Tech Support Forum - View Single Post

vinnie1543 · 11-12-2008, 02:59 AM

Thanks for the nice thoughts and for your time and help (I don't think I can say thanks enough). The combo fix said it was successfully submitted for analysis

ComboFix 08-11-11.01 - Owner 2008-11-12 4:41:23.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.886 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\Combo-Fix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point

FILE ::
c:\documents and settings\All Users\Application Data\isoluwav.bin
c:\documents and settings\All Users\Application Data\ramyxy.bin
c:\Program Files\Common Files\cadimi._sy
c:\Program Files\Common Files\cylulimy.bin
c:\Program Files\Common Files\gyfijydo.db
c:\Program Files\Common Files\ififezoxo.sys
c:\Program Files\Common Files\pesykacu.exe
c:\windows\agaloxyl.reg
c:\windows\akifonuh.com
c:\windows\codutaruq.vbs
c:\windows\enys.bin
c:\windows\fugenit.reg
c:\windows\izegip.bin
c:\windows\kozizoha._dl
c:\windows\kulybiqi.pif
c:\windows\qidybylo.bin
c:\windows\system32\dywumap.com
c:\windows\system32\fivacevo.lib
c:\windows\system32\muribud.scr
c:\windows\system32\nalymi.lib
c:\windows\system32\nolukywoje.pif
c:\windows\system32\runrefog.lnk
c:\windows\vipyxewubi._sy
c:\windows\ymym.bat
c:\windows\ytegico.scr
c:\windows\ziveqy.bin
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\isoluwav.bin
c:\documents and settings\All Users\Application Data\ramyxy.bin
c:\documents and settings\Owner\Application Data\spam drive copy
c:\Program Files\Common Files\cadimi._sy
c:\Program Files\Common Files\cylulimy.bin
c:\Program Files\Common Files\gyfijydo.db
c:\Program Files\Common Files\ififezoxo.sys
c:\Program Files\Common Files\pesykacu.exe
c:\windows\agaloxyl.reg
c:\windows\akifonuh.com
c:\windows\codutaruq.vbs
c:\windows\enys.bin
c:\windows\fugenit.reg
c:\windows\izegip.bin
c:\windows\kozizoha._dl
c:\windows\kulybiqi.pif
c:\windows\qidybylo.bin
c:\windows\system32\dywumap.com
c:\windows\system32\fivacevo.lib
c:\windows\system32\muribud.scr
c:\windows\system32\nalymi.lib
c:\windows\system32\nolukywoje.pif
c:\windows\system32\runrefog.lnk
c:\windows\vipyxewubi._sy
c:\windows\ymym.bat
c:\windows\ytegico.scr
c:\windows\ziveqy.bin

.
((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 )))))))))))))))))))))))))))))))
.

2008-11-03 21:18 . 2008-11-03 21:41 <DIR> d-------- C:\rsit
2008-11-03 21:18 . 2002-07-25 20:05 <DIR> d-------- C:\Program Files\trend micro
2008-10-26 13:43 . 2008-10-26 20:25 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-10-26 08:16 . 2008-10-26 08:16 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2008-10-25 20:57 . 2008-11-03 20:46 <DIR> d-------- C:\Documents and Settings\Other People\Incomplete
2008-10-25 11:15 . 2008-10-25 11:15 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy)
2008-10-25 10:53 . 2008-10-25 10:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-10-25 10:52 . 2008-10-25 11:23 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-10-25 10:32 . 2008-10-25 10:32 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys
2008-10-24 21:35 . 2008-10-24 21:35 <DIR> d-------- C:\Program Files\filehippo.com
2008-10-24 16:08 . 2008-10-15 11:34 337,408 --a------ C:\WINDOWS\system32\SET1E.tmp
2008-10-24 16:08 . 2008-10-15 11:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll
2008-10-14 15:26 . 2008-09-15 07:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys
2008-10-14 15:26 . 2008-09-08 05:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys
2008-10-14 15:25 . 2008-08-14 05:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe
2008-10-14 15:25 . 2008-08-14 05:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-10-14 15:25 . 2008-08-14 04:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe
2008-10-14 15:25 . 2008-08-14 04:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 02:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
2008-11-03 21:57 --------- d-----w C:\Documents and Settings\Other People\Application Data\Apple Computer
2008-10-26 13:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-10-23 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-10-23 20:13 --------- d-----w C:\Program Files\Philips
2008-10-23 20:06 --------- d-----w C:\Program Files\Atari
2008-10-23 20:03 --------- d-----w C:\Program Files\Red Storm Entertainment
2008-10-23 20:03 --------- d-----w C:\Program Files\GameSpy Arcade
2008-10-23 19:56 --------- d-----w C:\Program Files\Sierra
2008-10-23 18:26 --------- d-----w C:\Program Files\eMachineShop
2008-10-16 18:13 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-10-16 18:13 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-10-16 18:12 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-10-16 18:12 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-10-16 18:09 92,696 ----a-w C:\WINDOWS\system32\cdm.dll
2008-10-16 18:09 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-10-16 18:09 43,544 ----a-w C:\WINDOWS\system32\wups2.dll
2008-10-16 18:08 34,328 ----a-w C:\WINDOWS\system32\wups.dll
2008-10-16 18:06 268,648 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-10-16 18:06 208,744 ----a-w C:\WINDOWS\system32\muweb.dll
2008-10-09 03:54 --------- d-----w C:\Documents and Settings\Owner\Application Data\Viewpoint
2008-09-24 23:43 --------- d-----w C:\Program Files\Acoustic Labs Audio Editor (Demo)
2008-09-23 22:20 --------- d-----w C:\Program Files\MSECache
2008-09-23 21:22 --------- d-----w C:\Program Files\Ascentive
2008-09-23 21:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SKL
2008-09-23 21:17 --------- d-----w C:\Program Files\Common Files\Sony Shared
2008-09-23 07:00 --------- d-----w C:\Program Files\MSXML 4.0
2008-09-22 14:36 --------- d-----w C:\Program Files\HP PhotoSmart Printers
2008-09-22 00:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2008-09-22 00:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\acccore
2008-09-22 00:57 --------- d-----w C:\Program Files\Viewpoint
2008-09-22 00:57 --------- d-----w C:\Program Files\AIM6
2008-09-22 00:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-09-22 00:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\acccore
2008-09-22 00:56 --------- d-----w C:\Program Files\Common Files\AOL
2008-09-22 00:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys
2008-08-26 17:57 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll
2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2008-08-14 10:11 2,189,184 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-08-14 09:33 2,066,048 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2007-06-11 16:37 374 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb6334.dat
2007-06-10 23:24 538 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb8467.dat
2007-06-10 23:24 18,432 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb41.dat
2002-07-25 23:10 30 ----a-w C:\Documents and Settings\Owner\jagex_runescape_preferences.dat
.

((((((((((((((((((((((((((((( snapshot@2008-11-04_21.13.48.01 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-10-20 20:36:51 315,392 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl.dll
+ 2002-07-25 23:09:44 315,392 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl.dll
- 2008-10-20 20:36:51 20,480 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl_awt.dll
+ 2002-07-25 23:09:44 20,480 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl_awt.dll
+ 2008-11-28 23:11:51 11,346 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{F4E1D174-05F4-4DDF-99D1-68E431AD60D4}.bin
- 2008-07-19 02:10:48 94,920 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
+ 2008-10-16 18:09:44 92,696 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll
- 2008-07-19 02:09:44 563,912 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll
+ 2008-10-16 18:12:20 561,688 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll
- 2008-07-19 02:10:42 53,448 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
+ 2008-10-16 18:09:44 51,224 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe
- 2008-07-19 02:09:42 1,811,656 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
+ 2008-10-16 18:13:40 1,809,944 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll
- 2008-07-19 02:09:46 325,832 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll
+ 2008-10-16 18:12:22 323,608 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll
- 2008-07-19 02:10:20 36,552 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll
+ 2008-10-16 18:08:58 34,328 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll
- 2008-07-19 02:09:44 205,000 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll
+ 2008-10-16 18:13:40 202,776 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll
- 2008-11-05 02:08:04 59,780 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2002-07-25 05

54 59,780 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-11-05 02:08:04 397,560 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2002-07-25 05

54 397,560 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-10-16 18:08:58 34,328 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll
+ 2008-10-16 18:09:44 43,544 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-06 22:55 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 15:48 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 15:44 126976]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34 24576]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608]
"AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-02-13 22:25 684032]
"avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 11:24 266497]
"DXM6Patch_9904"="C:\WINDOWS\p_9904.exe" [1999-07-27 16:42 946448]
"QuickTime Task"="C:\my documents\QTTask.exe" [2008-05-27 09:50 413696]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
RollerCoaster Tycoon 3 Registration.lnk.disabled [2008-03-08 20:26:47 1478]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.MJPG"= m3jpeg32.dll
"vidc.dmb1"= m3jpeg32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Sierra On-Line\\SIGSPat.exe"=
"C:\\Program Files\\Comcast Rhapsody\\rhapsody.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\Program Files\\Atari\\RollerCoaster Tycoon 3 Platinum\\RCT3plus.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\WINDOWS\\system32\\dxdiag.exe"=
"C:\\WINDOWS\\system32\\dpnsvr.exe"=
"C:\\Program Files\\WarCommander\\WarCommander.exe"=
"C:\\Program Files\\Red Storm Entertainment\\Force 21\\Force21.exe"=
"C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\system32\\sessmgr.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"9420:TCP"= 9420:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface

R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 16:38 24652]
R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\ZDCNDIS5.sys [2006-08-17 10:03 19072]
S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2006-08-17 10:03 20608]
S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-25 10:32 27904]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73722e53-03de-11dd-82cb-0008a11ee0ee}]
\Shell\AutoRun\command - E:\RCAMemoryMgr.exe
\Shell\Manage your videos\command - E:\RCAMemoryMgr.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-11-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-Microsoft Works Update Detection - C:\Program Files\Microsoft Works\WkDetect.exe

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-12 04:43:58
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-11-12 4:45:33
ComboFix-quarantined-files.txt 2008-11-12 09:45:30
ComboFix2.txt 2008-11-05 02:14:22

Pre-Run: 53,718,937,600 bytes free
Post-Run: 53,706,039,296 bytes free

245 --- E O F --- 2008-10-15 07:04:43

and here is the latest hijack this scan.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:54:13 AM, on 11/12/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\trend micro\hijackthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [DXM6Patch_9904] C:\WINDOWS\p_9904.exe /Q:A
O4 - HKLM\..\Run: [QuickTime Task] "C:\my documents\QTTask.exe" -atboottime
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Search - ?p=ZJfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 5632 bytes

11-12-2008, 02:59 AM	#10 (permalink)
vinnie1543 Registered User Join Date: Oct 2008 Posts: 10 OS: XP Home	Re: Need help getting started Thanks for the nice thoughts and for your time and help (I don't think I can say thanks enough). The combo fix said it was successfully submitted for analysis ComboFix 08-11-11.01 - Owner 2008-11-12 4:41:23.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.886 [GMT -5:00] Running from: C:\Documents and Settings\Owner\Desktop\Combo-Fix.exe Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt * Created a new restore point FILE :: c:\documents and settings\All Users\Application Data\isoluwav.bin c:\documents and settings\All Users\Application Data\ramyxy.bin c:\Program Files\Common Files\cadimi._sy c:\Program Files\Common Files\cylulimy.bin c:\Program Files\Common Files\gyfijydo.db c:\Program Files\Common Files\ififezoxo.sys c:\Program Files\Common Files\pesykacu.exe c:\windows\agaloxyl.reg c:\windows\akifonuh.com c:\windows\codutaruq.vbs c:\windows\enys.bin c:\windows\fugenit.reg c:\windows\izegip.bin c:\windows\kozizoha._dl c:\windows\kulybiqi.pif c:\windows\qidybylo.bin c:\windows\system32\dywumap.com c:\windows\system32\fivacevo.lib c:\windows\system32\muribud.scr c:\windows\system32\nalymi.lib c:\windows\system32\nolukywoje.pif c:\windows\system32\runrefog.lnk c:\windows\vipyxewubi._sy c:\windows\ymym.bat c:\windows\ytegico.scr c:\windows\ziveqy.bin . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\All Users\Application Data\isoluwav.bin c:\documents and settings\All Users\Application Data\ramyxy.bin c:\documents and settings\Owner\Application Data\spam drive copy c:\Program Files\Common Files\cadimi._sy c:\Program Files\Common Files\cylulimy.bin c:\Program Files\Common Files\gyfijydo.db c:\Program Files\Common Files\ififezoxo.sys c:\Program Files\Common Files\pesykacu.exe c:\windows\agaloxyl.reg c:\windows\akifonuh.com c:\windows\codutaruq.vbs c:\windows\enys.bin c:\windows\fugenit.reg c:\windows\izegip.bin c:\windows\kozizoha._dl c:\windows\kulybiqi.pif c:\windows\qidybylo.bin c:\windows\system32\dywumap.com c:\windows\system32\fivacevo.lib c:\windows\system32\muribud.scr c:\windows\system32\nalymi.lib c:\windows\system32\nolukywoje.pif c:\windows\system32\runrefog.lnk c:\windows\vipyxewubi._sy c:\windows\ymym.bat c:\windows\ytegico.scr c:\windows\ziveqy.bin . ((((((((((((((((((((((((( Files Created from 2008-10-12 to 2008-11-12 ))))))))))))))))))))))))))))))) . 2008-11-03 21:18 . 2008-11-03 21:41 <DIR> d-------- C:\rsit 2008-11-03 21:18 . 2002-07-25 20:05 <DIR> d-------- C:\Program Files\trend micro 2008-10-26 13:43 . 2008-10-26 20:25 <DIR> d-------- C:\Program Files\Enigma Software Group 2008-10-26 08:16 . 2008-10-26 08:16 <DIR> d-------- C:\Program Files\Common Files\Download Manager 2008-10-25 20:57 . 2008-11-03 20:46 <DIR> d-------- C:\Documents and Settings\Other People\Incomplete 2008-10-25 11:15 . 2008-10-25 11:15 <DIR> d-------- C:\Program Files\SDHelper (Spybot - Search & Destroy) 2008-10-25 10:53 . 2008-10-25 10:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-10-25 10:52 . 2008-10-25 11:23 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-10-25 10:32 . 2008-10-25 10:32 27,904 --a------ C:\WINDOWS\system32\drivers\ndisprot.sys 2008-10-24 21:35 . 2008-10-24 21:35 <DIR> d-------- C:\Program Files\filehippo.com 2008-10-24 16:08 . 2008-10-15 11:34 337,408 --a------ C:\WINDOWS\system32\SET1E.tmp 2008-10-24 16:08 . 2008-10-15 11:34 337,408 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-14 15:26 . 2008-09-15 07:12 1,846,400 -----c--- C:\WINDOWS\system32\dllcache\win32k.sys 2008-10-14 15:26 . 2008-09-08 05:41 333,824 -----c--- C:\WINDOWS\system32\dllcache\srv.sys 2008-10-14 15:25 . 2008-08-14 05:11 2,189,184 -----c--- C:\WINDOWS\system32\dllcache\ntoskrnl.exe 2008-10-14 15:25 . 2008-08-14 05:09 2,145,280 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe 2008-10-14 15:25 . 2008-08-14 04:33 2,066,048 -----c--- C:\WINDOWS\system32\dllcache\ntkrnlpa.exe 2008-10-14 15:25 . 2008-08-14 04:33 2,023,936 -----c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-29 02:59 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire 2008-11-03 21:57 --------- d-----w C:\Documents and Settings\Other People\Application Data\Apple Computer 2008-10-26 13:37 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-10-23 20:13 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-23 20:13 --------- d-----w C:\Program Files\Philips 2008-10-23 20:06 --------- d-----w C:\Program Files\Atari 2008-10-23 20:03 --------- d-----w C:\Program Files\Red Storm Entertainment 2008-10-23 20:03 --------- d-----w C:\Program Files\GameSpy Arcade 2008-10-23 19:56 --------- d-----w C:\Program Files\Sierra 2008-10-23 18:26 --------- d-----w C:\Program Files\eMachineShop 2008-10-16 18:13 202,776 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-10-16 18:13 1,809,944 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-10-16 18:12 561,688 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-10-16 18:12 323,608 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-10-16 18:09 92,696 ----a-w C:\WINDOWS\system32\cdm.dll 2008-10-16 18:09 51,224 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-10-16 18:09 43,544 ----a-w C:\WINDOWS\system32\wups2.dll 2008-10-16 18:08 34,328 ----a-w C:\WINDOWS\system32\wups.dll 2008-10-16 18:06 268,648 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-10-16 18:06 208,744 ----a-w C:\WINDOWS\system32\muweb.dll 2008-10-09 03:54 --------- d-----w C:\Documents and Settings\Owner\Application Data\Viewpoint 2008-09-24 23:43 --------- d-----w C:\Program Files\Acoustic Labs Audio Editor (Demo) 2008-09-23 22:20 --------- d-----w C:\Program Files\MSECache 2008-09-23 21:22 --------- d-----w C:\Program Files\Ascentive 2008-09-23 21:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SKL 2008-09-23 21:17 --------- d-----w C:\Program Files\Common Files\Sony Shared 2008-09-23 07:00 --------- d-----w C:\Program Files\MSXML 4.0 2008-09-22 14:36 --------- d-----w C:\Program Files\HP PhotoSmart Printers 2008-09-22 00:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP 2008-09-22 00:58 --------- d-----w C:\Documents and Settings\Owner\Application Data\acccore 2008-09-22 00:57 --------- d-----w C:\Program Files\Viewpoint 2008-09-22 00:57 --------- d-----w C:\Program Files\AIM6 2008-09-22 00:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-09-22 00:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\acccore 2008-09-22 00:56 --------- d-----w C:\Program Files\Common Files\AOL 2008-09-22 00:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL 2008-09-15 12:12 1,846,400 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-26 17:57 43,520 ----a-w C:\WINDOWS\system32\CmdLineExt03.dll 2008-08-26 07:24 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 10:11 2,189,184 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 09:33 2,066,048 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2007-06-11 16:37 374 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb6334.dat 2007-06-10 23:24 538 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb8467.dat 2007-06-10 23:24 18,432 ----a-w C:\Documents and Settings\Owner\Application Data\internaldb41.dat 2002-07-25 23:10 30 ----a-w C:\Documents and Settings\Owner\jagex_runescape_preferences.dat . ((((((((((((((((((((((((((((( snapshot@2008-11-04_21.13.48.01 ))))))))))))))))))))))))))))))))))))))))) . - 2008-10-20 20:36:51 315,392 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl.dll + 2002-07-25 23:09:44 315,392 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl.dll - 2008-10-20 20:36:51 20,480 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl_awt.dll + 2002-07-25 23:09:44 20,480 ----a-w C:\WINDOWS\.file_store_32\runescape\jogl_awt.dll + 2008-11-28 23:11:51 11,346 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{F4E1D174-05F4-4DDF-99D1-68E431AD60D4}.bin - 2008-07-19 02:10:48 94,920 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll + 2008-10-16 18:09:44 92,696 -c--a-w C:\WINDOWS\system32\dllcache\cdm.dll - 2008-07-19 02:09:44 563,912 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll + 2008-10-16 18:12:20 561,688 -c--a-w C:\WINDOWS\system32\dllcache\wuapi.dll - 2008-07-19 02:10:42 53,448 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe + 2008-10-16 18:09:44 51,224 -c--a-w C:\WINDOWS\system32\dllcache\wuauclt.exe - 2008-07-19 02:09:42 1,811,656 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll + 2008-10-16 18:13:40 1,809,944 -c--a-w C:\WINDOWS\system32\dllcache\wuaueng.dll - 2008-07-19 02:09:46 325,832 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll + 2008-10-16 18:12:22 323,608 -c--a-w C:\WINDOWS\system32\dllcache\wucltui.dll - 2008-07-19 02:10:20 36,552 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll + 2008-10-16 18:08:58 34,328 -c--a-w C:\WINDOWS\system32\dllcache\wups.dll - 2008-07-19 02:09:44 205,000 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll + 2008-10-16 18:13:40 202,776 -c--a-w C:\WINDOWS\system32\dllcache\wuweb.dll - 2008-11-05 02:08:04 59,780 ----a-w C:\WINDOWS\system32\perfc009.dat + 2002-07-25 0554 59,780 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-11-05 02:08:04 397,560 ----a-w C:\WINDOWS\system32\perfh009.dat + 2002-07-25 0554 397,560 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-16 18:08:58 34,328 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll + 2008-10-16 18:09:44 43,544 ----a-w C:\WINDOWS\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2008-04-13 19:12 1695232] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-06 22:55 68856] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-21 15:48 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-21 15:44 126976] "WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34 24576] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 09:36 256576] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 02:43 83608] "AdaptecDirectCD"="C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2008-02-13 22:25 684032] "avgnt"="C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-19 11:24 266497] "DXM6Patch_9904"="C:\WINDOWS\p_9904.exe" [1999-07-27 16:42 946448] "QuickTime Task"="C:\my documents\QTTask.exe" [2008-05-27 09:50 413696] C:\Documents and Settings\Owner\Start Menu\Programs\Startup\ RollerCoaster Tycoon 3 Registration.lnk.disabled [2008-03-08 20:26:47 1478] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26 29696] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04 83360] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "ForceClassicControlPanel"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.MJPG"= m3jpeg32.dll "vidc.dmb1"= m3jpeg32.dll [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"= "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\Sierra On-Line\\SIGSPat.exe"= "C:\\Program Files\\Comcast Rhapsody\\rhapsody.exe"= "C:\\Program Files\\Mozilla Firefox\\firefox.exe"= "C:\\Program Files\\Atari\\RollerCoaster Tycoon 3 Platinum\\RCT3plus.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= "C:\\WINDOWS\\system32\\dxdiag.exe"= "C:\\WINDOWS\\system32\\dpnsvr.exe"= "C:\\Program Files\\WarCommander\\WarCommander.exe"= "C:\\Program Files\\Red Storm Entertainment\\Force 21\\Force21.exe"= "C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"= "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "C:\\Program Files\\AIM6\\aim6.exe"= "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "9420:TCP"= 9420:TCP:Akamai NetSession Interface "5000:UDP"= 5000:UDP:Akamai NetSession Interface R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 16:38 24652] R2 ZDCNDIS5;ZDCNDIS5 NDIS Protocol Driver;C:\WINDOWS\system32\ZDCNDIS5.sys [2006-08-17 10:03 19072] S3 BRGSp50;BRGSp50 NDIS Protocol Driver;C:\WINDOWS\system32\Drivers\BRGSp50.sys [2006-08-17 10:03 20608] S3 Ndisprot;ArcNet NDIS Protocol Driver;C:\WINDOWS\system32\drivers\Ndisprot.sys [2008-10-25 10:32 27904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73722e53-03de-11dd-82cb-0008a11ee0ee}] \Shell\AutoRun\command - E:\RCAMemoryMgr.exe \Shell\Manage your videos\command - E:\RCAMemoryMgr.exe Newly Created Service - CATCHME . Contents of the 'Scheduled Tasks' folder 2008-11-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Microsoft Works Update Detection - C:\Program Files\Microsoft Works\WkDetect.exe ************************************************************************ catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-12 04:43:58 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-11-12 4:45:33 ComboFix-quarantined-files.txt 2008-11-12 09:45:30 ComboFix2.txt 2008-11-05 02:14:22 Pre-Run: 53,718,937,600 bytes free Post-Run: 53,706,039,296 bytes free 245 --- E O F --- 2008-10-15 07:04:43 and here is the latest hijack this scan. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:54:13 AM, on 11/12/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\explorer.exe C:\Program Files\trend micro\hijackthis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://go.microsoft.com/fwlink/?LinkId=54843 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" O4 - HKLM\..\Run: [AdaptecDirectCD] C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [DXM6Patch_9904] C:\WINDOWS\p_9904.exe /Q:A O4 - HKLM\..\Run: [QuickTime Task] "C:\my documents\QTTask.exe" -atboottime O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - Startup: RollerCoaster Tycoon 3 Registration.lnk.disabled O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML O8 - Extra context menu item: &Search - ?p=ZJfox000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\WINDOWS\System32\shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramewor...o.cab56649.cab O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe -- End of file - 5632 bytes Last edited by tetonbob; 11-12-2008 at 07:59 AM.