Tech Support Forum - View Single Post - HJT Help with everything from spyware to "antispyware"

grizzgrizz87 · 08-08-2007, 10:52 AM

Thankies sUBs!!

ComboFix:

ComboFix 07-08-08 - "Administrator" 2007-08-08 9:33:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2497 [GMT -7:00]
* Created a new restore point

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\install.dat
C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Find Spyware Remover.lnk
C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Free Online Dating.lnk
C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Go to Casino.lnk
C:\Program Files\appatc~1
C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
C:\Program Files\ucleaner_setup.exe
C:\Program Files\Ultimate Cleaner
C:\WINDOWS\Casino.ico
C:\WINDOWS\Free Online Dating.ico
C:\WINDOWS\mgrs.exe
C:\WINDOWS\Spyware Remover.ico
C:\WINDOWS\system32\akbauedx.ini
C:\WINDOWS\system32\asomjkuw.exe
C:\WINDOWS\system32\atkeyqfe.exe
C:\WINDOWS\system32\awtqo.dll
C:\WINDOWS\system32\fkfqahfr.exe
C:\WINDOWS\system32\gebbcyx.dll
C:\WINDOWS\system32\gydutoul.exe
C:\WINDOWS\system32\hlpsrv.exe
C:\WINDOWS\system32\honmdutd.exe
C:\WINDOWS\system32\icroso~1
C:\WINDOWS\system32\ifkqjqtu.exe
C:\WINDOWS\system32\jjmmxulg.exe
C:\WINDOWS\system32\juvdfisw.dll
C:\WINDOWS\system32\kyaybqck.exe
C:\WINDOWS\system32\lfcyheqq.exe
C:\WINDOWS\system32\lxbktlnl.exe
C:\WINDOWS\system32\mit.bat
C:\WINDOWS\system32\mwtjbmhu.exe
C:\WINDOWS\system32\ooqbcqov.exe
C:\WINDOWS\system32\oqtwa.bak1
C:\WINDOWS\system32\oqtwa.bak2
C:\WINDOWS\system32\oqtwa.ini
C:\WINDOWS\system32\primrpcf.exe
C:\WINDOWS\system32\ptxhelpn.exe
C:\WINDOWS\system32\qahjdwxg.exe
C:\WINDOWS\system32\qnexnohc.exe
C:\WINDOWS\system32\qqtgcwpb.exe
C:\WINDOWS\system32\rcofcwmo.exe
C:\WINDOWS\system32\tdfqolik.exe
C:\WINDOWS\system32\urqpmjh.dll
C:\WINDOWS\system32\winlgj32.dll
C:\WINDOWS\system32\wiypieuw.exe
C:\WINDOWS\system32\xdeuabka.dll
C:\WINDOWS\system32\xnrufalq.exe
C:\WINDOWS\system32\xxojhyvj.exe
C:\WINDOWS\system32\yayyvvs.dll
C:\WINDOWS\system32\yuqktrds.exe

((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))

2007-08-08 09:32 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-08-07 22:49 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-06 12:49 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Oxin's Style!
2007-08-06 12:48 <DIR> d-------- C:\Program Files\thriXXX
2007-08-06 10:51 <DIR> d-------- C:\Program Files\FlashFXP
2007-08-06 10:51 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\FlashFXP
2007-08-06 10:13 6,372 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2007-08-02 06:32 93,696 --a------ C:\WINDOWS\system32\drvbig.dll
2007-07-28 09:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy
2007-07-27 16:40 126,016 --a------ C:\WINDOWS\system32\esranlok.dll
2007-07-27 15:59 <DIR> d-------- C:\ProgramData
2007-07-27 15:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Google
2007-07-27 15:36 <DIR> d-------- C:\VundoFix Backups
2007-07-27 15:36 <DIR> d-------- C:\Program Files\Google
2007-07-27 09:24 <DIR> d-------- C:\Program Files\Windows Defender
2007-07-26 22:06 93,696 --a------ C:\WINDOWS\system32\drvsuw.dll
2007-07-26 18:13 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\Opera
2007-07-26 18:10 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\uTorrent
2007-07-26 17:50 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\vlc
2007-07-26 16:32 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-07-26 16:31 1,572,864 --ah----- C:\DOCUME~1\Blackie\NTUSER.DAT
2007-07-26 16:30 <DIR> dr------- C:\Program Files\Aston
2007-07-26 08:55 1,933,312 --a------ C:\WINDOWS\system32\cdintf250.dll
2007-07-26 08:54 <DIR> d-------- C:\Program Files\Quicken
2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Palo Alto Software
2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Intuit
2007-07-26 08:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Intuit
2007-07-26 08:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Intuit
2007-07-23 06:25 <DIR> d-------- C:\Program Files\Last.fm
2007-07-22 13:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\dvdcss
2007-07-21 22:34 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll
2007-07-21 22:34 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll
2007-07-21 22:34 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll
2007-07-21 22:34 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll
2007-07-21 15:08 <DIR> d-------- C:\Program Files\iTunes
2007-07-21 15:05 <DIR> d-------- C:\Program Files\Common Files\Apple
2007-07-21 15:05 <DIR> d-------- C:\Program Files\Apple Software Update
2007-07-21 15:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple
2007-07-17 19:13 <DIR> d-------- C:\Program Files\Common Files\DirectX
2007-07-17 19:10 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll
2007-07-17 19:10 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll
2007-07-17 19:10 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2007-07-17 19:10 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll
2007-07-17 19:10 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll
2007-07-17 19:10 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll
2007-07-17 19:10 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll
2007-07-17 19:10 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll
2007-07-17 19:10 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll
2007-07-16 19:20 2,192,640 --a------ C:\WINDOWS\system32\kernel1.exe
2007-07-16 19:06 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-07-16 14:55 24,192 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermptxp.sys
2007-07-16 14:55 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys
2007-07-16 14:55 22,768 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermpt.sys
2007-07-13 11:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Help
2007-07-10 16:51 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-08 04:16 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\uTorrent
2007-08-06 10:13 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-07-30 18:46 8 --a------ C:\WINDOWS\system32\nvModes.dat
2007-07-27 15:32 --------- d-------- C:\Program Files\Microsoft IntelliType Pro
2007-07-27 09:29 --------- d-------- C:\Program Files\Opera
2007-07-26 18:25 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-26 18:25 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-26 16:07 --------- d-------- C:\Program Files\The All-Seeing Eye
2007-07-24 21:58 --------- d-------- C:\Program Files\uTorrent
2007-07-21 15:34 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Apple Computer
2007-07-21 15:08 --------- d-------- C:\Program Files\iPod
2007-07-21 15:07 --------- d-------- C:\Program Files\QuickTime
2007-07-21 14:11 --------- d-------- C:\Program Files\Winamp
2007-07-20 08:40 1809 --a------ C:\WINDOWS\mozver.dat
2007-07-16 14:56 --------- d-------- C:\Program Files\Motorola Phone Tools
2007-07-16 14:56 --------- d-------- C:\Program Files\Avanquest update
2007-07-06 22:14 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-05 22:10 --------- d-------- C:\Program Files\BitLord2
2007-07-05 15:26 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\InstallShield
2007-07-01 08:36 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SlySoft
2007-06-30 23:17 --------- d-------- C:\Program Files\CloneDVD
2007-06-30 23:16 14 --a------ C:\WINDOWS\system32\systeminfo3.dll
2007-06-30 23:15 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Vso
2007-06-30 23:14 81920 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ezpinst.exe
2007-06-30 23:14 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys
2007-06-30 23:14 47360 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\pcouffin.sys
2007-06-30 23:09 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys
2007-06-30 23:09 34308 --a------ C:\WINDOWS\system32\Chip.dll
2007-06-30 21:56 --------- d-------- C:\Program Files\Common Files\AOL
2007-06-30 21:56 --------- d-------- C:\Program Files\AIM6
2007-06-28 19:58 --------- d-------- C:\Program Files\HP
2007-06-27 03:00 --------- d-------- C:\Program Files\MSXML 4.0
2007-06-27 03:00 --------- d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-26 16:01 --------- d-------- C:\Program Files\Hewlett-Packard
2007-06-26 00:08 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Opera
2007-06-25 23:23 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment
2007-06-25 22:05 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SecondLife
2007-06-25 21:16 --------- d-------- C:\Program Files\SecondLife
2007-06-25 21:04 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-06-22 06:54 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys.bak
2007-06-20 14:08 93128 --a------ C:\WINDOWS\system32\ElbyCDIO.dll
2007-06-12 12:24 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Viewpoint
2007-06-11 10:16 5028 --a------ C:\dnsbak.reg
2007-06-11 09:38 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Aston
2007-06-10 22:09 --------- d-------- C:\Program Files\Windows Live
2007-06-03 08:17 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-06-01 08:20 51568 --a------ C:\WINDOWS\system32\sirenacm.dll
2007-05-20 18:11 291 --a------ C:\WINDOWS\PowerReg.dat
2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 08:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll
2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll
2001-01-11 16:02 794624 --a------ C:\WINDOWS\inf\OTHER\audio3d.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6}]
C:\WINDOWS\system32\geedc.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92E68C11-E017-43CD-82C0-48131B6FCA41}]
C:\WINDOWS\system32\awvts.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26]
"nwiz"="nwiz.exe" []
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 07:57]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-05-20 03:13]
"C-Media Mixer"="Mixer.exe" [2001-10-22 18:24 C:\WINDOWS\mixer.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 07:46]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
"itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-06-01 08:21]
"STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 11:31]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-23 06:25:21]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedc]
C:\WINDOWS\system32\geedc.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrsst]
ssqrsst.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD]
C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp]
C:\WINDOWS\TEMP\win511E.tmp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive]
rundll32.exe C:\WINDOWS\system32\drvsuw.dll,startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core]
"C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magicantispy]
C:\Program Files\Magicantispy\Magicantispy.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr]
mgrs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
rundll32.exe "C:\WINDOWS\system32\ixqfpdmc.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader]
C:\Windows\xpupdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"WLSetupSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"ose"=3 (0x3)
"odserv"=3 (0x3)
"NBService"=3 (0x3)
"Microsoft Office Groove Audit Service"=3 (0x3)
"iPod Service"=3 (0x3)

R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys
R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys
R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe
R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\system32\drivers\cmaudio.sys
R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys
S3 PnkBstrK;PnkBstrK;\??\C:\WINDOWS\system32\drivers\PnkBstrK.sys
S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys
S3 usbsermpt;Motorola USB Modem Driver for MPT;C:\WINDOWS\system32\DRIVERS\usbsermpt.sys
S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe"
S4 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE"

Contents of the 'Scheduled Tasks' folder
2007-08-03 15:58:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
2007-07-27 22:58:21 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job - C:\Program Files\Microsoft IntelliType Pro\itype.exe
2007-08-08 11:21:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-08 09:42:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

**************************************************************************

Completion time: 2007-08-08 9:45:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-08 09:44

--- E O F ---

HijackThis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:51:46 AM, on 8/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS\Mixer.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Microsoft IntelliType Pro\itype.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\TGTSoft\StyleXP\StyleXP.exe
C:\Program Files\Last.fm\LastFMHelper.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6} - C:\WINDOWS\system32\geedc.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {92E68C11-E017-43CD-82C0-48131B6FCA41} - C:\WINDOWS\system32\awvts.dll (file missing)
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll
O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: geedc - C:\WINDOWS\system32\geedc.dll (file missing)
O20 - Winlogon Notify: ssqrsst - ssqrsst.dll (file missing)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing)
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe

--
End of file - 7568 bytes

Again thank you very much.

08-08-2007, 10:52 AM	#3 (permalink)
grizzgrizz87 Registered User Join Date: Aug 2007 Posts: 10 OS: Win XP	Re: HJT Help with everything from spyware to "antispyware" Thankies sUBs!! ComboFix: ComboFix 07-08-08 - "Administrator" 2007-08-08 9:33:24.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2497 [GMT -7:00] * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\install.dat C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Find Spyware Remover.lnk C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Free Online Dating.lnk C:\DOCUME~1\ADMINI~1.JOS\Desktop.\Go to Casino.lnk C:\Program Files\appatc~1 C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe C:\Program Files\ucleaner_setup.exe C:\Program Files\Ultimate Cleaner C:\WINDOWS\Casino.ico C:\WINDOWS\Free Online Dating.ico C:\WINDOWS\mgrs.exe C:\WINDOWS\Spyware Remover.ico C:\WINDOWS\system32\akbauedx.ini C:\WINDOWS\system32\asomjkuw.exe C:\WINDOWS\system32\atkeyqfe.exe C:\WINDOWS\system32\awtqo.dll C:\WINDOWS\system32\fkfqahfr.exe C:\WINDOWS\system32\gebbcyx.dll C:\WINDOWS\system32\gydutoul.exe C:\WINDOWS\system32\hlpsrv.exe C:\WINDOWS\system32\honmdutd.exe C:\WINDOWS\system32\icroso~1 C:\WINDOWS\system32\ifkqjqtu.exe C:\WINDOWS\system32\jjmmxulg.exe C:\WINDOWS\system32\juvdfisw.dll C:\WINDOWS\system32\kyaybqck.exe C:\WINDOWS\system32\lfcyheqq.exe C:\WINDOWS\system32\lxbktlnl.exe C:\WINDOWS\system32\mit.bat C:\WINDOWS\system32\mwtjbmhu.exe C:\WINDOWS\system32\ooqbcqov.exe C:\WINDOWS\system32\oqtwa.bak1 C:\WINDOWS\system32\oqtwa.bak2 C:\WINDOWS\system32\oqtwa.ini C:\WINDOWS\system32\primrpcf.exe C:\WINDOWS\system32\ptxhelpn.exe C:\WINDOWS\system32\qahjdwxg.exe C:\WINDOWS\system32\qnexnohc.exe C:\WINDOWS\system32\qqtgcwpb.exe C:\WINDOWS\system32\rcofcwmo.exe C:\WINDOWS\system32\tdfqolik.exe C:\WINDOWS\system32\urqpmjh.dll C:\WINDOWS\system32\winlgj32.dll C:\WINDOWS\system32\wiypieuw.exe C:\WINDOWS\system32\xdeuabka.dll C:\WINDOWS\system32\xnrufalq.exe C:\WINDOWS\system32\xxojhyvj.exe C:\WINDOWS\system32\yayyvvs.dll C:\WINDOWS\system32\yuqktrds.exe ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 ))))))))))))))))))))))))))))))) 2007-08-08 09:32 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-08-07 22:49 <DIR> d-------- C:\Program Files\Trend Micro 2007-08-06 12:49 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Oxin's Style! 2007-08-06 12:48 <DIR> d-------- C:\Program Files\thriXXX 2007-08-06 10:51 <DIR> d-------- C:\Program Files\FlashFXP 2007-08-06 10:51 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\FlashFXP 2007-08-06 10:13 6,372 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg 2007-08-02 06:32 93,696 --a------ C:\WINDOWS\system32\drvbig.dll 2007-07-28 09:03 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Spybot - Search & Destroy 2007-07-27 16:40 126,016 --a------ C:\WINDOWS\system32\esranlok.dll 2007-07-27 15:59 <DIR> d-------- C:\ProgramData 2007-07-27 15:40 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Google 2007-07-27 15:36 <DIR> d-------- C:\VundoFix Backups 2007-07-27 15:36 <DIR> d-------- C:\Program Files\Google 2007-07-27 09:24 <DIR> d-------- C:\Program Files\Windows Defender 2007-07-26 22:06 93,696 --a------ C:\WINDOWS\system32\drvsuw.dll 2007-07-26 18:13 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\Opera 2007-07-26 18:10 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\uTorrent 2007-07-26 17:50 <DIR> d-------- C:\DOCUME~1\Blackie\APPLIC~1\vlc 2007-07-26 16:32 221,184 --a------ C:\WINDOWS\system32\wmpns.dll 2007-07-26 16:31 1,572,864 --ah----- C:\DOCUME~1\Blackie\NTUSER.DAT 2007-07-26 16:30 <DIR> dr------- C:\Program Files\Aston 2007-07-26 08:55 1,933,312 --a------ C:\WINDOWS\system32\cdintf250.dll 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Quicken 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Palo Alto Software 2007-07-26 08:54 <DIR> d-------- C:\Program Files\Common Files\Intuit 2007-07-26 08:54 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Intuit 2007-07-26 08:53 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Intuit 2007-07-23 06:25 <DIR> d-------- C:\Program Files\Last.fm 2007-07-22 13:59 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\dvdcss 2007-07-21 22:34 443,752 --a------ C:\WINDOWS\system32\d3dx10_33.dll 2007-07-21 22:34 3,495,784 --a------ C:\WINDOWS\system32\d3dx9_33.dll 2007-07-21 22:34 261,480 --a------ C:\WINDOWS\system32\xactengine2_7.dll 2007-07-21 22:34 1,123,696 --a------ C:\WINDOWS\system32\D3DCompiler_33.dll 2007-07-21 15:08 <DIR> d-------- C:\Program Files\iTunes 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Common Files\Apple 2007-07-21 15:05 <DIR> d-------- C:\Program Files\Apple Software Update 2007-07-21 15:05 <DIR> d-------- C:\DOCUME~1\ALLUSE~1.WIN\APPLIC~1\Apple 2007-07-17 19:13 <DIR> d-------- C:\Program Files\Common Files\DirectX 2007-07-17 19:10 81,768 --a------ C:\WINDOWS\system32\xinput1_3.dll 2007-07-17 19:10 62,744 --a------ C:\WINDOWS\system32\xinput1_2.dll 2007-07-17 19:10 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll 2007-07-17 19:10 255,848 --a------ C:\WINDOWS\system32\xactengine2_6.dll 2007-07-17 19:10 251,672 --a------ C:\WINDOWS\system32\xactengine2_5.dll 2007-07-17 19:10 237,848 --a------ C:\WINDOWS\system32\xactengine2_4.dll 2007-07-17 19:10 236,824 --a------ C:\WINDOWS\system32\xactengine2_3.dll 2007-07-17 19:10 2,414,360 --a------ C:\WINDOWS\system32\d3dx9_31.dll 2007-07-17 19:10 15,128 --a------ C:\WINDOWS\system32\x3daudio1_1.dll 2007-07-16 19:20 2,192,640 --a------ C:\WINDOWS\system32\kernel1.exe 2007-07-16 19:06 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy 2007-07-16 14:55 24,192 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermptxp.sys 2007-07-16 14:55 22,768 --a------ C:\WINDOWS\system32\drivers\usbsermpt.sys 2007-07-16 14:55 22,768 --a------ C:\DOCUME~1\ADMINI~1.JOS\usbsermpt.sys 2007-07-13 11:02 <DIR> d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Help 2007-07-10 16:51 <DIR> d-------- C:\Program Files\Common Files\Macromedia Shared (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-08-08 04:16 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\uTorrent 2007-08-06 10:13 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-07-30 18:46 8 --a------ C:\WINDOWS\system32\nvModes.dat 2007-07-27 15:32 --------- d-------- C:\Program Files\Microsoft IntelliType Pro 2007-07-27 09:29 --------- d-------- C:\Program Files\Opera 2007-07-26 18:25 99904 --a------ C:\WINDOWS\system32\PnkBstrB.exe 2007-07-26 18:25 22584 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-07-26 16:07 --------- d-------- C:\Program Files\The All-Seeing Eye 2007-07-24 21:58 --------- d-------- C:\Program Files\uTorrent 2007-07-21 15:34 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Apple Computer 2007-07-21 15:08 --------- d-------- C:\Program Files\iPod 2007-07-21 15:07 --------- d-------- C:\Program Files\QuickTime 2007-07-21 14:11 --------- d-------- C:\Program Files\Winamp 2007-07-20 08:40 1809 --a------ C:\WINDOWS\mozver.dat 2007-07-16 14:56 --------- d-------- C:\Program Files\Motorola Phone Tools 2007-07-16 14:56 --------- d-------- C:\Program Files\Avanquest update 2007-07-06 22:14 163644 --a------ C:\WINDOWS\system32\drivers\secdrv.sys 2007-07-05 22:10 --------- d-------- C:\Program Files\BitLord2 2007-07-05 15:26 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\InstallShield 2007-07-01 08:36 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SlySoft 2007-06-30 23:17 --------- d-------- C:\Program Files\CloneDVD 2007-06-30 23:16 14 --a------ C:\WINDOWS\system32\systeminfo3.dll 2007-06-30 23:15 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Vso 2007-06-30 23:14 81920 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\ezpinst.exe 2007-06-30 23:14 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-06-30 23:14 47360 --a------ C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\pcouffin.sys 2007-06-30 23:09 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys 2007-06-30 23:09 34308 --a------ C:\WINDOWS\system32\Chip.dll 2007-06-30 21:56 --------- d-------- C:\Program Files\Common Files\AOL 2007-06-30 21:56 --------- d-------- C:\Program Files\AIM6 2007-06-28 19:58 --------- d-------- C:\Program Files\HP 2007-06-27 03:00 --------- d-------- C:\Program Files\MSXML 4.0 2007-06-27 03:00 --------- d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2 2007-06-26 16:01 --------- d-------- C:\Program Files\Hewlett-Packard 2007-06-26 00:08 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Opera 2007-06-25 23:23 --------- d-------- C:\Program Files\Common Files\Blizzard Entertainment 2007-06-25 22:05 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\SecondLife 2007-06-25 21:16 --------- d-------- C:\Program Files\SecondLife 2007-06-25 21:04 499712 --a------ C:\WINDOWS\system32\msvcp71.dll 2007-06-22 06:54 99904 --a------ C:\WINDOWS\system32\drivers\AnyDVD.sys.bak 2007-06-20 14:08 93128 --a------ C:\WINDOWS\system32\ElbyCDIO.dll 2007-06-12 12:24 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Viewpoint 2007-06-11 10:16 5028 --a------ C:\dnsbak.reg 2007-06-11 09:38 --------- d-------- C:\DOCUME~1\ADMINI~1.JOS\APPLIC~1\Aston 2007-06-10 22:09 --------- d-------- C:\Program Files\Windows Live 2007-06-03 08:17 108144 --a------ C:\WINDOWS\system32\CmdLineExt.dll 2007-06-01 08:20 51568 --a------ C:\WINDOWS\system32\sirenacm.dll 2007-05-20 18:11 291 --a------ C:\WINDOWS\PowerReg.dat 2007-05-16 08:12 86528 --a--c--- C:\WINDOWS\system32\dllcache\directdb.dll 2007-05-16 08:12 85504 --a--c--- C:\WINDOWS\system32\dllcache\wabimp.dll 2007-05-16 08:12 683520 --a--c--- C:\WINDOWS\system32\dllcache\inetcomm.dll 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-16 08:12 510976 --a--c--- C:\WINDOWS\system32\dllcache\wab32.dll 2007-05-16 08:12 1314816 --a--c--- C:\WINDOWS\system32\dllcache\msoe.dll 2007-05-08 02:24 3583488 --a--c--- C:\WINDOWS\system32\dllcache\mshtml.dll 2001-01-11 16:02 794624 --a------ C:\WINDOWS\inf\OTHER\audio3d.dll ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6}] C:\WINDOWS\system32\geedc.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{92E68C11-E017-43CD-82C0-48131B6FCA41}] C:\WINDOWS\system32\awvts.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 13:26] "nwiz"="nwiz.exe" [] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2005-12-10 07:57] "PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2006-05-20 03:13] "C-Media Mixer"="Mixer.exe" [2001-10-22 18:24 C:\WINDOWS\mixer.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 13:26] "HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 08:38] "HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe" [2004-03-04 07:46] "HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11] "Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-14 15:22] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-10 09:18] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20] "itype"="C:\Program Files\Microsoft IntelliType Pro\itype.exe" [2006-11-21 17:08] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-10-09 11:28] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-06-01 08:21] "STYLEXP"="C:\Program Files\TGTSoft\StyleXP\StyleXP.exe" [2006-05-24 11:31] C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\ Last.fm Helper.lnk - C:\Program Files\Last.fm\LastFMHelper.exe [2007-07-23 06:25:21] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\geedc] C:\WINDOWS\system32\geedc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqrsst] ssqrsst.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\avp] C:\WINDOWS\TEMP\win511E.tmp.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDrive] rundll32.exe C:\WINDOWS\system32\drvsuw.dll,startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EA Core] "C:\Program Files\Electronic Arts\EA Link\Core.exe" -silent [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magicantispy] C:\Program Files\Magicantispy\Magicantispy.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Run] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\smgr] mgrs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\ixqfpdmc.dll",forkonce [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Program Files\Winamp\winampa.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows update loader] C:\Windows\xpupdate.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "WMPNetworkSvc"=3 (0x3) "WLSetupSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "odserv"=3 (0x3) "NBService"=3 (0x3) "Microsoft Office Groove Audit Service"=3 (0x3) "iPod Service"=3 (0x3) R0 uagp35;Microsoft AGPv3.5 Filter;C:\WINDOWS\system32\DRIVERS\uagp35.sys R1 SCDEmu;SCDEmu;C:\WINDOWS\system32\drivers\SCDEmu.sys R1 StyleXPHelper;StyleXPHelper;\??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe R3 cmpci;C-Media PCI Audio Driver (WDM);C:\WINDOWS\system32\drivers\cmaudio.sys R3 pcouffin;VSO Software pcouffin;C:\WINDOWS\system32\Drivers\pcouffin.sys S3 PnkBstrK;PnkBstrK;\??\C:\WINDOWS\system32\drivers\PnkBstrK.sys S3 usbser;Motorola USB Modem Driver;C:\WINDOWS\system32\DRIVERS\usbser.sys S3 usbsermpt;Motorola USB Modem Driver for MPT;C:\WINDOWS\system32\DRIVERS\usbsermpt.sys S4 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service;"C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe" S4 odserv;Microsoft Office Diagnostics Service;"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE" Contents of the 'Scheduled Tasks' folder 2007-08-03 15:58:50 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job 2007-07-27 22:58:21 C:\WINDOWS\Tasks\Microsoft_Hardware_Launch_IType_exe.job - C:\Program Files\Microsoft IntelliType Pro\itype.exe 2007-08-08 11:21:07 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe ************************************************************************ catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-08-08 09:42:27 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... ************************************************************************ Completion time: 2007-08-08 9:45:26 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-08-08 09:44 --- E O F --- HijackThis: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 9:51:46 AM, on 8/8/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16473) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\DAEMON Tools\daemon.exe C:\Program Files\PowerISO\PWRISOVM.EXE C:\WINDOWS\Mixer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\QuickTime\QTTask.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Program Files\Microsoft IntelliType Pro\itype.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\Program Files\Opera\Opera.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {8D3DC90A-FE00-4C49-8ECF-DBD9C9F4AFC6} - C:\WINDOWS\system32\geedc.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {92E68C11-E017-43CD-82C0-48131B6FCA41} - C:\WINDOWS\system32\awvts.dll (file missing) O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll O3 - Toolbar: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [itype] "C:\Program Files\Microsoft IntelliType Pro\itype.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide O4 - Global Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O20 - Winlogon Notify: geedc - C:\WINDOWS\system32\geedc.dll (file missing) O20 - Winlogon Notify: ssqrsst - ssqrsst.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: ASP.NET State Service (aspnet_state) - Unknown owner - C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe (file missing) O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 7568 bytes Again thank you very much.