Hi to all at the TSF, I throw myself at your mercy!
I have developed a bit of a horrible problem with my PC and decided to search for some help, which led to me being brought here by google. After having a quick browse, I was really impressed at the service you guys are offering! If anything, you guys are the ones who seemingly should be getting paid, rather than these cowboys who will take your PC away and then (claim to have) spend hours trying to fix it, only to have fresh installed your Windows rather than repairing the problem!! (Sorry, that example got a bit specific- not something I've personally suffered though!)
Anyway, I have babbled long enough! I'm normally able to get on top of any problems I develop with a couple of sweeps with different security programs I have installed- this one just wont go away though. I really don't know what it is that triggered it off and I don't know what other effects I'm suffering besides the performance related issues- but I would like to get it resolved!!!
Super Anti Spyware, AVG and Spybot all pick up this vundo thing and locate the same entries/files etc, and though they claim to have healed/deleted them, the problem just comes back. As best I can tell, there's possibly something located in a (hidden) Temporary Internet Files folder, although I haven't got the exact path. Also, Spybot keeps picking up persistent attempts for a 'Browser Helper Object' to do something- which I keep denying- and it also appears that a number of randomly named files are being created in my system32 folder. These files are DLL and they also seem to trigger a process called rundll32.exe. I've tried to kill these processes and used the cmd to delete the offending files- but new ones then just get created instead. When Spybot starts picking them up and I deny them, it seems to alternate- first the Browser Helper Object, then the DLL- but no matter how many times I deny the change, it just keeps coming straight back up with the other one. Around the same time, my Firefox had suddenly refused to load facebook, but was still loading other pages. I think that's about as descriptive as I can be. Oh, and I believe a couple of registry keys get picked up by a spyware scan too.
I tried to do your five steps and I've done pretty much everything- however, the Panda Security checker did not want to install properly and though it did in the end, it didn't scan. It stayed on the scan screen for about two seconds, then a pop up appeared saying I was not infected followed by a paragraph which included the phrase 'no protection was found'. I can't remember the full sentence but it's almost like 'protection' was a typo that was meant to say 'infection', based on the context of the sentence. If that makes any sense whatsoever....
As it stands at this exact moment, I'm not being bothered by Spybot but that will inevitably start again at some point. There is one instance of rundll32.exe running.
My main.txt follows:
Deckard's System Scanner v20071014.68
Run by Dannyboy! on 2008-06-12 08:46:54
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- System Restore --------------------------------------------------------------
Successfully created a Deckard's System Scanner Restore Point.
-- Last 5 Restore Point(s) --
22: 2008-06-12 07:46:59 UTC - RP116 - Deckard's System Scanner Restore Point
21: 2008-06-12 07:44:24 UTC - RP115 - Removed NinjaVideo Helper
20: 2008-06-11 15:31:28 UTC - RP114 - System Checkpoint
19: 2008-06-10 14:53:45 UTC - RP113 - System Checkpoint
18: 2008-06-09 14:32:36 UTC - RP112 - System Checkpoint
-- First Restore Point --
1: 2008-06-08 14:20:47 UTC - RP95 - System Checkpoint
Backed up registry hives.
Performed disk cleanup.
System Drive C: has 27.26 GiB (less than 15%) free.
-- HijackThis Clone ------------------------------------------------------------
Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-06-12 08:51:58
Platform: Windows XP Service Pack 3, v.3311 (5.01.2600)
MSIE: Internet Explorer (8.00.6001.17184)
Boot mode: Normal
Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Grisoft\AVG7\avgamsvr.exe
C:\Program Files\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Grisoft\AVG7\avgemc.exe
C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\CTHELPER.EXE
C:\Program Files\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Safari\Safari.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\Dannyboy!\Desktop\dss.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about
:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.google.com/ie
O2 - BHO: (no name) - {25996837-9A25-4D8C-A62D-A1294FF307C1} - C:\WINDOWS\system32\jkkjJdCr.dll (file missing)
O2 - BHO: (no name) - {4F7634AE-50F3-4E15-8805-BDC7BF7C19A8} - blank (file missing)
O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\ydtucicq.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {5DBFA7AE-38CD-4861-8E2F-33519FCDE725} - blank (file missing)
O2 - BHO: (no name) - {5E6AD50A-BB92-47E3-B458-8A889CF2634E} - C:\WINDOWS\system32\awtttqnO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {850CBAAD-72B8-4001-A433-B611BFFFD5A3} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {E25EE903-37EB-467B-B1F0-F71063F6B8C8} - C:\WINDOWS\system32\efcBrsQI.dll (file missing)
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WinSys2] C:\WINDOWS\system32\winsys2.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IE7Pro\IE7Pro.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) -
http://download.microsoft.com/downlo...OGAControl.cab
O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) -
http://musicmix.messenger.msn.com/Medialogic.CAB
O16 - DPF: {4A85DBE0-BFB2-4119-8401-186A7C6EB653} () -
http://messenger.zone.msn.com/binary/MJSS.cab69309.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) -
http://messenger.zone.msn.com/binary...n.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zone.msn.com/EN-GB/.../GAME_UNO1.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsof...?1174847536953
O16 - DPF: {8FEFF364-6A5F-4966-A917-A3AC28411659} (SopCore Control) -
http://download.sopcast.com/download/SOPCORE.CAB
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () -
http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) -
http://messenger.zone.msn.com/binary...o.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Measurement Services Client v.3.12) -
http://www.yougamers.com/systeminfo/MSC3.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) -
http://drmlicense.one.microsoft.com/.../en/crlocx.ocx
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) -
http://messenger.zone.msn.com/binary...r.cab56986.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{B7C49087-ACDB-40EE-B952-E1EBA86BA129}: NameServer = 87.194.0.51,87.194.0.52
O18 - Protocol: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O18 - Protocol: wlmailhtml - {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: AtiExtEvent - C:\WINDOWS\system32\
O20 - Winlogon Notify: efcBrsQI - C:\WINDOWS\system32\efcBrsQI.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\Program Files\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
--
End of file - 13486 bytes
-- HijackThis Fixed Entries (C:\Program Files\hijackthis\backups\) -------------
backup-20070624-181610-266 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157
backup-20070624-181610-276 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
backup-20070624-181610-451 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
backup-20070624-181610-828 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
backup-20070820-224747-482 O17 - HKLM\System\CCS\Services\Tcpip\..\{4E31E2A1-D9D1-45B6-978C-ACC382E0C54C}: NameServer = 85.255.116.170,85.255.112.213
backup-20070820-224747-502 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
backup-20070820-224748-100 O17 - HKLM\System\CCS\Services\Tcpip\..\{A88FAF56-0926-441F-849E-F9A9C46114BE}: NameServer = 85.255.116.170,85.255.112.213
backup-20070820-224748-197 O17 - HKLM\System\CCS\Services\Tcpip\..\{62234CC4-8E57-48DE-923E-1DF304D3A7EA}: NameServer = 85.255.116.170,85.255.112.213
backup-20070820-224748-299 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213
backup-20070820-224748-801 O17 - HKLM\System\CCS\Services\Tcpip\..\{61F7AE8A-DA69-4C09-846E-1C88BB9145A3}: NameServer = 85.255.116.170,85.255.112.213
backup-20070820-224748-833 O17 - HKLM\System\CCS\Services\Tcpip\..\{99476C9A-D7E6-4028-B7DC-144366FE3763}: NameServer = 85.255.116.170,85.255.112.213
backup-20070820-224748-962 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213
backup-20070820-224748-968 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.116.170 85.255.112.213
-- File Associations -----------------------------------------------------------
.cpl - cplfile - shell\cplopen\command - rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.cpl - cplfile - shell\runas\command - rundll32.exe shell32.dll,Control_RunDLLAsUser "%1",%*
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
R1 BANTExt (Belarc SMBios Access) - c:\windows\system32\drivers\bantext.sys
R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
R3 GTNDIS5 (GTNDIS5 NDIS Protocol Driver) - c:\windows\system32\gtndis5.sys <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>
S0 viasraid - c:\windows\system32\drivers\viasraid.sys (file missing)
S1 atitray - c:\program files\radeon omega drivers\v3.8.360\ati tray tools\atitray.sys (file missing)
S1 sdpiosys - c:\windows\system32\drivers\sdpiosys.sys (file missing)
S3 ALCXSENS (Service for WDM 3D Audio Driver) - c:\windows\system32\drivers\alcxsens.sys (file missing)
S3 ALCXWDM (Service for Realtek AC97 Audio (WDM)) - c:\windows\system32\drivers\alcxwdm.sys (file missing)
S3 BCM43XX (BCM 802.11b Network Adapter Driver) - c:\windows\system32\drivers\bcmwl5.sys (file missing)
S3 ENTECH - c:\windows\system32\drivers\entech.sys <Not Verified; EnTech Taiwan; PowerStrip>
S3 RTL8023 (Realtek RTL8139/810x/8169/8110 all in one NDIS NT Driver) - c:\windows\system32\drivers\rtlnic51.sys (file missing)
S3 SABProcEnum - c:\progra~1\mozilla firefox\sabprocenum.sys (file missing)
S3 TVICHW32 - c:\windows\system32\drivers\tvichw32.sys <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64>
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
R2 Diskeeper - "c:\program files\diskeeper corporation\diskeeper\dkservice.exe" <Not Verified; Diskeeper Corporation; Diskeeper (TM) Disk Defragmenter>
S3 aawservice (Ad-Aware 2007 Service) - "c:\program files\lavasoft\ad-aware 2007\aawservice.exe" <Not Verified; Lavasoft AB; Ad-Aware 2007 Service>
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S4 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
-- Device Manager: Disabled ----------------------------------------------------
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 1394 Net Adapter
Device ID: V1394\NIC1394\1108509623C04
Manufacturer: Microsoft
Name: 1394 Net Adapter
PNP Device ID: V1394\NIC1394\1108509623C04
Service: NIC1394
-- Scheduled Tasks -------------------------------------------------------------
2008-06-09 13:30:05 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
-- Files created between 2008-05-12 and 2008-06-12 -----------------------------
2008-06-12 01:38:00 0 d-------- C:\ie-spyad_zo
2008-06-12 01:12:56 0 d-------- C:\Program Files\Panda Security
2008-06-12 00:56:00 98816 --a------ C:\WINDOWS\system32\jcdhvpqw.dll
2008-06-12 00:53:08 80896 --a------ C:\WINDOWS\system32\onextdnj.dll
2008-06-12 00:53:00 89600 --a------ C:\WINDOWS\system32\mtuykryl.dll
2008-06-12 00:50:43 92160 --a------ C:\WINDOWS\system32\ydtucicq.dll
2008-06-12 00:50:00 517896 --ahs---- C:\WINDOWS\system32\Onqtttwa.ini2
2008-06-12 00:49:57 321536 --a------ C:\WINDOWS\system32\awtttqnO.dll
2008-06-11 14:20:58 109056 --a------ C:\WINDOWS\system32\deqcuxxp.dll
2008-06-11 14:17:58 91648 --a------ C:\WINDOWS\system32\xmfsenew.dll
2008-06-11 14:14:58 92160 --a------ C:\WINDOWS\system32\mhfehniq.dll
2008-06-11 14:12:38 100864 --a------ C:\WINDOWS\system32\wshgakwb.dll
2008-06-11 14:11:58 503679 --ahs---- C:\WINDOWS\system32\rCdJjkkj.ini2
2008-06-11 11:03:09 184320 --a------ C:\WINDOWS\system32\nwrlsnfu.dll
2008-06-11 10:57:28 92160 --a------ C:\WINDOWS\system32\uonhppfv.dll
2008-06-11 10:33:09 489826 --ahs---- C:\WINDOWS\system32\yGPrsBeg.ini2
2008-06-11 03:25:49 184320 --a------ C:\WINDOWS\system32\wptaubhd.dll
2008-06-11 03:25:41 157184 --a------ C:\WINDOWS\system32\tdukmbxy.dll
2008-06-11 03:25:34 92160 --a------ C:\WINDOWS\system32\idmsqgwu.dll
2008-06-10 03:27:17 109056 --a------ C:\WINDOWS\system32\qsosswhn.dll
2008-06-10 03:27:15 92160 --a------ C:\WINDOWS\system32\htteqcjs.dll
2008-06-10 03:24:15 92160 --a------ C:\WINDOWS\system32\wwbijorm.dll
2008-06-09 16:22:01 0 d-------- C:\Program Files\Safari
2008-06-09 03:25:16 108544 --a------ C:\WINDOWS\system32\tkcfckvu.dll
2008-06-09 03:22:43 92160 --a------ C:\WINDOWS\system32\oekhbkff.dll
2008-06-09 03:22:36 100352 --a------ C:\WINDOWS\system32\trgtgkyn.dll
2008-06-08 15:20:37 490086 --ahs---- C:\WINDOWS\system32\dNWENqru.ini2
2008-06-08 14:33:01 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\CyberLink
2008-06-08 14:30:46 0 d-------- C:\Program Files\Common Files\CyberLink
2008-06-08 13:50:07 0 d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
2008-06-08 13:49:57 0 d-------- C:\Program Files\CyberLink
2008-06-03 17:17:21 0 d-------- C:\Program Files\Apple Software Update
2008-05-27 18:04:30 0 d-------- C:\WINDOWS\CD95F661A5C444F5A6AAECDD91C240B5.TMP
2008-05-26 18:58:22 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Pioneer
2008-05-26 18:57:14 0 d-------- C:\WINDOWS\system32\ipp20
2008-05-26 18:56:56 0 d-------- C:\Program Files\Pioneer
2008-05-26 15
54 0 dr-h----- C:\$VAULT$.AVG
2008-05-26 11:59:48 0 d-------- C:\Program Files\Capcom
2008-05-20 22:56:24 0 d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-05-20 22:56:23 0 d-------- C:\Program Files\DVD Shrink
2008-05-18 14:10:22 0 d-------- C:\Program Files\Eidos
2008-05-18 12:40:18 0 d-------- C:\Program Files\DAEMON Tools Lite
2008-05-18 12:35:33 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\DAEMON Tools
2008-05-15 03:36:42 0 d-------- C:\Program Files\Activision
2008-05-15 00:40:58 0 d-------- C:\WINDOWS\system32\Lang
2008-05-15 00:26:36 23600 --a------ C:\WINDOWS\system32\drivers\TVICHW32.SYS <Not Verified; EnTech Taiwan; TVicHW32 Generic Device Driver for Windows 95/98/ME/NT/2000/2003/XP/XP64>
2008-05-14 23:46:57 0 d-------- C:\Program Files\ATI Technologies
2008-05-14 23:37:29 0 d-------- C:\Program Files\GIGABYTE
2008-05-14 23:35:19 0 d-------- C:\WINDOWS\nview
2008-05-14 23:33:32 208896 --a------ C:\WINDOWS\system32\WinSys2.exe <Not Verified; ; DOT Application>
2008-05-14 23:33:32 200704 --a------ C:\WINDOWS\system32\WinSys.exe <Not Verified; ; DOT Application>
2008-05-14 23:33:32 9728 --a------ C:\WINDOWS\system32\sysinfoX64.sys
2008-05-14 23:33:31 8192 --a------ C:\WINDOWS\system32\sysinfo.sys
2008-05-14 23:33:31 114688 --a------ C:\WINDOWS\system32\sysinfo.dll <Not Verified; Crystal Dew World; SysInfo>
2008-05-14 23:33:31 69632 --a------ C:\WINDOWS\system32\sw24.exe
2008-05-14 23:33:31 208896 --a------ C:\WINDOWS\system32\sw20.exe <Not Verified; ; sw20 Application>
2008-05-14 23:33:31 131072 --a------ C:\WINDOWS\system32\smdll.dll <Not Verified; ; SMdll Dynamic Link Library>
2008-05-14 23:33:31 1626112 --a------ C:\WINDOWS\system32\nwiz.exe
2008-05-14 23:33:31 1019904 --a------ C:\WINDOWS\system32\nvwimg.dll
2008-05-14 23:33:31 1703936 --a------ C:\WINDOWS\system32\nvwdmcpl.dll
2008-05-14 23:33:30 1018772 --a------ C:\WINDOWS\system32\nvucode.bin
2008-05-14 23:33:30 466944 --a------ C:\WINDOWS\system32\nvshell.dll
2008-05-14 23:33:30 286720 --a------ C:\WINDOWS\system32\nvnt4cpl.dll
2008-05-14 23:33:29 1474560 --a------ C:\WINDOWS\system32\nview.dll
2008-05-14 23:33:29 1339392 --a------ C:\WINDOWS\system32\nvdspsch.exe
2008-05-14 23:33:27 442368 --a------ C:\WINDOWS\system32\nvappbar.exe
2008-05-14 23:33:25 1748992 --a------ C:\WINDOWS\system32\msicpl.dll <Not Verified; MSI; MSI MsiCpl>
2008-05-14 23:33:25 130048 --a------ C:\WINDOWS\system32\MadCHook.dll <Not Verified;
www.madshi.net; madCHook>
2008-05-14 23:33:25 425984 --a------ C:\WINDOWS\system32\keystone.exe
2008-05-14 23:33:25 266240 --a------ C:\WINDOWS\system32\HookShield.dll
2008-05-14 23:33:25 262144 --a------ C:\WINDOWS\system32\HookMAp.dll
2008-05-14 23:33:25 32768 --a------ C:\WINDOWS\system32\Auxiliary.dll
2008-05-14 22:26:15 0 d-------- C:\WINDOWS\OPTIONS
2008-05-14 22:25:55 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\InstallShield
2008-05-14 22:23:58 0 d-------- C:\WINDOWS\system32\RTCOM
2008-05-14 22:23:58 49152 -ra------ C:\WINDOWS\system32\ChCfg.exe
2008-05-14 22:22:58 0 d-------- C:\Program Files\Realtek
2008-05-14 22:22:34 520192 -r------- C:\WINDOWS\RtlExUpd.dll <Not Verified; Realtek Semiconductor Corp.; RtlExUpd Dynamic Link Library>
2008-05-13 20:13:07 0 d-------- C:\Program Files\VirtualDJ
2008-05-13 02:53:16 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-05-13 02:50:16 196608 --a------ C:\WINDOWS\system32\dtu100.dll <Not Verified; DivX, Inc.; DivX, Inc. dtu100>
2008-05-13 02:50:16 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-05-13 02:50:08 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:50:08 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-05-13 02:50:08 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:50:06 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-05-13 02:49:02 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
-- Find3M Report ---------------------------------------------------------------
2008-06-12 08:36:24 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\uTorrent
2008-06-12 08:00:06 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\AVG7
2008-06-12 01:41:55 0 d-------- C:\Program Files\SpywareBlaster
2008-06-09 16:41:30 57076 --ah----- C:\WINDOWS\system32\mlfcache.dat
2008-06-09 16:23:01 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Apple Computer
2008-06-08 14:30:46 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-08 14:30:46 0 d-------- C:\Program Files\Common Files
2008-06-06 15:33:54 0 d-------- C:\Program Files\DC++
2008-06-04 23:23:16 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-05-30 04:55:37 0 d-------- C:\Program Files\mIRC
2008-05-26 09:15:05 0 d-------- C:\Program Files\Java
2008-05-23 21:07:51 0 d-------- C:\Program Files\ARWizard3
2008-05-20 09:33:26 0 d-------- C:\Program Files\Microsoft Silverlight
2008-05-19 12:44:53 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\dvdcss
2008-05-16 12:43:01 0 d-------- C:\Program Files\DivX
2008-05-04 17:29:09 315392 --a------ C:\WINDOWS\HideWin.exe <Not Verified; Realtek Semiconductor Corp.; HD Audio Hide windows program>
2008-05-04 17:05:29 0 d-------- C:\Program Files\VIA
2008-04-28 09:52:02 0 d-------- C:\Program Files\NinjaVideo
2008-04-18 01:30:04 0 d-------- C:\Program Files\Viewpoint
2008-04-18 01:28:58 335 --a------ C:\WINDOWS\nsreg.dat
2008-04-18 01:28:58 0 d-------- C:\Documents and Settings\Dannyboy!\Application Data\Mozilla
2008-04-17 21:15:17 0 d-------- C:\Program Files\Kontiki
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25996837-9A25-4D8C-A62D-A1294FF307C1}]
C:\WINDOWS\system32\jkkjJdCr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4F7634AE-50F3-4E15-8805-BDC7BF7C19A8}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]
12/06/2008 00:50 92160 --a------ C:\WINDOWS\system32\ydtucicq.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5DBFA7AE-38CD-4861-8E2F-33519FCDE725}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E6AD50A-BB92-47E3-B458-8A889CF2634E}]
12/06/2008 00:49 321536 --a------ C:\WINDOWS\system32\awtttqnO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{850CBAAD-72B8-4001-A433-B611BFFFD5A3}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E25EE903-37EB-467B-B1F0-F71063F6B8C8}]
C:\WINDOWS\system32\efcBrsQI.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTHelper"="CTHELPER.EXE" [11/08/2006 14:56 C:\WINDOWS\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [11/08/2006 14:56 C:\WINDOWS\system32\CTXFIHLP.EXE]
"DiskeeperSystray"="C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe" [22/11/2005 17:38]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [11/01/2008 23:16]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [18/04/2008 08:24]
"KernelFaultCheck"="C:\WINDOWS\system32\dumprep 0 -k" []
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [29/06/2007 00:43]
"nwiz"="nwiz.exe" [29/06/2007 00:43 C:\WINDOWS\system32\nwiz.exe]
"WinSys2"="C:\WINDOWS\system32\winsys2.exe" [29/04/2006 11:36]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [29/06/2007 00:43]
"RTHDCPL"="RTHDCPL.EXE" [10/05/2007 10:08 C:\WINDOWS\RTHDCPL.EXE]
"Alcmtr"="ALCMTR.EXE" [03/05/2005 10:43 C:\WINDOWS\Alcmtr.exe]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [22/02/2008 04:25]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [24/11/2006 01:06]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [01/02/2008 00:13]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [09/03/2007 18:53]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [19/02/2008 14:10]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [12/02/2008 10:29]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18/10/2007 12:34]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [28/01/2008 12:43]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE" [04/03/2008 02:33]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [18/10/2006 20:05]
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [20/12/2006 13:55 77824]
"{E25EE903-37EB-467B-B1F0-F71063F6B8C8}"= C:\WINDOWS\system32\efcBrsQI.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 19/04/2007 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dimsntfy]
C:\WINDOWS\System32\dimsntfy.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcBrsQI]
efcBrsQI.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\awtttqnO
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShutDown]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- D:\setup.exe
-- Hosts -----------------------------------------------------------------------
127.0.0.1
www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1
www.008k.com
127.0.0.1 008k.com
127.0.0.1
www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1
www.032439.com
127.0.0.1 032439.com
8744 more entries in hosts file.
-- End of Deckard's System Scanner: finished at 2008-06-12 08:53:49 ------------
My extra.txt is attached.
I shall patiently await your response! Thanks for your time :)