPERAntiSpyware
2008-12-09 20:46 . 2008-12-09 20:46 d-------- c:\program files\Common Files\Wise Installation Wizard
2008-12-09 20:46 . 2008-12-09 20:46 d-------- c:\documents and settings\Yosh\Application Data\SUPERAntiSpyware.com
2008-12-09 20:46 . 2008-12-09 20:46 d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-12-09 20:20 . 2008-12-09 20:20 0 --a------ c:\windows\VPC32.INI
2008-12-07 23:38 . 2008-12-07 23:38 d-------- c:\documents and settings\Mom & Alexa\Contacts
2008-12-06 20:21 . 2001-08-17 13:56 7,552 --a------ c:\windows\system32\drivers\SONYPVU1.SYS
2008-12-06 20:21 . 2001-08-17 13:56 7,552 --a--c--- c:\windows\system32\dllcache\sonypvu1.sys
2008-12-06 01:30 . 2008-12-06 01:30 268 --ah----- C:\sqmdata19.sqm
2008-12-06 01:30 . 2008-12-06 01:30 244 --ah----- C:\sqmnoopt19.sqm
2008-12-06 00:04 . 2008-12-06 00:04 268 --ah----- C:\sqmdata18.sqm
2008-12-06 00:04 . 2008-12-06 00:04 244 --ah----- C:\sqmnoopt18.sqm
2008-12-05 23:51 . 2008-12-05 23:51 268 --ah----- C:\sqmdata17.sqm
2008-12-05 23:51 . 2008-12-05 23:51 244 --ah----- C:\sqmnoopt17.sqm
2008-12-05 19:57 . 2008-12-05 19:57 268 --ah----- C:\sqmdata16.sqm
2008-12-05 19:57 . 2008-12-05 19:57 244 --ah----- C:\sqmnoopt16.sqm
2008-12-05 12:52 . 2008-12-05 12:52 268 --ah----- C:\sqmdata15.sqm
2008-12-05 12:52 . 2008-12-05 12:52 244 --ah----- C:\sqmnoopt15.sqm
2008-12-05 02:06 . 2008-12-05 02:06 268 --ah----- C:\sqmdata14.sqm
2008-12-05 02:06 . 2008-12-05 02:06 244 --ah----- C:\sqmnoopt14.sqm
2008-12-04 18:49 . 2008-12-04 18:49 244 --ah----- C:\sqmnoopt13.sqm
2008-12-04 18:49 . 2008-12-04 18:49 232 --ah----- C:\sqmdata13.sqm
2008-12-04 16:56 . 2008-12-04 17:17 664 --a------ c:\windows\system32\d3d9caps.dat
2008-12-02 15:23 . 2008-12-02 15:23 d-------- c:\program files\Common Files\Adobe AIR
2008-12-02 15:22 . 2008-12-02 15:22 d-------- c:\program files\Common Files\Adobe
2008-12-02 15:20 . 2008-12-02 16:00 d-------- c:\program files\NOS
2008-12-02 15:20 . 2008-12-02 16:00 d-------- c:\documents and settings\All Users\Application Data\NOS
2008-12-01 18:08 . 2008-12-06 11:46 376 --a------ c:\windows\ODBC.INI
2008-12-01 18:06 . 2008-12-01 18:06 d-------- c:\program files\Microsoft ActiveSync
2008-12-01 18:05 . 2008-12-01 18:06 d-------- c:\windows\ShellNew
2008-11-29 18:22 . 2008-11-29 18:22 d--h----- c:\program files\InstallShield Installation Information
2008-11-29 18:22 . 1999-05-13 15:42 1,064,456 --a------ c:\windows\system32\MSCOMCTL.OCX
2008-11-29 18:22 . 1999-05-07 13:24 645,616 --a------ c:\windows\system32\MSCOMCT2.OCX
2008-11-29 18:22 . 2000-03-23 12:50 446,464 -ra------ c:\windows\system32\hhactivex.dll
2008-11-29 18:22 . 1999-05-07 13:24 414,944 --a------ c:\windows\system32\COMCT332.OCX
2008-11-29 18:22 . 1998-11-10 10:46 328,480 --a------ c:\windows\system32\ssa3d30.ocx
2008-11-29 18:22 . 2002-01-08 17:00 176,128 --a------ c:\windows\system32\RcdScan.dll
2008-11-29 18:22 . 1998-09-24 12:03 171,967 --a------ c:\windows\system32\Odbcjet.hlp
2008-11-29 18:22 . 1998-06-17 23:00 89,360 --a------ c:\windows\system32\VB5DB.DLL
2008-11-29 18:22 . 2001-08-22 08:42 13,632 --------- c:\windows\system32\drivers\omci.sys
2008-11-29 18:22 . 1998-09-24 12:03 7,348 --a------ c:\windows\system32\Odbcjet.cnt
2008-11-29 18:21 . 2008-11-29 18:21 d-------- c:\program files\Common Files\InstallShield
2008-11-29 02:37 . 2008-11-29 02:37 268 --ah----- C:\sqmdata12.sqm
2008-11-29 02:37 . 2008-11-29 02:37 244 --ah----- C:\sqmnoopt12.sqm
2008-11-27 09:02 . 2008-11-27 09:02 268 --ah----- C:\sqmdata11.sqm
2008-11-27 09:02 . 2008-11-27 09:02 244 --ah----- C:\sqmnoopt11.sqm
2008-11-26 22:19 . 2008-11-26 22:19 268 --ah----- C:\sqmdata10.sqm
2008-11-26 22:19 . 2008-11-26 22:19 244 --ah----- C:\sqmnoopt10.sqm
2008-11-26 20:00 . 2008-11-26 20:00 268 --ah----- C:\sqmdata09.sqm
2008-11-26 20:00 . 2008-11-26 20:00 244 --ah----- C:\sqmnoopt09.sqm
2008-11-26 16:13 . 2008-11-26 16:13 268 --ah----- C:\sqmdata08.sqm
2008-11-26 16:13 . 2008-11-26 16:13 244 --ah----- C:\sqmnoopt08.sqm
2008-11-26 02:26 . 2008-11-26 02:26 268 --ah----- C:\sqmdata07.sqm
2008-11-26 02:26 . 2008-11-26 02:26 244 --ah----- C:\sqmnoopt07.sqm
2008-11-26 02:15 . 2008-12-11 16:43 d-------- c:\documents and settings\Yosh\Application Data\LimeWire
2008-11-25 22:48 . 2008-11-25 22:48 d-------- c:\documents and settings\Mom & Alexa\Application Data\Apple Computer
2008-11-25 15:17 . 2008-11-26 02:09 d-------- c:\program files\BitLord
2008-11-25 15:09 . 2008-11-25 15:09 d-------- c:\program files\LimeWire
2008-11-25 10:11 . 2008-11-25 10:11 268 --ah----- C:\sqmdata06.sqm
2008-11-25 10:11 . 2008-11-25 10:11 244 --ah----- C:\sqmnoopt06.sqm
2008-11-24 22:25 . 2008-04-13 10:45 26,368 --a--c--- c:\windows\system32\dllcache\usbstor.sys
2008-11-24 20:34 . 2008-04-13 11:19 146,048 --a------ c:\windows\system32\drivers\portcls.sys
2008-11-24 20:34 . 2008-04-13 11:19 146,048 --a--c--- c:\windows\system32\dllcache\portcls.sys
2008-11-24 20:34 . 2008-04-13 10:45 60,160 --a------ c:\windows\system32\drivers\drmk.sys
2008-11-24 20:34 . 2008-04-13 10:45 60,160 --a--c--- c:\windows\system32\dllcache\drmk.sys
2008-11-24 19:51 . 2008-12-07 15:09 268 --ah----- C:\sqmdata05.sqm
2008-11-24 19:51 . 2008-12-07 15:09 244 --ah----- C:\sqmnoopt05.sqm
2008-11-24 19:46 . 2008-11-24 19:46 d-------- c:\documents and settings\Jonathan\Application Data\Apple Computer
2008-11-24 19:46 . 2008-12-07 14:40 268 --ah----- C:\sqmdata04.sqm
2008-11-24 19:46 . 2008-12-07 14:40 244 --ah----- C:\sqmnoopt04.sqm
2008-11-24 19:38 . 2008-12-07 00:09 268 --ah----- C:\sqmdata03.sqm
2008-11-24 19:38 . 2008-12-07 00:09 244 --ah----- C:\sqmnoopt03.sqm
2008-11-24 19:26 . 2008-11-24 19:26 d-------- c:\windows\system32\scripting
2008-11-24 19:26 . 2008-11-24 19:26 d-------- c:\windows\system32\en
2008-11-24 19:26 . 2008-11-24 19:26 d-------- c:\windows\l2schemas
2008-11-24 16:08 . 2008-11-24 16:08 d-------- c:\program files\iTunes
2008-11-24 16:08 . 2008-11-24 16:08 d-------- c:\program files\iPod
2008-11-24 16:08 . 2008-11-24 16:08 d-------- c:\documents and settings\Yosh\Application Data\Apple Computer
2008-11-24 16:08 . 2008-11-24 16:08 d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-11-24 16:08 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-11-24 16:08 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-11-24 16:07 . 2008-11-24 16:07 d-------- c:\program files\QuickTime
2008-11-24 16:07 . 2008-11-24 16:07 d-------- c:\program files\Bonjour
2008-11-24 16:07 . 2008-11-24 16:08 d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-24 16:06 . 2008-11-24 16:08 d-------- c:\program files\Common Files\Apple
2008-11-24 16:06 . 2008-11-24 16:06 d-------- c:\program files\Apple Software Update
2008-11-24 16:06 . 2008-11-24 16:06 d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-24 16:06 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-11-24 15:39 . 2008-10-16 12:38 6,066,176 -----c--- c:\windows\system32\dllcache\ieframe.dll
2008-11-24 15:39 . 2007-04-17 01:32 2,455,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dat
2008-11-24 15:39 . 2007-03-07 21:10 991,232 -----c--- c:\windows\system32\dllcache\ieframe.dll.mui
2008-11-24 15:39 . 2008-10-16 12:38 459,264 -----c--- c:\windows\system32\dllcache\msfeeds.dll
2008-11-24 15:39 . 2008-10-16 12:38 383,488 -----c--- c:\windows\system32\dllcache\ieapfltr.dll
2008-11-24 15:39 . 2008-10-16 12:38 267,776 -----c--- c:\windows\system32\dllcache\iertutil.dll
2008-11-24 15:39 . 2008-10-16 12:38 63,488 -----c--- c:\windows\system32\dllcache\icardie.dll
2008-11-24 15:39 . 2008-10-16 12:38 52,224 -----c--- c:\windows\system32\dllcache\msfeedsbs.dll
2008-11-24 15:39 . 2008-10-16 05:11 13,824 -----c--- c:\windows\system32\dllcache\ieudinit.exe
2008-11-24 14:59 . 2008-09-09 17:14 1,307,648 --------- c:\windows\system32\msxml6.dll
2008-11-24 14:58 . 2008-04-13 16:11 650,752 --------- c:\windows\system32\dot3ui.dll
2008-11-24 14:43 . 2008-04-11 11:04 691,712 -----c--- c:\windows\system32\dllcache\inetcomm.dll
2008-11-24 14:43 . 2008-05-01 06:33 331,776 -----c--- c:\windows\system32\dllcache\msadce.dll
2008-11-24 14:43 . 2008-06-13 03:05 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-24 14:43 . 2008-05-08 06:02 203,136 -----c--- c:\windows\system32\dllcache\rmcast.sys
2008-11-24 14:43 . 2008-08-14 02:04 138,496 -----c--- c:\windows\system32\dllcache\afd.sys
2008-11-24 14:42 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-24 14:42 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-24 14:42 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-24 14:42 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-24 14:42 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows\system32\dllcache\win32k.sys
2008-11-24 14:42 . 2008-09-04 09:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-24 14:42 . 2008-10-24 03:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-24 14:42 . 2008-10-15 08:34 337,408 -----c--- c:\windows\system32\dllcache\netapi32.dll
2008-11-24 14:42 . 2008-09-08 02:41 333,824 -----c--- c:\windows\system32\dllcache\srv.sys
2008-11-24 14:41 . 2008-12-10 03:00 d--h----- c:\windows\$hf_mig$
2008-11-24 13:28 . 2008-11-24 13:28 d--hs---- c:\documents and settings\Yosh\UserData
2008-11-24 13:16 . 2008-11-24 13:16 d---s---- c:\windows\system32\Microsoft
2008-11-24 12:28 . 2008-11-29 18:57 316,640 --a------ c:\windows\WMSysPr9.prx

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-23 02:42 155,995 ----a-w c:\windows\java\Packages\GFTBVRDJ.ZIP
2008-11-23 02:33 --------- d-----w c:\program files\microsoft frontpage
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 22:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 22:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 22:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 22:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-03 10:02 247,326 ----a-w c:\windows\system32\strmdll.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-12-04 1809648]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-23 136600]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2006-03-07 53408]
"vptray"="c:\progra~1\SYMANT~1\SYMANT~2\VPTray.exe" [2006-03-17 124656]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-03 14:56 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=

R1 SASDIFSV;SASDIFSV;\??\c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;\??\c:\program files\SUPERAntiSpyware\SASKUTIL.sys [2008-12-04 55024]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-11-23 99376]
R3 SASENUM;SASENUM;\??\c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 SavRoam;SAVRoam;"c:\program files\Symantec Client Security\Symantec AntiVirus\SavRoam.exe" [2006-03-17 115952]

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{11FC12D0-1A72-12D2-992D-5BC14F992BC7}]
c:\windows\system32\javan.exe
.
Contents of the 'Scheduled Tasks' folder

2008-12-11 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.myspace.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Yosh\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\iTunes\Mozilla Plugins\npitunes.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-13 16:06:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(516)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2008-12-13 16:08:18
ComboFix-quarantined-files.txt 2008-12-14 00:08:11

Pre-Run: 16,123,879,424 bytes free
Post-Run: 17,435,074,560 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

239 --- E O F --- 2008-12-11 11:02:11

Hello.
Bad news.

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

• Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  
• Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  
• Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  
• From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
  

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

Due to its backdoor functionality, your computer is very likely to have been compromised and there is no way that it can be trusted again. Many experts in the security community believe that once infected with this type of Trojan, the best course of action would be to do a reformat and reinstallation of the operating system (OS). However, if you do not have the resources to reinstall your OS and would like me to attempt to clean your machine, I will be happy to do so.

To help you understand more, please take some time to read the following articles:

What are Remote Access Trojans and why are they dangerous
How do I respond to a possible identity theft and how do I prevent it
When should do a reformat and reinstallation of my OS
Where to backup your files
How to backup your files in Windows XP
Restoring your backups

if at all possible, i would like to see what we can do with it, the comp was just rebuilt and windows re-installed and it was a pain trying to get a new product key. if you really recommend that we not proceed trying to fix it, then i won't. i'm using the good comp to check back here, i have the bad one disconnected like you said.

We can attempt cleaning it, do you use this now infected one for stuff like Paypal? If so, I recommend we do not try cleaning and re-install.
But if it's just used for something like gaming, then we go ahead and attempt cleaning.

But remember, if you want to do anything financially, use the clean machine, this infected one can't be trusted.

Please let me know what you want to do.

its pretty much just used for internet browsing and some gaming. but i have let everyone know to use the clean one for financial stuff.

Okay.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :processes
  explorer.exe
  
  :files
  C:\sqmdata*.sqm
  C:\sqmnoopt*.sqm
  c:\windows\system32\javan.exe
  
  :reg
  [-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{11FC12D0-1A72-12D2-992D-5BC14F992BC7}]
  
  :commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]
  
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
C:\sqmdata00.sqm moved successfully.
C:\sqmdata01.sqm moved successfully.
C:\sqmdata02.sqm moved successfully.
C:\sqmdata03.sqm moved successfully.
C:\sqmdata04.sqm moved successfully.
C:\sqmdata05.sqm moved successfully.
C:\sqmdata06.sqm moved successfully.
C:\sqmdata07.sqm moved successfully.
C:\sqmdata08.sqm moved successfully.
C:\sqmdata09.sqm moved successfully.
C:\sqmdata10.sqm moved successfully.
C:\sqmdata11.sqm moved successfully.
C:\sqmdata12.sqm moved successfully.
C:\sqmdata13.sqm moved successfully.
C:\sqmdata14.sqm moved successfully.
C:\sqmdata15.sqm moved successfully.
C:\sqmdata16.sqm moved successfully.
C:\sqmdata17.sqm moved successfully.
C:\sqmdata18.sqm moved successfully.
C:\sqmdata19.sqm moved successfully.
C:\sqmnoopt00.sqm moved successfully.
C:\sqmnoopt01.sqm moved successfully.
C:\sqmnoopt02.sqm moved successfully.
C:\sqmnoopt03.sqm moved successfully.
C:\sqmnoopt04.sqm moved successfully.
C:\sqmnoopt05.sqm moved successfully.
C:\sqmnoopt06.sqm moved successfully.
C:\sqmnoopt07.sqm moved successfully.
C:\sqmnoopt08.sqm moved successfully.
C:\sqmnoopt09.sqm moved successfully.
C:\sqmnoopt10.sqm moved successfully.
C:\sqmnoopt11.sqm moved successfully.
C:\sqmnoopt12.sqm moved successfully.
C:\sqmnoopt13.sqm moved successfully.
C:\sqmnoopt14.sqm moved successfully.
C:\sqmnoopt15.sqm moved successfully.
C:\sqmnoopt16.sqm moved successfully.
C:\sqmnoopt17.sqm moved successfully.
C:\sqmnoopt18.sqm moved successfully.
C:\sqmnoopt19.sqm moved successfully.
File/Folder c:\windows\system32\javan.exe not found.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{11FC12D0-1A72-12D2-992D-5BC14F992BC7}\\ deleted successfully.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_DAxe76h605EF5ploW3gm scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_DAxe76h605EF5ploW3gm-journal scheduled to be deleted on reboot.
File delete failed. C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_hTiaStntJnTJn24vAuOq scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
File delete failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_a0.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\OfflineCache\index.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_001_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_002_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_003_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_MAP_ scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\urlclassifier3.sqlite scheduled to be deleted on reboot.
File delete failed. C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\XUL.mfl scheduled to be deleted on reboot.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12132008_191958

Files moved on Reboot...
File C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_DAxe76h605EF5ploW3gm not found!
File C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_DAxe76h605EF5ploW3gm-journal not found!
File C:\DOCUME~1\Yosh\LOCALS~1\Temp\etilqs_hTiaStntJnTJn24vAuOq not found!
File move failed. C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat scheduled to be moved on reboot.
File C:\WINDOWS\temp\Perflib_Perfdata_a0.dat not found!
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\OfflineCache\index.sqlite moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_001_ moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_002_ moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_003_ moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\Cache\_CACHE_MAP_ moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\urlclassifier3.sqlite moved successfully.
C:\Documents and Settings\Yosh\Local Settings\Application Data\Mozilla\Firefox\Profiles\jz8e5oap.default\XUL.mfl moved successfully.

Looks good, what problems remain?

is it safe to connect it back to the router and stuff

Yeah, the backdoor file/key has been removed.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.