Tech Support Forum - View Single Post

crazy_pc_lady · 01-12-2008, 06:33 AM

I finally got a chance to get back at working on this machine. Below is the ComboFix.txt and new HJT log you asked for. One note - When running ComboFix is rebooted which I wasn't expecting so I had not turned off the autoload features of the antivirus and anti-spyware programs. The Combofix screen said "Preparing log report. Do not run any programs until ComboFix has finished." It was rebooting and loading the autoloads which I turned off as they came up, but it took a long time and I hope it didn't cause any problems. Here are the logs:

ComboFix 08-01-11.3 - Owner 2008-01-12 7:05:35.1 - NTFSx86
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\antivirus.exe
C:\Documents and Settings\Owner\Application Data\install.dat
C:\Documents and Settings\Owner\My Documents\MCROSO~1
C:\Program Files\eliteprotector
C:\Program Files\Hewlett-Packard\profsywuylel.html
C:\Program Files\HPSelect\profsywuylel.html
C:\Program Files\Microsoft Security Adviser
C:\Program Files\Microsoft Security Adviser\mssadv.exe
C:\Program Files\stem~1
C:\Program Files\stem~1\??stem\
C:\Temp\fCOe
C:\WINDOWS\IA
C:\WINDOWS\system32\cabine.dll
C:\WINDOWS\system32\drivers\sfopkbcu.dat
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\RunOnce.tmp

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CMDSERVICE
-------\LEGACY_FCI
-------\LEGACY_MICROSOFT_INET_SERVICE
-------\LEGACY_NETWORK_MONITOR
-------\LEGACY_NNEXAVDC
-------\LEGACY_PERFORMANCE_MONITOR
-------\nnexavdc
-------\Performance Monitor

((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 )))))))))))))))))))))))))))))))
.

2008-01-12 07:04 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-10 19:26 . 2008-01-10 19:26 <DIR> d-------- C:\Deckard
2008-01-09 22:20 . 2008-01-09 22:21 97,558,528 --a------ C:\1CA.tmp
2008-01-09 21:39 . 2007-10-10 17:55 6,065,664 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2008-01-09 21:39 . 2007-06-30 21:31 2,455,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dat
2008-01-09 21:39 . 2007-06-30 21:36 991,232 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll.mui
2008-01-09 21:39 . 2007-10-10 17:55 459,264 -----c--- C:\WINDOWS\SYSTEM32\dllcache\msfeeds.dll
2008-01-09 21:39 . 2007-10-10 17:55 383,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dll
2008-01-09 21:39 . 2007-10-10 17:55 267,776 -----c--- C:\WINDOWS\SYSTEM32\dllcache\iertutil.dll
2008-01-09 21:39 . 2007-10-10 17:55 63,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\icardie.dll
2008-01-09 21:39 . 2007-10-10 17:55 52,224 -----c--- C:\WINDOWS\SYSTEM32\dllcache\msfeedsbs.dll
2008-01-09 21:39 . 2007-10-10 04:59 13,824 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2008-01-09 21:02 . 2008-01-09 21:02 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner
2008-01-07 20:18 . 2008-01-09 21:57 <DIR> d-------- C:\Program Files\a-squared Anti-Malware
2008-01-06 21:51 . 2008-01-09 22:12 <DIR> d-------- C:\Program Files\Windows Defender
2008-01-06 20:48 . 2007-02-28 03:10 2,180,352 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntoskrnl.exe
2008-01-06 20:48 . 2007-02-28 03:08 2,136,064 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrnlmp.exe
2008-01-06 20:48 . 2007-02-28 02:38 2,057,600 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrnlpa.exe
2008-01-06 20:48 . 2007-02-28 02:38 2,015,744 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrpamp.exe
2008-01-06 20:35 . 2006-06-01 12:47 163,840 -----c--- C:\WINDOWS\SYSTEM32\dllcache\jgdw400.dll
2008-01-06 20:35 . 2006-06-01 12:47 27,648 -----c--- C:\WINDOWS\SYSTEM32\dllcache\jgpl400.dll
2008-01-06 20:23 . 2006-06-14 02:47 172,416 -----c--- C:\WINDOWS\SYSTEM32\dllcache\kmixer.sys
2008-01-06 20:23 . 2006-06-14 03:00 82,944 -----c--- C:\WINDOWS\SYSTEM32\dllcache\wdmaud.sys
2008-01-06 20:23 . 2006-06-14 02:47 6,400 -----c--- C:\WINDOWS\SYSTEM32\dllcache\splitter.sys
2008-01-06 20:04 . 2006-05-05 03:41 453,120 -----c--- C:\WINDOWS\SYSTEM32\dllcache\mrxsmb.sys
2008-01-06 19:14 . 2008-01-06 19:13 12,620 --a------ C:\WINDOWS\SYSTEM32\wpa.bak
2008-01-06 19:07 . 2001-08-07 18:28 577,536 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll
2008-01-06 18:57 . 2006-02-28 06:00 28,288 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\xjis.nls
2008-01-06 18:55 . 2006-02-28 06:00 482,304 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\pintlgnt.ime
2008-01-06 18:54 . 2006-02-28 06:00 1,875,968 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\msir3jp.lex
2008-01-06 18:53 . 2006-02-28 06:00 13,463,552 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\hwxjpn.dll
2008-01-06 18:52 . 2006-02-28 06:00 1,677,824 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\chsbrkr.dll
2008-01-06 18:51 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\fp4awel.dll
2008-01-06 18:48 . 2008-01-06 18:48 488 -rah----- C:\WINDOWS\SYSTEM32\logonui.exe.manifest
2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\wuaucpl.cpl.manifest
2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\sapi.cpl.manifest
2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\ncpa.cpl.manifest
2008-01-06 18:46 . 2006-02-28 06:00 16,384 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\isignup.exe
2008-01-06 18:35 . 2001-07-03 16:13 81,920 --a------ C:\WINDOWS\SYSTEM32\ps2.EXE
2008-01-06 18:34 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\drivers\RTL8139.sys
2008-01-06 18:24 . 2006-02-28 06:00 1,086,058 -ra------ C:\WINDOWS\SET9E.tmp
2008-01-06 18:24 . 2006-02-28 06:00 1,042,903 -ra------ C:\WINDOWS\SET9B.tmp
2008-01-06 17:38 . 2008-01-06 17:50 194 --a------ C:\WINDOWS\MyDrivers.ini
2008-01-06 17:34 . 2008-01-06 17:34 0 --a------ C:\smx.cat
2008-01-06 17:32 . 2008-01-06 17:32 0 --a------ C:\s3savNB.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv4.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv3.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv1.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv0.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wfp4.cat
2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wfp3.cat
2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp2.cat
2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp1.cat
2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp0.cat
2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\i81xnt5.cat
2008-01-06 17:26 . 2008-01-06 17:26 0 --a------ C:\mx70.cat
2008-01-06 17:26 . 2008-01-06 17:26 0 --a------ C:\H1710200.cat
2008-01-06 16:25 . 2008-01-06 17:34 190 --a------ C:\Setup.DIY
2008-01-06 16:19 . 2008-01-06 17:34 <DIR> d-------- C:\Program Files\My Drivers
2008-01-06 14:40 . 2008-01-10 19:08 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-12-30 21:44 . 2004-08-04 01:56 221,184 --a------ C:\WINDOWS\SYSTEM32\wmpns.dll
2007-12-30 21:40 . 2007-12-30 21:40 <DIR> d-------- C:\WINDOWS\provisioning
2007-12-30 21:40 . 2008-01-06 12:20 <DIR> d-------- C:\WINDOWS\peernet
2007-12-30 21:36 . 2007-12-30 21:36 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-12-30 21:28 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe
2007-12-30 21:22 . 2007-12-30 21:22 <DIR> d-------- C:\WINDOWS\EHome
2007-12-30 15:54 . 2007-12-30 15:52 102,664 --a------ C:\WINDOWS\SYSTEM32\drivers\tmcomm.sys
2007-12-30 15:51 . 2007-12-30 17:25 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2007-12-30 14:44 . 2007-12-30 14:47 <DIR> d-------- C:\Documents and Settings\Owner\.housecall6.6
2007-12-30 14:41 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2007-12-28 21:43 . 2008-01-06 17:53 446,749 --a------ C:\WINDOWS\setupapi.old
2007-12-28 20:50 . 2004-08-04 01:56 768,512 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\helpctr.exe
2007-12-28 20:50 . 2004-08-04 01:56 385,024 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\callcont.dll
2007-12-28 20:50 . 2004-08-04 01:56 274,432 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\mst120.dll
2007-12-28 20:50 . 2004-08-04 01:56 77,824 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\nmcom.dll
2007-12-28 20:40 . 2003-02-28 18:26 49,424 --a------ C:\WINDOWS\SYSTEM32\clspack.exe
2007-12-28 20:32 . 2004-08-04 01:56 239,104 --a------ C:\WINDOWS\SYSTEM32\srrstr.dll
2007-12-28 20:32 . 2004-08-04 01:56 239,104 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\srrstr.dll
2007-12-28 20:28 . 2007-12-28 20:28 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-28 20:26 . 2007-12-28 20:51 <DIR> d--h-c--- C:\WINDOWS\$xpsp1hfm$
2007-12-28 20:26 . 2004-01-09 23:11 26,112 --a------ C:\WINDOWS\SYSTEM32\xpsp1hfm.exe
2007-12-27 00:03 . 2007-12-27 00:03 <DIR> d-------- C:\WINDOWS\SYSTEM32\bits
2007-12-27 00:01 . 2004-08-04 01:56 18,944 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll
2007-12-27 00:01 . 2004-08-04 01:56 18,944 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\qmgrprxy.dll
2007-12-27 00:01 . 2004-08-04 01:56 8,192 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\bitsprx2.dll
2007-12-27 00:01 . 2004-08-04 01:56 8,192 --a------ C:\WINDOWS\SYSTEM32\bitsprx2.dll
2007-12-27 00:01 . 2004-08-04 01:56 7,168 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\bitsprx3.dll
2007-12-27 00:01 . 2004-08-04 01:56 7,168 --a------ C:\WINDOWS\SYSTEM32\bitsprx3.dll
2007-12-26 23:33 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll
2007-12-26 23:33 . 2007-07-30 19:19 549,720 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll
2007-12-26 23:33 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll
2007-12-26 23:33 . 2007-07-30 19:19 325,976 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll
2007-12-26 23:33 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\SYSTEM32\wuaucpl.cpl
2007-12-26 23:33 . 2007-07-30 19:19 216,408 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl
2007-12-26 23:33 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll
2007-12-26 23:33 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\SYSTEM32\wups.dll
2007-12-26 23:33 . 2007-07-30 19:18 33,624 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wups.dll
2007-12-26 23:31 . 2007-12-26 23:31 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData
2007-12-26 21:14 . 2007-12-26 21:14 <DIR> d-------- C:\Program Files\Trend Micro

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-12 13:09 --------- d-----w C:\Program Files\HPSelect
2008-01-12 13:09 --------- d-----w C:\Program Files\Hewlett-Packard
2008-01-10 02:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Netscape Internet Service
2008-01-10 02:34 --------- d-----w C:\Program Files\Microsoft Money
2007-12-30 20:41 --------- d-----w C:\Program Files\Java
2007-12-27 05:47 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-24 02:46 --------- d-----w C:\Program Files\QuickTime
2007-12-24 02:46 --------- d-----w C:\Program Files\My Movies
2007-12-05 22:28 --------- d-----w C:\Documents and Settings\Owner\Application Data\MSN6
2007-12-01 21:36 --------- d-----w C:\Program Files\UltimateBet
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 11:04 52736]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2001-08-07 19:25 143360]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 18:36 90112]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu]
--a------ 2001-10-02 21:23 94208 C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
--a------ 2003-06-25 11:24 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetscapeClient]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2004-11-15 10:53 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2003-11-10 13:55 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-07-12 02:12:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1073876945.job"
- C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1073876945
"2008-01-12 13:17:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-12 07:15:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-12 7:21:10 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-12 13:21:00
.
2008-01-11 01:25:50 --- E O F ---

Logfile of Trend Micro HijackThis v2.0.2Scan saved at 7:24:36 AM, on 1/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/sh...3/mcinsctl.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198733508546
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/sh...20/mcgdmgr.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 6261 bytes

THANKS AGAIN.

01-12-2008, 06:33 AM	#5 (permalink)
crazy_pc_lady Registered User Join Date: Jan 2008 Location: Mid-Missouri Posts: 5 OS: WinXP Home SP2	Re: Need pc cleanup help after some cleaning I finally got a chance to get back at working on this machine. Below is the ComboFix.txt and new HJT log you asked for. One note - When running ComboFix is rebooted which I wasn't expecting so I had not turned off the autoload features of the antivirus and anti-spyware programs. The Combofix screen said "Preparing log report. Do not run any programs until ComboFix has finished." It was rebooting and loading the autoloads which I turned off as they came up, but it took a long time and I hope it didn't cause any problems. Here are the logs: ComboFix 08-01-11.3 - Owner 2008-01-12 7:05:35.1 - NTFSx86 Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Administrator\Application Data\antivirus.exe C:\Documents and Settings\Owner\Application Data\install.dat C:\Documents and Settings\Owner\My Documents\MCROSO~1 C:\Program Files\eliteprotector C:\Program Files\Hewlett-Packard\profsywuylel.html C:\Program Files\HPSelect\profsywuylel.html C:\Program Files\Microsoft Security Adviser C:\Program Files\Microsoft Security Adviser\mssadv.exe C:\Program Files\stem~1 C:\Program Files\stem~1\??stem\ C:\Temp\fCOe C:\WINDOWS\IA C:\WINDOWS\system32\cabine.dll C:\WINDOWS\system32\drivers\sfopkbcu.dat C:\WINDOWS\system32\pac.txt C:\WINDOWS\system32\RunOnce.tmp . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_CMDSERVICE -------\LEGACY_FCI -------\LEGACY_MICROSOFT_INET_SERVICE -------\LEGACY_NETWORK_MONITOR -------\LEGACY_NNEXAVDC -------\LEGACY_PERFORMANCE_MONITOR -------\nnexavdc -------\Performance Monitor ((((((((((((((((((((((((( Files Created from 2007-12-12 to 2008-01-12 ))))))))))))))))))))))))))))))) . 2008-01-12 07:04 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe 2008-01-10 19:26 . 2008-01-10 19:26 <DIR> d-------- C:\Deckard 2008-01-09 22:20 . 2008-01-09 22:21 97,558,528 --a------ C:\1CA.tmp 2008-01-09 21:39 . 2007-10-10 17:55 6,065,664 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll 2008-01-09 21:39 . 2007-06-30 21:31 2,455,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dat 2008-01-09 21:39 . 2007-06-30 21:36 991,232 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll.mui 2008-01-09 21:39 . 2007-10-10 17:55 459,264 -----c--- C:\WINDOWS\SYSTEM32\dllcache\msfeeds.dll 2008-01-09 21:39 . 2007-10-10 17:55 383,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dll 2008-01-09 21:39 . 2007-10-10 17:55 267,776 -----c--- C:\WINDOWS\SYSTEM32\dllcache\iertutil.dll 2008-01-09 21:39 . 2007-10-10 17:55 63,488 -----c--- C:\WINDOWS\SYSTEM32\dllcache\icardie.dll 2008-01-09 21:39 . 2007-10-10 17:55 52,224 -----c--- C:\WINDOWS\SYSTEM32\dllcache\msfeedsbs.dll 2008-01-09 21:39 . 2007-10-10 04:59 13,824 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe 2008-01-09 21:02 . 2008-01-09 21:02 <DIR> d-------- C:\Program Files\Eusing Free Registry Cleaner 2008-01-07 20:18 . 2008-01-09 21:57 <DIR> d-------- C:\Program Files\a-squared Anti-Malware 2008-01-06 21:51 . 2008-01-09 22:12 <DIR> d-------- C:\Program Files\Windows Defender 2008-01-06 20:48 . 2007-02-28 03:10 2,180,352 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntoskrnl.exe 2008-01-06 20:48 . 2007-02-28 03:08 2,136,064 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrnlmp.exe 2008-01-06 20:48 . 2007-02-28 02:38 2,057,600 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrnlpa.exe 2008-01-06 20:48 . 2007-02-28 02:38 2,015,744 -----c--- C:\WINDOWS\SYSTEM32\dllcache\ntkrpamp.exe 2008-01-06 20:35 . 2006-06-01 12:47 163,840 -----c--- C:\WINDOWS\SYSTEM32\dllcache\jgdw400.dll 2008-01-06 20:35 . 2006-06-01 12:47 27,648 -----c--- C:\WINDOWS\SYSTEM32\dllcache\jgpl400.dll 2008-01-06 20:23 . 2006-06-14 02:47 172,416 -----c--- C:\WINDOWS\SYSTEM32\dllcache\kmixer.sys 2008-01-06 20:23 . 2006-06-14 03:00 82,944 -----c--- C:\WINDOWS\SYSTEM32\dllcache\wdmaud.sys 2008-01-06 20:23 . 2006-06-14 02:47 6,400 -----c--- C:\WINDOWS\SYSTEM32\dllcache\splitter.sys 2008-01-06 20:04 . 2006-05-05 03:41 453,120 -----c--- C:\WINDOWS\SYSTEM32\dllcache\mrxsmb.sys 2008-01-06 19:14 . 2008-01-06 19:13 12,620 --a------ C:\WINDOWS\SYSTEM32\wpa.bak 2008-01-06 19:07 . 2001-08-07 18:28 577,536 --a------ C:\WINDOWS\SYSTEM32\igfxres.dll 2008-01-06 18:57 . 2006-02-28 06:00 28,288 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\xjis.nls 2008-01-06 18:55 . 2006-02-28 06:00 482,304 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\pintlgnt.ime 2008-01-06 18:54 . 2006-02-28 06:00 1,875,968 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\msir3jp.lex 2008-01-06 18:53 . 2006-02-28 06:00 13,463,552 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\hwxjpn.dll 2008-01-06 18:52 . 2006-02-28 06:00 1,677,824 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\chsbrkr.dll 2008-01-06 18:51 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\fp4awel.dll 2008-01-06 18:48 . 2008-01-06 18:48 488 -rah----- C:\WINDOWS\SYSTEM32\logonui.exe.manifest 2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\WindowsShell.Manifest 2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\wuaucpl.cpl.manifest 2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\sapi.cpl.manifest 2008-01-06 18:47 . 2008-01-06 18:47 749 -rah----- C:\WINDOWS\SYSTEM32\ncpa.cpl.manifest 2008-01-06 18:46 . 2006-02-28 06:00 16,384 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\isignup.exe 2008-01-06 18:35 . 2001-07-03 16:13 81,920 --a------ C:\WINDOWS\SYSTEM32\ps2.EXE 2008-01-06 18:34 . 2004-08-03 22:31 20,992 --a------ C:\WINDOWS\SYSTEM32\drivers\RTL8139.sys 2008-01-06 18:24 . 2006-02-28 06:00 1,086,058 -ra------ C:\WINDOWS\SET9E.tmp 2008-01-06 18:24 . 2006-02-28 06:00 1,042,903 -ra------ C:\WINDOWS\SET9B.tmp 2008-01-06 17:38 . 2008-01-06 17:50 194 --a------ C:\WINDOWS\MyDrivers.ini 2008-01-06 17:34 . 2008-01-06 17:34 0 --a------ C:\smx.cat 2008-01-06 17:32 . 2008-01-06 17:32 0 --a------ C:\s3savNB.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv4.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv3.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv1.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wtv0.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wfp4.cat 2008-01-06 17:30 . 2008-01-06 17:30 0 --a------ C:\wfp3.cat 2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp2.cat 2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp1.cat 2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\wfp0.cat 2008-01-06 17:29 . 2008-01-06 17:29 0 --a------ C:\i81xnt5.cat 2008-01-06 17:26 . 2008-01-06 17:26 0 --a------ C:\mx70.cat 2008-01-06 17:26 . 2008-01-06 17:26 0 --a------ C:\H1710200.cat 2008-01-06 16:25 . 2008-01-06 17:34 190 --a------ C:\Setup.DIY 2008-01-06 16:19 . 2008-01-06 17:34 <DIR> d-------- C:\Program Files\My Drivers 2008-01-06 14:40 . 2008-01-10 19:08 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-12-30 21:44 . 2004-08-04 01:56 221,184 --a------ C:\WINDOWS\SYSTEM32\wmpns.dll 2007-12-30 21:40 . 2007-12-30 21:40 <DIR> d-------- C:\WINDOWS\provisioning 2007-12-30 21:40 . 2008-01-06 12:20 <DIR> d-------- C:\WINDOWS\peernet 2007-12-30 21:36 . 2007-12-30 21:36 <DIR> d-------- C:\WINDOWS\ServicePackFiles 2007-12-30 21:28 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\SYSTEM32\spupdsvc.exe 2007-12-30 21:22 . 2007-12-30 21:22 <DIR> d-------- C:\WINDOWS\EHome 2007-12-30 15:54 . 2007-12-30 15:52 102,664 --a------ C:\WINDOWS\SYSTEM32\drivers\tmcomm.sys 2007-12-30 15:51 . 2007-12-30 17:25 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6 2007-12-30 14:44 . 2007-12-30 14:47 <DIR> d-------- C:\Documents and Settings\Owner\.housecall6.6 2007-12-30 14:41 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl 2007-12-28 21:43 . 2008-01-06 17:53 446,749 --a------ C:\WINDOWS\setupapi.old 2007-12-28 20:50 . 2004-08-04 01:56 768,512 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\helpctr.exe 2007-12-28 20:50 . 2004-08-04 01:56 385,024 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\callcont.dll 2007-12-28 20:50 . 2004-08-04 01:56 274,432 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\mst120.dll 2007-12-28 20:50 . 2004-08-04 01:56 77,824 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\nmcom.dll 2007-12-28 20:40 . 2003-02-28 18:26 49,424 --a------ C:\WINDOWS\SYSTEM32\clspack.exe 2007-12-28 20:32 . 2004-08-04 01:56 239,104 --a------ C:\WINDOWS\SYSTEM32\srrstr.dll 2007-12-28 20:32 . 2004-08-04 01:56 239,104 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\srrstr.dll 2007-12-28 20:28 . 2007-12-28 20:28 <DIR> d-------- C:\Program Files\MSXML 4.0 2007-12-28 20:26 . 2007-12-28 20:51 <DIR> d--h-c--- C:\WINDOWS\$xpsp1hfm$ 2007-12-28 20:26 . 2004-01-09 23:11 26,112 --a------ C:\WINDOWS\SYSTEM32\xpsp1hfm.exe 2007-12-27 00:03 . 2007-12-27 00:03 <DIR> d-------- C:\WINDOWS\SYSTEM32\bits 2007-12-27 00:01 . 2004-08-04 01:56 18,944 --a------ C:\WINDOWS\SYSTEM32\qmgrprxy.dll 2007-12-27 00:01 . 2004-08-04 01:56 18,944 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\qmgrprxy.dll 2007-12-27 00:01 . 2004-08-04 01:56 8,192 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\bitsprx2.dll 2007-12-27 00:01 . 2004-08-04 01:56 8,192 --a------ C:\WINDOWS\SYSTEM32\bitsprx2.dll 2007-12-27 00:01 . 2004-08-04 01:56 7,168 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\bitsprx3.dll 2007-12-27 00:01 . 2004-08-04 01:56 7,168 --a------ C:\WINDOWS\SYSTEM32\bitsprx3.dll 2007-12-26 23:33 . 2007-07-30 19:19 549,720 --a------ C:\WINDOWS\SYSTEM32\wuapi.dll 2007-12-26 23:33 . 2007-07-30 19:19 549,720 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wuapi.dll 2007-12-26 23:33 . 2007-07-30 19:19 325,976 --a------ C:\WINDOWS\SYSTEM32\wucltui.dll 2007-12-26 23:33 . 2007-07-30 19:19 325,976 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wucltui.dll 2007-12-26 23:33 . 2007-07-30 19:19 216,408 --a------ C:\WINDOWS\SYSTEM32\wuaucpl.cpl 2007-12-26 23:33 . 2007-07-30 19:19 216,408 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wuaucpl.cpl 2007-12-26 23:33 . 2007-07-30 19:19 43,352 --a------ C:\WINDOWS\SYSTEM32\wups2.dll 2007-12-26 23:33 . 2007-07-30 19:18 33,624 --a------ C:\WINDOWS\SYSTEM32\wups.dll 2007-12-26 23:33 . 2007-07-30 19:18 33,624 --a--c--- C:\WINDOWS\SYSTEM32\dllcache\wups.dll 2007-12-26 23:31 . 2007-12-26 23:31 <DIR> d---s---- C:\Documents and Settings\Administrator\UserData 2007-12-26 21:14 . 2007-12-26 21:14 <DIR> d-------- C:\Program Files\Trend Micro . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-12 13:09 --------- d-----w C:\Program Files\HPSelect 2008-01-12 13:09 --------- d-----w C:\Program Files\Hewlett-Packard 2008-01-10 02:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\Netscape Internet Service 2008-01-10 02:34 --------- d-----w C:\Program Files\Microsoft Money 2007-12-30 20:41 --------- d-----w C:\Program Files\Java 2007-12-27 05:47 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-12-24 02:46 --------- d-----w C:\Program Files\QuickTime 2007-12-24 02:46 --------- d-----w C:\Program Files\My Movies 2007-12-05 22:28 --------- d-----w C:\Documents and Settings\Owner\Application Data\MSN6 2007-12-01 21:36 --------- d-----w C:\Program Files\UltimateBet 2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys 2006-11-25 07:57 482 ----a-w C:\Program Files\Del.js . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 10:24 1694208] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 06:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 11:04 52736] "IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2001-08-07 19:25 143360] "HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2001-08-07 18:36 90112] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496] "avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224] "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312] "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 16:38 39264] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"= 0 (0x0) [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, append.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DDCActiveMenu] --a------ 2001-10-02 21:23 94208 C:\Program Files\WildTangent\DDC\ActiveMenu\DDCActiveMenu.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] --a------ 2003-06-25 11:24 49152 C:\Program Files\HP\HP Software Update\HPWuSchd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetscapeClient] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2004-11-15 10:53 98304 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] --a------ 2003-11-10 13:55 26112 C:\Program Files\Real\RealPlayer\RealPlay.exe . Contents of the 'Scheduled Tasks' folder "2007-07-12 02:12:00 C:\WINDOWS\Tasks\HP DArC Task #Hewlett-Packard#hp psc 1300 series#1073876945.job" - C:\Program Files\HP\hpcoretech\comp\hpdarc.exe0/#Hewlett-Packard#hp psc 1300 series#1073876945 "2008-01-12 13:17:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job" - C:\Program Files\Windows Defender\MpCmdRun.exe . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-12 07:15:30 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . Completion time: 2008-01-12 7:21:10 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-12 13:21:00 . 2008-01-11 01:25:50 --- E O F --- Logfile of Trend Micro HijackThis v2.0.2**Scan saved at 7:24:36 AM, on 1/12/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16574) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hkcmd.exe C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Alwil Software\Avast4\setup\avast.setup R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://srch-us4.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user') O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user') O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.av.aol.com/molbin/sh...3/mcinsctl.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1198733508546 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.av.aol.com/molbin/sh...20/mcgdmgr.cab O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe -- End of file - 6261 bytes THANKS AGAIN.