Tech Support Forum - View Single Post

rces · 05-17-2008, 07:41 PM

I'v done what you said

This is the latest log from ComboFix:
ComboFix 08-05-15.3 - user 2008-05-18 10:27:02.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.244 [GMT 8:00]
Running from: C:\Documents and Settings\user\My Documents\walkthroughs\security\ComboFix.exe
Command switches used :: C:\Documents and Settings\user\My Documents\walkthroughs\security\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CMDSERVICE
-------\Legacy_NETWORK_MONITOR

((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 )))))))))))))))))))))))))))))))
.

2008-05-18 10:05 . 2008-05-18 10:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-18 10:05 . 2008-05-18 10:05 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-17 14:28 . 2008-05-17 14:28 <DIR> d-------- C:\_OTMoveIt
2008-05-16 10:19 . 2008-05-16 10:19 <DIR> d-------- C:\Program Files\PictureDesk
2008-05-16 10:19 . 2007-10-11 15:08 372,736 --a------ C:\WINDOWS\system32\dcrawlib.dll
2008-05-16 07:33 . 2008-05-16 07:33 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-05-16 07:30 . 2008-05-16 07:30 0 --a------ C:\end
2008-05-16 07:15 . 2008-05-16 07:15 <DIR> d-------- C:\Program Files\e-Games
2008-05-14 22:46 . 2008-05-14 22:46 <DIR> d-------- C:\cabal
2008-05-03 06:04 . 2008-05-03 06:04 <DIR> d-------- C:\Documents and Settings\user\Application Data\Media Player Classic
2008-05-01 19:46 . 2008-05-01 19:46 <DIR> d-------- C:\Program Files\WexTech
2008-05-01 19:46 . 2008-05-01 19:46 <DIR> d-------- C:\Program Files\Common Files\LHSPF
2008-05-01 19:46 . 2000-05-02 10:03 225,280 --a------ C:\WINDOWS\system32\awrtl30.dll
2008-05-01 19:46 . 1998-08-04 11:22 111,616 --------- C:\WINDOWS\system32\Ltih30tb.dll
2008-05-01 19:45 . 2000-10-20 13:25 487,184 --a------ C:\WINDOWS\system32\Mrt7enu.dll
2008-05-01 19:45 . 2000-10-20 13:25 446,464 --a------ C:\WINDOWS\system32\hhactivex.dll
2008-05-01 19:45 . 2000-10-20 13:25 79,360 --a------ C:\WINDOWS\system32\acdbres.dll
2008-05-01 19:44 . 2008-05-01 19:44 <DIR> d-------- C:\Program Files\Volo View Express
2008-05-01 19:42 . 2008-05-01 19:42 <DIR> d-------- C:\Program Files\Common Files\Wextech Shared
2008-05-01 19:41 . 2008-05-01 19:41 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared
2008-05-01 19:41 . 2008-05-01 19:41 <DIR> d-------- C:\Program Files\AutoCAD 2002

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-12 23:42 --------- d-----w C:\Program Files\Avira
2008-04-07 22:17 --------- d-----w C:\Program Files\Camtech
2008-04-07 11:27 --------- d-----w C:\Documents and Settings\user\Application Data\Teleca
2008-04-07 11:26 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Ericsson
2008-04-07 11:25 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2008-04-07 11:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Teleca
2008-04-07 11:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson
2008-04-06 12:12 --------- d-----w C:\Program Files\Dream
2008-04-03 22:57 --------- d-----w C:\Program Files\Total Video Converter
2008-03-31 07:34 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
2008-03-28 22:52 --------- d-----w C:\Program Files\FLV Player
2008-03-28 09:31 --------- d-----w C:\Program Files\YahELite
2008-03-20 20:37 --------- d-----w C:\Program Files\Garena
2008-03-20 10:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Arovax
2008-03-20 03:52 --------- d-----w C:\Program Files\CABAL Online (SG MY)
2008-03-04 00:55 65,536 ----a-w C:\WINDOWS\IFinst27.exe
2008-03-02 20:39 5,632 --sha-w C:\Program Files\Thumbs.db
2008-03-02 08:49 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-07-19 02:18 5,118,288 ----a-w C:\Documents and Settings\user\Firefox Setup 1.5.0.4.exe
2007-07-09 21:18 6,511,392 ----a-w C:\Documents and Settings\user\dap85.exe
2007-07-09 20:44 1,744,296 ----a-w C:\Documents and Settings\user\amust_registry_cleaner_3.5.exe
2006-09-23 16:30 124,256 ----a-w C:\Documents and Settings\user\Poringpink.zip
2006-09-20 14:33 443,432 ----a-w C:\Documents and Settings\user\msgr8us.exe
2006-08-11 16:07 186 ----a-w C:\Documents and Settings\user\n.bat
2006-06-05 00:58 1,663 ----a-w C:\WINDOWS\inf\COMCC.tmp
2006-05-15 11:11 1,663 ----a-w C:\WINDOWS\inf\COMC5.tmp
2006-04-29 02:43 1,663 ----a-w C:\WINDOWS\inf\COMBB.tmp
2006-04-20 04:56 1,663 ----a-w C:\WINDOWS\inf\COMB9.tmp
2006-01-08 22:18 273,115 ----a-w C:\Documents and Settings\user\VBUSoftButtonSetup.EXE
2005-11-28 04:03 720,128 ----a-w C:\Program Files\nero_photoshow_elite_trial_intl_us.exe
2005-11-03 08:23 0 ----a-w C:\Documents and Settings\user\CONFIG.SYS
2005-11-03 08:23 0 ----a-w C:\Documents and Settings\user\AUTOEXEC.BAT
2004-07-22 02:51 3,432,656 ----a-w C:\Program Files\ManagedDX.CAB
2004-07-19 14:58 1,156,363 ----a-w C:\Program Files\BDANT.cab
2004-07-19 14:53 976,020 ----a-w C:\Program Files\BDAXP.cab
2004-07-09 06:17 13,265,040 ----a-w C:\Program Files\dxnt.cab
2004-07-09 01:13 703,080 ----a-w C:\Program Files\BDA.cab
2004-07-09 01:13 15,493,481 ----a-w C:\Program Files\DirectX.cab
2004-07-08 20:08 472,576 ----a-w C:\Program Files\dxsetup.exe
2004-07-08 20:08 2,242,560 ----a-w C:\Program Files\dsetup32.dll
2004-07-08 19:03 62,976 ----a-w C:\Program Files\DSETUP.dll
2005-12-26 11:40 7 --sha-w C:\WINDOWS\hstmgsii.sys
2005-12-26 12:07 7 --sha-w C:\WINDOWS\hstmgsiv.sys
.

((((((((((((((((((((((((((((( snapshot@2008-05-17_14.49.54.34 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-17 06:46:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-18 02:32:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 07:51 262401]
"combofix"="C:\WINDOWS\system32\CF1522.exe" [2008-05-18 10:26 388608]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 12:00 53760 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\st3]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm
"msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm
"msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk]
backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk]
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Metacafe.lnk]
backup=C:\WINDOWS\pss\Metacafe.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk]
backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Pacific Speed Booster.lnk]
backup=C:\WINDOWS\pss\Pacific Speed Booster.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^SpeedUpMyPC.lnk]
backup=C:\WINDOWS\pss\SpeedUpMyPC.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^taskmgr.exe]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ulead Photo Express Calendar Checker For My Custom Edition.lnk]
backup=C:\WINDOWS\pss\Ulead Photo Express Calendar Checker For My Custom Edition.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Watch.lnk]
backup=C:\WINDOWS\pss\Watch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Dreamweaver Interface Improver.lnk]
backup=C:\WINDOWS\pss\Dreamweaver Interface Improver.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^GreatMemo.lnk]
backup=C:\WINDOWS\pss\GreatMemo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^StartUp^Metacafe.lnk]
backup=C:\WINDOWS\pss\Metacafe.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk]
backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^PowerReg Scheduler.exe]
backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChikkaDefault]
--a------ 2006-11-08 17:40 36864 C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 12:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
--a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C45 Series]
--a------ 2004-01-14 02:00 99840 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flash32]
c:\Program Files\Flash 32\Flash32.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a------ 2004-08-04 20:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
--------- 2005-05-13 23:11 1397760 C:\Program Files\Ahead\InCD\InCD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
--a------ 2004-08-04 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NCLaunch]
--ah----- 2005-11-27 09:08 40960 C:\WINDOWS\NCLAUNCH.EXe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
-ra------ 2004-07-12 00:50 4112384 C:\WINDOWS\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
-ra------ 2004-07-12 00:50 81920 C:\WINDOWS\system32\NvMcTray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2004-07-12 00:50 843776 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
--a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
--a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager]
--a------ 2005-02-26 08:28 212992 C:\PROGRA~1\Ahead\NEROPH~2\data\xtras\mssysmgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2008-01-20 15:05 217088 C:\Program Files\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-05 17:17 282624 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
-ra------ 2007-05-28 10:14 528384 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
-rah----- 2005-06-20 05:42 77824 C:\WINDOWS\SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2005-04-13 03:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TClock.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload]
--a------ 2007-03-03 14:12 341488 C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlog]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\Warcraft III\\War3.exe"=
"C:\\Program Files\\Call of Duty\\CoDMP.exe"=
"C:\\Program Files\\Microsoft Games\\Rise of Nations\\rise.Exe"=
"C:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"=
"C:\\WINDOWS\\System32\\AUTMGR32.EXE"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Grouper\\Grouper.exe"=
"C:\\Program Files\\FusionProject\\Fusion.EXE"=
"C:\\Program Files\\RagnarokOffline3\\FusionProject\\Fusion.EXE"=
"C:\\Program Files\\Java\\jre1.5.0_03\\bin\\javaw.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\NtreevSoft\\PangYa\\update.exe"=
"C:\\Program Files\\NtreevSoft\\PangYa\\ProjectG.exe"=
"C:\\Program Files\\Chinesegamer\\TSOnline\\UPDATE.EXE"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Hexacto Games\\Lemonade Tycoon\\Lemonade.exe"=
"C:\\Program Files\\Lemonade Tycoon 2\\Lemonade2.exe"=
"C:\\Program Files\\EA SPORTS\\NASCAR Thunder TM 2004\\NASCAR_Thunder_2004.exe"=
"C:\\Program Files\\Shareaza\\Shareaza.exe"=
"C:\\Program Files\\empire earth\\Empire Earth.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\DAP\\DAP.exe"=
"C:\\Program Files\\Gravity\\RO\\magclient.exe"=
"C:\\Program Files\\Gravity\\RO\\maggotzRO.exe"=
"C:\\Program Files\\EA SPORTS\\NBA LIVE 06\\nbalive06.exe"=
"C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"C:\\Program Files\\ValveSoftware\\Half-life2\\hl2.exe"=
"C:\\Program Files\\Valve\\Counter-Strike Source\\hl2.exe"=
"C:\\Program Files\\Valve\\Counter-Strike Source\\srcds.exe"=
"C:\\Valve\\Steam\\SteamApps\\Drogon\\Half-Life2\\hl2.exe"=
"C:\\Program Files\\ZakFromAnotherPlanet\\Yazak Chat\\yazak.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\YahELite\\YahVox.exe"=
"C:\\Program Files\\Zone.com Deluxe Games\\Wheel of Fortune Deluxe\\Wheel of Fortune Deluxe.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Garena\\Garena.exe"=
"C:\\Program Files\\YahELite\\YahELite.exe"=
"C:\\Program Files\\Dream\\Yahaven!\\Yahaven!.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 Z302Mic;Vimicro Z302 Mic Audio Filter Driver;C:\WINDOWS\system32\drivers\UsbMicfilt.sys [2002-05-14 19:05]
S2 jsm-default;JRun Service Manager;C:\Program Files\Macromedia\Generator 2\bin\jsm.exe "jsm-default" "C:\Program Files\Macromedia\Generator 2\jsm-default" []
S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12]
S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12]
S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12]
S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12]
S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12]
S3 npkycryp;npkycryp;C:\Program Files\Gravity\RO\npkycryp.sys []
S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\H10USB.sys [2004-06-24 12:52]
S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 12:43]
S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-04-04 12:43]
S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-04-04 12:43]
S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43]
S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43]
S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 12:43]
S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43]
S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2004-12-18 20:32]
S3 tap0801;Smarthide TAP driver;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2007-10-12 21:07]
S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01]
S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys []
S3 XDva104;XDva104;C:\WINDOWS\system32\XDva104.sys []
S3 XDva121;XDva121;C:\WINDOWS\system32\XDva121.sys []
S3 XDva132;XDva132;C:\WINDOWS\system32\XDva132.sys []
S3 ZSMC302;PC CAM 300A;C:\WINDOWS\system32\Drivers\usbvm302.sys [2002-11-02 01:43]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-08 17:00:02 C:\WINDOWS\Tasks\user backup.job"
- C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe
"2008-02-08 17:20:02 C:\WINDOWS\Tasks\user scan and fix.job"
- C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe
"2007-08-10 22:38:24 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-03-08 09:24:02 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2008-03-14 01:00:02 C:\WINDOWS\Tasks\At1.job"
- C:\WINDOWS\system32\blastclnnn.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-18 10:33:18
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE
C:\PROGRAM FILES\COMMON FILES\INTERVIDEO\DEVICESERVICE\DEVSVC.EXE
C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE
C:\WINDOWS\SYSTEM32\WSCNTFY.EXE
.
**************************************************************************
.
Completion time: 2008-05-18 10:36:49 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-18 02:36:48
ComboFix2.txt 2008-05-17 06:50:18

Pre-Run: 7,671,349,248 bytes free
Post-Run: 7,109,312,512 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

316 --- E O F --- 2008-02-28 05:08:27

This is the log from Hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:05 AM, on 5/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\user\My Documents\hijackthis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1150152044214
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocx
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file:///C:/Program%20Files/AutoCAD%202002/InstFred.ocx
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx
O20 - Winlogon Notify: st3 - C:\WINDOWS\
O22 - SharedTaskScheduler: st3 - {1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5} - (no file)
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: InCD Helper (read only) (InCDsrvR) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing)
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: JRun Service Manager (jsm-default) - Unknown owner - C:\Program Files\Macromedia\Generator 2\bin\jsm.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - (no file)
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 6265 bytes

Thanks

05-17-2008, 07:41 PM	#5 (permalink)
rces Registered User Join Date: May 2008 Posts: 7 OS: xp	Re: please analyze my hijackthis log I'v done what you said This is the latest log from ComboFix: ComboFix 08-05-15.3 - user 2008-05-18 10:27:02.2 - FAT32x86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.244 [GMT 8:00] Running from: C:\Documents and Settings\user\My Documents\walkthroughs\security\ComboFix.exe Command switches used :: C:\Documents and Settings\user\My Documents\walkthroughs\security\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_CMDSERVICE -------\Legacy_NETWORK_MONITOR ((((((((((((((((((((((((( Files Created from 2008-04-18 to 2008-05-18 ))))))))))))))))))))))))))))))) . 2008-05-18 10:05 . 2008-05-18 10:05 54,156 --ah----- C:\WINDOWS\QTFont.qfn 2008-05-18 10:05 . 2008-05-18 10:05 1,409 --a------ C:\WINDOWS\QTFont.for 2008-05-17 14:28 . 2008-05-17 14:28 <DIR> d-------- C:\_OTMoveIt 2008-05-16 10:19 . 2008-05-16 10:19 <DIR> d-------- C:\Program Files\PictureDesk 2008-05-16 10:19 . 2007-10-11 15:08 372,736 --a------ C:\WINDOWS\system32\dcrawlib.dll 2008-05-16 07:33 . 2008-05-16 07:33 <DIR> d-------- C:\Program Files\Common Files\INCA Shared 2008-05-16 07:30 . 2008-05-16 07:30 0 --a------ C:\end 2008-05-16 07:15 . 2008-05-16 07:15 <DIR> d-------- C:\Program Files\e-Games 2008-05-14 22:46 . 2008-05-14 22:46 <DIR> d-------- C:\cabal 2008-05-03 06:04 . 2008-05-03 06:04 <DIR> d-------- C:\Documents and Settings\user\Application Data\Media Player Classic 2008-05-01 19:46 . 2008-05-01 19:46 <DIR> d-------- C:\Program Files\WexTech 2008-05-01 19:46 . 2008-05-01 19:46 <DIR> d-------- C:\Program Files\Common Files\LHSPF 2008-05-01 19:46 . 2000-05-02 10:03 225,280 --a------ C:\WINDOWS\system32\awrtl30.dll 2008-05-01 19:46 . 1998-08-04 11:22 111,616 --------- C:\WINDOWS\system32\Ltih30tb.dll 2008-05-01 19:45 . 2000-10-20 13:25 487,184 --a------ C:\WINDOWS\system32\Mrt7enu.dll 2008-05-01 19:45 . 2000-10-20 13:25 446,464 --a------ C:\WINDOWS\system32\hhactivex.dll 2008-05-01 19:45 . 2000-10-20 13:25 79,360 --a------ C:\WINDOWS\system32\acdbres.dll 2008-05-01 19:44 . 2008-05-01 19:44 <DIR> d-------- C:\Program Files\Volo View Express 2008-05-01 19:42 . 2008-05-01 19:42 <DIR> d-------- C:\Program Files\Common Files\Wextech Shared 2008-05-01 19:41 . 2008-05-01 19:41 <DIR> d-------- C:\Program Files\Common Files\Autodesk Shared 2008-05-01 19:41 . 2008-05-01 19:41 <DIR> d-------- C:\Program Files\AutoCAD 2002 . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-04-12 23:42 --------- d-----w C:\Program Files\Avira 2008-04-07 22:17 --------- d-----w C:\Program Files\Camtech 2008-04-07 11:27 --------- d-----w C:\Documents and Settings\user\Application Data\Teleca 2008-04-07 11:26 --------- d-----w C:\Documents and Settings\user\Application Data\Sony Ericsson 2008-04-07 11:25 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared 2008-04-07 11:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Teleca 2008-04-07 11:24 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Ericsson 2008-04-06 12:12 --------- d-----w C:\Program Files\Dream 2008-04-03 22:57 --------- d-----w C:\Program Files\Total Video Converter 2008-03-31 07:34 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo 2008-03-28 22:52 --------- d-----w C:\Program Files\FLV Player 2008-03-28 09:31 --------- d-----w C:\Program Files\YahELite 2008-03-20 20:37 --------- d-----w C:\Program Files\Garena 2008-03-20 10:56 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Arovax 2008-03-20 03:52 --------- d-----w C:\Program Files\CABAL Online (SG MY) 2008-03-04 00:55 65,536 ----a-w C:\WINDOWS\IFinst27.exe 2008-03-02 20:39 5,632 --sha-w C:\Program Files\Thumbs.db 2008-03-02 08:49 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-02-21 02:05 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll 2008-02-21 02:05 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll 2007-07-19 02:18 5,118,288 ----a-w C:\Documents and Settings\user\Firefox Setup 1.5.0.4.exe 2007-07-09 21:18 6,511,392 ----a-w C:\Documents and Settings\user\dap85.exe 2007-07-09 20:44 1,744,296 ----a-w C:\Documents and Settings\user\amust_registry_cleaner_3.5.exe 2006-09-23 16:30 124,256 ----a-w C:\Documents and Settings\user\Poringpink.zip 2006-09-20 14:33 443,432 ----a-w C:\Documents and Settings\user\msgr8us.exe 2006-08-11 16:07 186 ----a-w C:\Documents and Settings\user\n.bat 2006-06-05 00:58 1,663 ----a-w C:\WINDOWS\inf\COMCC.tmp 2006-05-15 11:11 1,663 ----a-w C:\WINDOWS\inf\COMC5.tmp 2006-04-29 02:43 1,663 ----a-w C:\WINDOWS\inf\COMBB.tmp 2006-04-20 04:56 1,663 ----a-w C:\WINDOWS\inf\COMB9.tmp 2006-01-08 22:18 273,115 ----a-w C:\Documents and Settings\user\VBUSoftButtonSetup.EXE 2005-11-28 04:03 720,128 ----a-w C:\Program Files\nero_photoshow_elite_trial_intl_us.exe 2005-11-03 08:23 0 ----a-w C:\Documents and Settings\user\CONFIG.SYS 2005-11-03 08:23 0 ----a-w C:\Documents and Settings\user\AUTOEXEC.BAT 2004-07-22 02:51 3,432,656 ----a-w C:\Program Files\ManagedDX.CAB 2004-07-19 14:58 1,156,363 ----a-w C:\Program Files\BDANT.cab 2004-07-19 14:53 976,020 ----a-w C:\Program Files\BDAXP.cab 2004-07-09 06:17 13,265,040 ----a-w C:\Program Files\dxnt.cab 2004-07-09 01:13 703,080 ----a-w C:\Program Files\BDA.cab 2004-07-09 01:13 15,493,481 ----a-w C:\Program Files\DirectX.cab 2004-07-08 20:08 472,576 ----a-w C:\Program Files\dxsetup.exe 2004-07-08 20:08 2,242,560 ----a-w C:\Program Files\dsetup32.dll 2004-07-08 19:03 62,976 ----a-w C:\Program Files\DSETUP.dll 2005-12-26 11:40 7 --sha-w C:\WINDOWS\hstmgsii.sys 2005-12-26 12:07 7 --sha-w C:\WINDOWS\hstmgsiv.sys . ((((((((((((((((((((((((((((( snapshot@2008-05-17_14.49.54.34 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-17 06:46:00 2,048 --s-a-w C:\WINDOWS\bootstat.dat + 2008-05-18 02:32:30 2,048 --s-a-w C:\WINDOWS\bootstat.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-04-15 07:51 262401] "combofix"="C:\WINDOWS\system32\CF1522.exe" [2008-05-18 10:26 388608] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 12:00 53760 C:\WINDOWS\system32\narrator.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\st3] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\Vio\Dvacm.acm "msacm.MPEGacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\MPEGacm.acm "msacm.ulmp3acm"= C:\PROGRA~1\COMMON~1\ULEADS~1\MPEG\ulmp3acm.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^AutoCAD Startup Accelerator.lnk] backup=C:\WINDOWS\pss\AutoCAD Startup Accelerator.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Google Updater.lnk] backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Metacafe.lnk] backup=C:\WINDOWS\pss\Metacafe.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Microsoft Office OneNote 2003 Quick Launch.lnk] backup=C:\WINDOWS\pss\Microsoft Office OneNote 2003 Quick Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Pacific Speed Booster.lnk] backup=C:\WINDOWS\pss\Pacific Speed Booster.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^SpeedUpMyPC.lnk] backup=C:\WINDOWS\pss\SpeedUpMyPC.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^taskmgr.exe] [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Ulead Photo Express Calendar Checker For My Custom Edition.lnk] backup=C:\WINDOWS\pss\Ulead Photo Express Calendar Checker For My Custom Edition.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Start Menu^Programs^Startup^Watch.lnk] backup=C:\WINDOWS\pss\Watch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^Dreamweaver Interface Improver.lnk] backup=C:\WINDOWS\pss\Dreamweaver Interface Improver.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^GreatMemo.lnk] backup=C:\WINDOWS\pss\GreatMemo.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^StartUp^Metacafe.lnk] backup=C:\WINDOWS\pss\Metacafe.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^MyWebSearch Email Plugin.lnk] backup=C:\WINDOWS\pss\MyWebSearch Email Plugin.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^user^Start Menu^Programs^Startup^PowerReg Scheduler.exe] backup=C:\WINDOWS\pss\PowerReg Scheduler.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ChikkaDefault] --a------ 2006-11-08 17:40 36864 C:\PROGRA~1\CHIKKA~1\CHIKKA~1.4\ChikkaLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] --a------ 2004-08-04 12:00 15360 C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033] --a------ 2004-08-22 17:05 81920 C:\Program Files\D-Tools\daemon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DNS] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EPSON Stylus C45 Series] --a------ 2004-01-14 02:00 99840 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I3T1.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Flash32] c:\Program Files\Flash 32\Flash32.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1] --a------ 2004-08-04 20:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2005-05-13 23:11 1397760 C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2006-06-14 16:24 278528 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --------- 2004-10-14 00:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002] --a------ 2004-08-04 20:00 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NCLaunch] --ah----- 2005-11-27 09:08 40960 C:\WINDOWS\NCLAUNCH.EXe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 11:50 155648 C:\WINDOWS\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] -ra------ 2004-07-12 00:50 4112384 C:\WINDOWS\system32\NvCpl.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] -ra------ 2004-07-12 00:50 81920 C:\WINDOWS\system32\NvMcTray.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NWEReboot] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2004-07-12 00:50 843776 C:\WINDOWS\system32\nwiz.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2007-03-23 13:20 227328 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A] --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync] --a------ 2004-08-04 20:00 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PhotoShow Deluxe Media Manager] --a------ 2005-02-26 08:28 212992 C:\PROGRA~1\Ahead\NEROPH~2\data\xtras\mssysmgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE] --a------ 2008-01-20 15:05 217088 C:\Program Files\PowerISO\PWRISOVM.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-01-05 17:17 282624 C:\Program Files\QuickTime\qttask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] -ra------ 2007-05-28 10:14 528384 C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan] -rah----- 2005-06-20 05:42 77824 C:\WINDOWS\SOUNDMAN.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2005-04-13 03:48 36975 C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TClock.exe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UVS11 Preload] --a------ 2007-03-03 14:12 341488 C:\Program Files\Ulead Systems\Ulead VideoStudio 11\uvPL.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Veoh] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winlog] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] --a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "C:\\Program Files\\Warcraft III\\Warcraft III.exe"= "C:\\Program Files\\Warcraft III\\War3.exe"= "C:\\Program Files\\Call of Duty\\CoDMP.exe"= "C:\\Program Files\\Microsoft Games\\Rise of Nations\\rise.Exe"= "C:\\Program Files\\Microsoft Visual Studio\\COMMON\\Tools\\VS-Ent98\\Vanalyzr\\VARPC.EXE"= "C:\\WINDOWS\\System32\\AUTMGR32.EXE"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Grouper\\Grouper.exe"= "C:\\Program Files\\FusionProject\\Fusion.EXE"= "C:\\Program Files\\RagnarokOffline3\\FusionProject\\Fusion.EXE"= "C:\\Program Files\\Java\\jre1.5.0_03\\bin\\javaw.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\NtreevSoft\\PangYa\\update.exe"= "C:\\Program Files\\NtreevSoft\\PangYa\\ProjectG.exe"= "C:\\Program Files\\Chinesegamer\\TSOnline\\UPDATE.EXE"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\StubInstaller.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Hexacto Games\\Lemonade Tycoon\\Lemonade.exe"= "C:\\Program Files\\Lemonade Tycoon 2\\Lemonade2.exe"= "C:\\Program Files\\EA SPORTS\\NASCAR Thunder TM 2004\\NASCAR_Thunder_2004.exe"= "C:\\Program Files\\Shareaza\\Shareaza.exe"= "C:\\Program Files\\empire earth\\Empire Earth.exe"= "C:\\Program Files\\Opera\\Opera.exe"= "C:\\Program Files\\DAP\\DAP.exe"= "C:\\Program Files\\Gravity\\RO\\magclient.exe"= "C:\\Program Files\\Gravity\\RO\\maggotzRO.exe"= "C:\\Program Files\\EA SPORTS\\NBA LIVE 06\\nbalive06.exe"= "C:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"= "C:\\Program Files\\ValveSoftware\\Half-life2\\hl2.exe"= "C:\\Program Files\\Valve\\Counter-Strike Source\\hl2.exe"= "C:\\Program Files\\Valve\\Counter-Strike Source\\srcds.exe"= "C:\\Valve\\Steam\\SteamApps\\Drogon\\Half-Life2\\hl2.exe"= "C:\\Program Files\\ZakFromAnotherPlanet\\Yazak Chat\\yazak.exe"= "C:\\Program Files\\uTorrent\\uTorrent.exe"= "C:\\Program Files\\YahELite\\YahVox.exe"= "C:\\Program Files\\Zone.com Deluxe Games\\Wheel of Fortune Deluxe\\Wheel of Fortune Deluxe.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"= "C:\\Program Files\\Bonjour\\mDNSResponder.exe"= "C:\\Program Files\\Garena\\Garena.exe"= "C:\\Program Files\\YahELite\\YahELite.exe"= "C:\\Program Files\\Dream\\Yahaven!\\Yahaven!.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009 R3 Z302Mic;Vimicro Z302 Mic Audio Filter Driver;C:\WINDOWS\system32\drivers\UsbMicfilt.sys [2002-05-14 19:05] S2 jsm-default;JRun Service Manager;C:\Program Files\Macromedia\Generator 2\bin\jsm.exe "jsm-default" "C:\Program Files\Macromedia\Generator 2\jsm-default" [] S3 k600bus;Sony Ericsson 600i driver (WDM);C:\WINDOWS\system32\DRIVERS\k600bus.sys [2005-05-11 19:12] S3 k600mdfl;Sony Ericsson 600i USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\k600mdfl.sys [2005-05-11 19:12] S3 k600mdm;Sony Ericsson 600i USB WMC Modem Drivers;C:\WINDOWS\system32\DRIVERS\k600mdm.sys [2005-05-11 19:12] S3 k600mgmt;Sony Ericsson 600i USB WMC Device Management Drivers;C:\WINDOWS\system32\DRIVERS\k600mgmt.sys [2005-05-11 19:12] S3 k600obex;Sony Ericsson 600i USB WMC OBEX Interface Drivers;C:\WINDOWS\system32\DRIVERS\k600obex.sys [2005-05-11 19:12] S3 npkycryp;npkycryp;C:\Program Files\Gravity\RO\npkycryp.sys [] S3 PortlUSB;PortlUSB;C:\WINDOWS\system32\DRIVERS\H10USB.sys [2004-06-24 12:52] S3 s716bus;Sony Ericsson Device 716 driver (WDM);C:\WINDOWS\system32\DRIVERS\s716bus.sys [2007-04-04 12:43] S3 s716mdfl;Sony Ericsson Device 716 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s716mdfl.sys [2007-04-04 12:43] S3 s716mdm;Sony Ericsson Device 716 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s716mdm.sys [2007-04-04 12:43] S3 s716mgmt;Sony Ericsson Device 716 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s716mgmt.sys [2007-04-04 12:43] S3 s716nd5;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (NDIS);C:\WINDOWS\system32\DRIVERS\s716nd5.sys [2007-04-04 12:43] S3 s716obex;Sony Ericsson Device 716 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s716obex.sys [2007-04-04 12:43] S3 s716unic;Sony Ericsson Device 716 USB Ethernet Emulation SEMC716 (WDM);C:\WINDOWS\system32\DRIVERS\s716unic.sys [2007-04-04 12:43] S3 StMp3Rec;Player Recovery Device Control Driver;C:\WINDOWS\system32\Drivers\StMp3Rec.sys [2004-12-18 20:32] S3 tap0801;Smarthide TAP driver;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2007-10-12 21:07] S3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 23:01] S3 XDva037;XDva037;C:\WINDOWS\system32\XDva037.sys [] S3 XDva104;XDva104;C:\WINDOWS\system32\XDva104.sys [] S3 XDva121;XDva121;C:\WINDOWS\system32\XDva121.sys [] S3 XDva132;XDva132;C:\WINDOWS\system32\XDva132.sys [] S3 ZSMC302;PC CAM 300A;C:\WINDOWS\system32\Drivers\usbvm302.sys [2002-11-02 01:43] . Contents of the 'Scheduled Tasks' folder "2008-02-08 17:00:02 C:\WINDOWS\Tasks\user backup.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe "2008-02-08 17:20:02 C:\WINDOWS\Tasks\user scan and fix.job" - C:\Program Files\AMUST\Registry Cleaner\RegCleaner.exe "2007-08-10 22:38:24 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2008-03-08 09:24:02 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job" - C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe "2008-03-14 01:00:02 C:\WINDOWS\Tasks\At1.job" - C:\WINDOWS\system32\blastclnnn.exe . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-05-18 10:33:18 Windows 5.1.2600 Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\PROGRAM FILES\BONJOUR\MDNSRESPONDER.EXE C:\PROGRAM FILES\COMMON FILES\INTERVIDEO\DEVICESERVICE\DEVSVC.EXE C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VS7DEBUG\MDM.EXE C:\WINDOWS\SYSTEM32\WSCNTFY.EXE . ********************************************************************** . Completion time: 2008-05-18 10:36:49 - machine was rebooted ComboFix-quarantined-files.txt 2008-05-18 02:36:48 ComboFix2.txt 2008-05-17 06:50:18 Pre-Run: 7,671,349,248 bytes free Post-Run: 7,109,312,512 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons 316 --- E O F --- 2008-02-28 05:08:27 This is the log from Hijackthis:** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:38:05 AM, on 5/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\user\My Documents\hijackthis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) F1 - win.ini: run=C:\WINDOWS\system32\mouse_configurator.win O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1150152044214 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file:///C:/Program%20Files/AutoCAD%202002/AcDcToday.ocx O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file:///C:/Program%20Files/AutoCAD%202002/InstBanr.ocx O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file:///C:/Program%20Files/AutoCAD%202002/InstFred.ocx O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file:///C:/Program%20Files/AutoCAD%202002/AcPreview.ocx O20 - Winlogon Notify: st3 - C:\WINDOWS\ O22 - SharedTaskScheduler: st3 - {1B68470C-2DEF-493B-8A4A-8E2D81BE4EA5} - (no file) O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Capture Device Service - InterVideo Inc. - C:\Program Files\Common Files\InterVideo\DeviceService\DevSvc.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing) O23 - Service: InCD Helper (read only) (InCDsrvR) - Unknown owner - C:\Program Files\Ahead\InCD\InCDsrv.exe (file missing) O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: JRun Service Manager (jsm-default) - Unknown owner - C:\Program Files\Macromedia\Generator 2\bin\jsm.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - (no file) O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 6265 bytes Thanks