Bluescreen Smithfraud infection, Help!

jawilsondesign · 04-07-2008, 02:22 AM

Hello, I have a PC crippling spyware problem. In the past any problem I’ve had was fixable with Spybot, Adaware or a spyware specialty agent. Anyway, since I’ve never used logs like this before, I’m a bit nervous that I might erase something important or generally screw something up. I have that nasty strain of smithfraud with the “fatal error” blue screen wallpaper. I’ve used both Spybot and SmithfraudFix in safe mode, following the directions to the letter 3X. This doesn’t even phase it. In case you are not familiar with this particular type of Smithfraud it’s the one that resets your wall paper with the message: Warning spyware has been detected on your PC, Click here to scan your PC for spyware. (Enough irony for all of us.) Every time Spybot erases the programs Smithfraud ****s for: 180 Search assistant, 1800 Soloutions, Zango, and about six others, it simply reinstalls them. I also get constant pop-ups for "Top rated spyware removers" and get redirected to ABC Search when I try to use google. I have downloaded Combofix but the complexities of its use require me to seek help. I am, of course, looking for some help, and it really will be much appreciated as I’m going out of my mind. Thanks.

(Ran twice and saw no “Extra.txt report”) Main:

Deckard's System Scanner v20071014.68
Run by HP_Administrator on 2008-04-07 02:07:40
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as HP_Administrator.exe) ------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 2:07:45 AM, on 4/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\wmsdkns.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Opera\Opera.exe
C:\Documents and Settings\HP_Administrator\Desktop\spyware crap\dss.exe
C:\DOCUME~1\HP_ADM~1\Desktop\INSTAL~1\HP_ADM~1.EXE

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file)
O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file)
O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file)
O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file)
O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file)
O2 - BHO: (no name) - {6047C7E3-7275-69AC-5365-5D00B8C58EB8} - C:\WINDOWS\system32\bqcqxnqg.dll (file missing)
O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll
O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file)
O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file)
O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file)
O2 - BHO: (no name) - {CF988033-AEAC-4703-B80E-47C4594492CA} - C:\WINDOWS\system32\jkkjj.dll (file missing)
O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file)
O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Stop-the-Pop-Up Lite\stopthepop.exe" -minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by135fd.bay135.hotmail.msn.co...s/MsnPUpld.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254
O17 - HKLM\System\CS1\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254
O17 - HKLM\System\CS2\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe

-- Files created between 2008-03-07 and 2008-04-07 -----------------------------

2008-04-06 07:54:45 28672 --a------ C:\WINDOWS\stcloader.exe
2008-04-06 07:54:45 20736 --a------ C:\WINDOWS\2020search2.dll
2008-04-06 07:54:45 10496 --a------ C:\WINDOWS\2020search.dll
2008-04-06 07:54:44 25856 --a------ C:\WINDOWS\updatetc.exe
2008-04-06 07:54:44 19712 --a------ C:\WINDOWS\system32\MSIXU.DLL
2008-04-06 07:54:44 0 d-------- C:\Program Files\zango
2008-04-06 07:54:44 0 d-------- C:\Program Files\seekmo
2008-04-06 07:54:44 0 d-------- C:\Program Files\180solutions
2008-04-06 07:54:44 0 d-------- C:\Program Files\180searchassistant
2008-04-06 07:54:43 0 d-------- C:\WINDOWS\FLEOK
2008-04-06 06:20:06 0 d-------- C:\Program Files\180search assistant
2008-04-06 05:56:49 0 d-------- C:\WINDOWS\CSC
2008-04-06 05:47:15 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-04-06 05:47:15 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-04-06 05:47:15 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-04-06 05:47:15 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-04-06 03:20:29 22016 --a------ C:\WINDOWS\system32\WER8274.DLL
2008-04-06 03:20:29 11520 --a------ C:\WINDOWS\salm.exe
2008-04-06 01:32:41 0 d-------- C:\Program Files\Lavasoft
2008-04-06 01:32:17 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-05 12:42:30 13824 --a------ C:\WINDOWS\mspphe.dll
2008-04-05 12:42:30 25856 --a------ C:\WINDOWS\cdsm32.dll
2008-04-05 12:42:30 14336 --a------ C:\WINDOWS\bokja.exe
2008-04-05 12:42:30 31232 --a------ C:\WINDOWS\bjam.dll
2008-04-05 12:07:39 19712 --a------ C:\WINDOWS\voiceip.dll
2008-04-05 12:07:39 25344 --a------ C:\WINDOWS\swin32.dll
2008-04-05 12:07:39 0 d-------- C:\Program Files\stc
2008-04-05 12:07:38 16640 --a------ C:\WINDOWS\mssvr.exe
2008-04-05 12:07:36 32512 --a------ C:\WINDOWS\180ax.exe
2008-04-05 12:07:35 26112 --a------ C:\WINDOWS\system32\MSNSA32.dll
2008-04-05 12:07:35 19968 --a------ C:\WINDOWS\saiemod.dll
2008-04-05 12:07:34 30720 --a------ C:\WINDOWS\msapasrc.dll
2008-04-05 12:07:34 11008 --a------ C:\WINDOWS\msa64chk.dll
2008-04-05 12:07:33 18688 --a------ C:\WINDOWS\system32\SIPSPI32.dll
2008-04-05 12:07:33 29184 --a------ C:\WINDOWS\system32\shdocpe.dll
2008-04-05 12:07:33 16640 --a------ C:\WINDOWS\system32\ntnut32.exe
2008-04-05 12:07:33 31232 --a------ C:\WINDOWS\shdocpl.dll
2008-04-05 12:07:33 8704 --a------ C:\WINDOWS\shdocpe.dll
2008-04-05 12:07:33 19200 --a------ C:\WINDOWS\ntnut.exe
2008-04-05 12:07:32 24064 --a------ C:\WINDOWS\winsb.dll
2008-04-05 12:07:32 16128 --a------ C:\WINDOWS\browserad.dll
2008-04-05 12:07:32 13568 --a------ C:\WINDOWS\aviwrap32.dll
2008-04-05 12:07:32 14080 --a------ C:\WINDOWS\avisynthex32.dll
2008-04-05 12:07:32 26112 --a------ C:\WINDOWS\avifile32.dll
2008-04-05 12:07:32 0 d-------- C:\Program Files\Sysmnt
2008-04-05 12:07:31 27136 --a------ C:\WINDOWS\autodisc32.dll
2008-04-05 12:07:31 30208 --a------ C:\WINDOWS\audiosrv32.dll
2008-04-05 12:07:31 16640 --a------ C:\WINDOWS\ati2dvag32.dll
2008-04-05 12:07:31 25600 --a------ C:\WINDOWS\ati2dvaa32.dll
2008-04-05 12:07:31 32000 --a------ C:\WINDOWS\athprxy32.dll
2008-04-05 12:07:30 23296 --a------ C:\WINDOWS\changeurl_30.dll
2008-04-05 12:07:30 11520 --a------ C:\WINDOWS\asycfilt32.dll
2008-04-05 12:07:30 26880 --a------ C:\WINDOWS\asferror32.dll
2008-04-05 12:07:30 26112 --a------ C:\WINDOWS\apphelp32.dll
2008-04-05 12:05:37 0 d--hs---- C:\WINDOWS\IA
2008-04-05 11:45:22 0 d-------- C:\Program Files\nvcoi
2008-04-05 11:40:20 0 d-------- C:\Program Files\CPV
2008-04-05 11:40:19 0 d-------- C:\Program Files\Temporary
2008-04-05 11:38:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2008-04-05 11:37:14 0 d-------- C:\Program Files\Outerinfo
2008-04-05 11:37:13 0 d-------- C:\Program Files\?racle
2008-04-05 11:37:12 0 d-------- C:\Program Files\Bat
2008-04-05 11:36:56 91561 --a------ C:\WINDOWS\system32\wmsdkns.exe <Not Verified; Microsoft; XML Media>
2008-04-05 11:36:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?dobe
2008-04-04 22:29:14 270694 --a------ C:\WINDOWS\system32\000090.exe
2008-04-03 05:12:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2008-04-03 05:11:57 0 d-------- C:\Program Files\Common Files\Adobe
2008-04-01 22:44:55 0 d-------- C:\Program Files\SunoSoft
2008-04-01 22:44:38 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller>
2008-03-13 04:00:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater

-- Find3M Report ---------------------------------------------------------------

2008-04-07 00:51:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\uTorrent
2008-04-06 09:27:58 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\AVG7
2008-04-06 08:05:15 1462 --a------ C:\WINDOWS\system32\tmp.reg
2008-04-06 01:32:17 0 d-------- C:\Program Files\Common Files
2008-04-05 18:38:58 0 d-------- C:\Program Files\?racle
2008-04-05 11:55:36 10 --a------ C:\Program Files\.autoreg
2008-04-05 11:52:34 0 d-------- C:\Program Files\LimeWire
2008-04-05 11:36:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?dobe
2008-03-26 06:43:26 187 --a------ C:\Documents and Settings\HP_Administrator\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
2008-03-14 01:21:50 0 d-------- C:\Program Files\Common Files\Real
2008-03-14 01:21:49 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Real
2008-03-13 05:00:15 0 d-------- C:\Program Files\Google
2008-03-13 04:01:41 0 d-------- C:\Program Files\Real
2008-02-18 22:49:53 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Adobe
2008-02-11 10:49:17 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\U3
2008-01-09 03:26:58 3100 --a------ C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6047C7E3-7275-69AC-5365-5D00B8C58EB8}]
C:\WINDOWS\system32\bqcqxnqg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}]
03/07/2008 09:15 PM 413696 --a------ C:\Program Files\Bat\Bat.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF988033-AEAC-4703-B80E-47C4594492CA}]
C:\WINDOWS\system32\jkkjj.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [12/22/2007 09:40 AM]
"sureshotpopupkiller"="C:\Program Files\Stop-the-Pop-Up Lite\stopthepop.exe" [10/27/2003 01:03 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/09/2004 09:00 PM]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/24/2007 04:30 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
"DisableTaskMgr"=1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"=1 (0x1)
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^IAccess.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\IAccess.lnk
backup=C:\WINDOWS\pss\IAccess.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk
backup=C:\WINDOWS\pss\Updates From HP.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^Bat - Auto Update.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\Bat - Auto Update.lnk
backup=C:\WINDOWS\pss\Bat - Auto Update.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^TA_Start.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^Think-Adz.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\Think-Adz.lnk
backup=C:\WINDOWS\pss\Think-Adz.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Think-Adz.lnk]
path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\Think-Adz.lnk
backup=C:\WINDOWS\pss\Think-Adz.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
C:\Program Files\DISC\DISCover.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager]
C:\Program Files\DISC\DiscUpdMgr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler]
"c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
C:\WINDOWS\system32\rwintndt.exe CHD003

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GPLv3]
rundll32.exe "C:\WINDOWS\system32\xqhebklk.dll",realset

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp]
"C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08]
c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore]
C:\Program Files\\JavaCore\\JavaCore.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kbp]
"C:\Program Files\?racle\l?gonui.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
%systemroot%\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows Installer]
C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\ie.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcoi]
C:\Program Files\nvcoi\nvcoi.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
"C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule15]
"C:\Program Files\QdrModule\QdrModule15.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule9]
"C:\Program Files\QdrModule\QdrModule9.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack9]
"C:\Program Files\QdrPack\QdrPack9.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
C:\WINDOWS\SMINST\RECGUARD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder]
"C:\Windows\Creator\Remind_XP.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc]
"C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
"C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1]
C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Scbu]
"C:\DOCUME~1\HP_ADM~1\APPLIC~1\DOBE~1\dvdplay.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w]
C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Windows\nnhuw.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"C:\Program Files\Winamp\Winampa.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch]
C:\Documents and Settings\HP_Administrator\Application Data\WinTouch\WinTouch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{B1-14-4D-D5-ZN}]
c:\windows\system32\msdsrngo.exe CHD003

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ERSvc"=2 (0x2)
"CryptSvc"=3 (0x3)
"wuauserv"=2 (0x2)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
AutoRun\command- J:\LaunchU3.exe -a

-- End of Deckard's System Scanner: finished at 2008-04-07 02:08:00 ------------

tetonbob · 04-10-2008, 01:26 PM

Hello, and welcome.

I see that you've stated you already downloaded ComboFix. This tool is frequently updated. So, please delete any existing copies you have, and then follow these instructions:

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

If you have any questions along the way, STOP and ask them before proceeding.

To produce an extra.txt:

Please run Deckard's System Scanner once again, this time using these instructions:

Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK

"C:\Documents and Settings\HP_Administrator\Desktop\spyware crap\dss.exe" /config

Click on "Check All"

Click on "Uncheck All"

On the right side, under Extra Log, check all except "Event Logs".

Click Scan!

When finished, it shall produce a log for you. Post that log in your next reply.

04-07-2008, 02:22 AM	#1 (permalink)
jawilsondesign Registered User Join Date: Apr 2008 Posts: 1 OS: windows xp	Bluescreen Smithfraud infection, Help! Hello, I have a PC crippling spyware problem. In the past any problem I’ve had was fixable with Spybot, Adaware or a spyware specialty agent. Anyway, since I’ve never used logs like this before, I’m a bit nervous that I might erase something important or generally screw something up. I have that nasty strain of smithfraud with the “fatal error” blue screen wallpaper. I’ve used both Spybot and SmithfraudFix in safe mode, following the directions to the letter 3X. This doesn’t even phase it. In case you are not familiar with this particular type of Smithfraud it’s the one that resets your wall paper with the message: Warning spyware has been detected on your PC, Click here to scan your PC for spyware. (Enough irony for all of us.) Every time Spybot erases the programs Smithfraud ***s for: 180 Search assistant, 1800 Soloutions, Zango, and about six others, it simply reinstalls them. I also get constant pop-ups for "Top rated spyware removers" and get redirected to ABC Search when I try to use google. I have downloaded Combofix but the complexities of its use require me to seek help. I am, of course, looking for some help, and it really will be much appreciated as I’m going out of my mind. Thanks. (Ran twice and saw no “Extra.txt report”) Main: Deckard's System Scanner v20071014.68 Run by HP_Administrator on 2008-04-07 02:07:40 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as HP_Administrator.exe) ------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 2:07:45 AM, on 4/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe C:\WINDOWS\system32\wmsdkns.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Opera\Opera.exe C:\Documents and Settings\HP_Administrator\Desktop\spyware crap\dss.exe C:\DOCUME~1\HP_ADM~1\Desktop\INSTAL~1\HP_ADM~1.EXE F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe, O2 - BHO: (no name) - {00000250-0320-4dd4-be4f-7566d2314352} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {13197ace-6851-45c3-a7ff-c281324d5489} - (no file) O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file) O2 - BHO: (no name) - {4e1075f4-eec4-4a86-add7-cd5f52858c31} - (no file) O2 - BHO: (no name) - {4e7bd74f-2b8d-469e-92c6-ce7eb590a94d} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: (no name) - {5929cd6e-2062-44a4-b2c5-2c7e78fbab38} - (no file) O2 - BHO: (no name) - {5dafd089-24b1-4c5e-bd42-8ca72550717b} - (no file) O2 - BHO: (no name) - {5fa6752a-c4a0-4222-88c2-928ae5ab4966} - (no file) O2 - BHO: (no name) - {6047C7E3-7275-69AC-5365-5D00B8C58EB8} - C:\WINDOWS\system32\bqcqxnqg.dll (file missing) O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file) O2 - BHO: BatBHO - {63F7460B-C831-4142-A4AA-5EC303EC4343} - C:\Program Files\Bat\Bat.dll O2 - BHO: (no name) - {8674aea0-9d3d-11d9-99dc-00600f9a01f1} - (no file) O2 - BHO: (no name) - {965a592f-8efa-4250-8630-7960230792f1} - (no file) O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file) O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: HpWebHelper - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll O2 - BHO: (no name) - {cf021f40-3e14-23a5-cba2-717765728274} - (no file) O2 - BHO: (no name) - {CF988033-AEAC-4703-B80E-47C4594492CA} - C:\WINDOWS\system32\jkkjj.dll (file missing) O2 - BHO: (no name) - {fc3a74e5-f281-4f10-ae1e-733078684f3c} - (no file) O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Stop-the-Pop-Up Lite\stopthepop.exe" -minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by135fd.bay135.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://go.divx.com/plugin/DivXBrowserPlugin.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254 O17 - HKLM\System\CS1\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254 O17 - HKLM\System\CS2\Services\Tcpip\..\{141E5FB3-6D27-4B5F-8F72-425888ADE0C8}: NameServer = 192.168.1.254 O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe O23 - Service: Intel® Quick Resume Technology Drivers (ELService) - Intel Corporation - C:\Program Files\Intel\IntelDH\Intel(R) Quick Resume Technology\ELService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe -- Files created between 2008-03-07 and 2008-04-07 ----------------------------- 2008-04-06 07:54:45 28672 --a------ C:\WINDOWS\stcloader.exe 2008-04-06 07:54:45 20736 --a------ C:\WINDOWS\2020search2.dll 2008-04-06 07:54:45 10496 --a------ C:\WINDOWS\2020search.dll 2008-04-06 07:54:44 25856 --a------ C:\WINDOWS\updatetc.exe 2008-04-06 07:54:44 19712 --a------ C:\WINDOWS\system32\MSIXU.DLL 2008-04-06 07:54:44 0 d-------- C:\Program Files\zango 2008-04-06 07:54:44 0 d-------- C:\Program Files\seekmo 2008-04-06 07:54:44 0 d-------- C:\Program Files\180solutions 2008-04-06 07:54:44 0 d-------- C:\Program Files\180searchassistant 2008-04-06 07:54:43 0 d-------- C:\WINDOWS\FLEOK 2008-04-06 06:20:06 0 d-------- C:\Program Files\180search assistant 2008-04-06 05:56:49 0 d-------- C:\WINDOWS\CSC 2008-04-06 05:47:15 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-04-06 05:47:15 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; > 2008-04-06 05:47:15 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix> 2008-04-06 05:47:15 82432 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix> 2008-04-06 03:20:29 22016 --a------ C:\WINDOWS\system32\WER8274.DLL 2008-04-06 03:20:29 11520 --a------ C:\WINDOWS\salm.exe 2008-04-06 01:32:41 0 d-------- C:\Program Files\Lavasoft 2008-04-06 01:32:17 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-04-05 12:42:30 13824 --a------ C:\WINDOWS\mspphe.dll 2008-04-05 12:42:30 25856 --a------ C:\WINDOWS\cdsm32.dll 2008-04-05 12:42:30 14336 --a------ C:\WINDOWS\bokja.exe 2008-04-05 12:42:30 31232 --a------ C:\WINDOWS\bjam.dll 2008-04-05 12:07:39 19712 --a------ C:\WINDOWS\voiceip.dll 2008-04-05 12:07:39 25344 --a------ C:\WINDOWS\swin32.dll 2008-04-05 12:07:39 0 d-------- C:\Program Files\stc 2008-04-05 12:07:38 16640 --a------ C:\WINDOWS\mssvr.exe 2008-04-05 12:07:36 32512 --a------ C:\WINDOWS\180ax.exe 2008-04-05 12:07:35 26112 --a------ C:\WINDOWS\system32\MSNSA32.dll 2008-04-05 12:07:35 19968 --a------ C:\WINDOWS\saiemod.dll 2008-04-05 12:07:34 30720 --a------ C:\WINDOWS\msapasrc.dll 2008-04-05 12:07:34 11008 --a------ C:\WINDOWS\msa64chk.dll 2008-04-05 12:07:33 18688 --a------ C:\WINDOWS\system32\SIPSPI32.dll 2008-04-05 12:07:33 29184 --a------ C:\WINDOWS\system32\shdocpe.dll 2008-04-05 12:07:33 16640 --a------ C:\WINDOWS\system32\ntnut32.exe 2008-04-05 12:07:33 31232 --a------ C:\WINDOWS\shdocpl.dll 2008-04-05 12:07:33 8704 --a------ C:\WINDOWS\shdocpe.dll 2008-04-05 12:07:33 19200 --a------ C:\WINDOWS\ntnut.exe 2008-04-05 12:07:32 24064 --a------ C:\WINDOWS\winsb.dll 2008-04-05 12:07:32 16128 --a------ C:\WINDOWS\browserad.dll 2008-04-05 12:07:32 13568 --a------ C:\WINDOWS\aviwrap32.dll 2008-04-05 12:07:32 14080 --a------ C:\WINDOWS\avisynthex32.dll 2008-04-05 12:07:32 26112 --a------ C:\WINDOWS\avifile32.dll 2008-04-05 12:07:32 0 d-------- C:\Program Files\Sysmnt 2008-04-05 12:07:31 27136 --a------ C:\WINDOWS\autodisc32.dll 2008-04-05 12:07:31 30208 --a------ C:\WINDOWS\audiosrv32.dll 2008-04-05 12:07:31 16640 --a------ C:\WINDOWS\ati2dvag32.dll 2008-04-05 12:07:31 25600 --a------ C:\WINDOWS\ati2dvaa32.dll 2008-04-05 12:07:31 32000 --a------ C:\WINDOWS\athprxy32.dll 2008-04-05 12:07:30 23296 --a------ C:\WINDOWS\changeurl_30.dll 2008-04-05 12:07:30 11520 --a------ C:\WINDOWS\asycfilt32.dll 2008-04-05 12:07:30 26880 --a------ C:\WINDOWS\asferror32.dll 2008-04-05 12:07:30 26112 --a------ C:\WINDOWS\apphelp32.dll 2008-04-05 12:05:37 0 d--hs---- C:\WINDOWS\IA 2008-04-05 11:45:22 0 d-------- C:\Program Files\nvcoi 2008-04-05 11:40:20 0 d-------- C:\Program Files\CPV 2008-04-05 11:40:19 0 d-------- C:\Program Files\Temporary 2008-04-05 11:38:45 0 d-------- C:\Documents and Settings\All Users\Application Data\Rabio 2008-04-05 11:37:14 0 d-------- C:\Program Files\Outerinfo 2008-04-05 11:37:13 0 d-------- C:\Program Files\?racle 2008-04-05 11:37:12 0 d-------- C:\Program Files\Bat 2008-04-05 11:36:56 91561 --a------ C:\WINDOWS\system32\wmsdkns.exe <Not Verified; Microsoft; XML Media> 2008-04-05 11:36:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?dobe 2008-04-04 22:29:14 270694 --a------ C:\WINDOWS\system32\000090.exe 2008-04-03 05:12:01 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe 2008-04-03 05:11:57 0 d-------- C:\Program Files\Common Files\Adobe 2008-04-01 22:44:55 0 d-------- C:\Program Files\SunoSoft 2008-04-01 22:44:38 299520 --a------ C:\WINDOWS\uninst.exe <Not Verified; InstallShield Corporation, Inc.; InstallShield unInstaller> 2008-03-13 04:00:04 0 d-------- C:\Documents and Settings\All Users\Application Data\Google Updater -- Find3M Report --------------------------------------------------------------- 2008-04-07 00:51:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\uTorrent 2008-04-06 09:27:58 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\AVG7 2008-04-06 08:05:15 1462 --a------ C:\WINDOWS\system32\tmp.reg 2008-04-06 01:32:17 0 d-------- C:\Program Files\Common Files 2008-04-05 18:38:58 0 d-------- C:\Program Files\?racle 2008-04-05 11:55:36 10 --a------ C:\Program Files\.autoreg 2008-04-05 11:52:34 0 d-------- C:\Program Files\LimeWire 2008-04-05 11:36:56 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\?dobe 2008-03-26 06:43:26 187 --a------ C:\Documents and Settings\HP_Administrator\Application Data\G-Force Prefs (WindowsMediaPlayer).txt 2008-03-14 01:21:50 0 d-------- C:\Program Files\Common Files\Real 2008-03-14 01:21:49 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Real 2008-03-13 05:00:15 0 d-------- C:\Program Files\Google 2008-03-13 04:01:41 0 d-------- C:\Program Files\Real 2008-02-18 22:49:53 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\Adobe 2008-02-11 10:49:17 0 d-------- C:\Documents and Settings\HP_Administrator\Application Data\U3 2008-01-09 03:26:58 3100 --a------ C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat -- Registry Dump --------------------------------------------------------------- Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{00000250-0320-4dd4-be4f-7566d2314352}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13197ace-6851-45c3-a7ff-c281324d5489}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15651c7c-e812-44a2-a9ac-b467a2233e7d}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e1075f4-eec4-4a86-add7-cd5f52858c31}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4e7bd74f-2b8d-469e-92c6-ce7eb590a94d}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5929cd6e-2062-44a4-b2c5-2c7e78fbab38}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5dafd089-24b1-4c5e-bd42-8ca72550717b}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5fa6752a-c4a0-4222-88c2-928ae5ab4966}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6047C7E3-7275-69AC-5365-5D00B8C58EB8}] C:\WINDOWS\system32\bqcqxnqg.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{622cc208-b014-4fe0-801b-874a5e5e403a}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63F7460B-C831-4142-A4AA-5EC303EC4343}] 03/07/2008 09:15 PM 413696 --a------ C:\Program Files\Bat\Bat.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8674aea0-9d3d-11d9-99dc-00600f9a01f1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{965a592f-8efa-4250-8630-7960230792f1}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9c5b2f29-1f46-4639-a6b4-828942301d3e}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cf021f40-3e14-23a5-cba2-717765728274}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF988033-AEAC-4703-B80E-47C4594492CA}] C:\WINDOWS\system32\jkkjj.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{fc3a74e5-f281-4f10-ae1e-733078684f3c}] [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [12/22/2007 09:40 AM] "sureshotpopupkiller"="C:\Program Files\Stop-the-Pop-Up Lite\stopthepop.exe" [10/27/2003 01:03 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/09/2004 09:00 PM] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/24/2007 04:30 PM] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme "DisableTaskMgr"=1 (0x1) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"=1 (0x1) "disableregistrytools"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon] "Userinit"="C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe," [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^IAccess.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\IAccess.lnk backup=C:\WINDOWS\pss\IAccess.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates From HP.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates From HP.lnk backup=C:\WINDOWS\pss\Updates From HP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^Bat - Auto Update.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\Bat - Auto Update.lnk backup=C:\WINDOWS\pss\Bat - Auto Update.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^TA_Start.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\TA_Start.lnk backup=C:\WINDOWS\pss\TA_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Accessories^Startup^Think-Adz.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Accessories\Startup\Think-Adz.lnk backup=C:\WINDOWS\pss\Think-Adz.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^TA_Start.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\TA_Start.lnk backup=C:\WINDOWS\pss\TA_Start.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^HP_Administrator^Start Menu^Programs^Startup^Think-Adz.lnk] path=C:\Documents and Settings\HP_Administrator\Start Menu\Programs\Startup\Think-Adz.lnk backup=C:\WINDOWS\pss\Think-Adz.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover] C:\Program Files\DISC\DISCover.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiscUpdateManager] C:\Program Files\DISC\DiscUpdMgr.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMAScheduler] "c:\Program Files\HP DigitalMedia Archive\DMAScheduler.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray] C:\WINDOWS\ehome\ehtray.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched] C:\WINDOWS\system32\rwintndt.exe CHD003 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GPLv3] rundll32.exe "C:\WINDOWS\system32\xqhebklk.dll",realset [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers] C:\WINDOWS\system32\igfxpers.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JavaCore] C:\Program Files\\JavaCore\\JavaCore.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kbp] "C:\Program Files\?racle\l?gonui.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck] %systemroot%\system32\dumprep 0 -k [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Windows Installer] C:\DOCUME~1\HP_ADM~1\LOCALS~1\Temp\ie.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nvcoi] C:\Program Files\nvcoi\nvcoi.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrModule9] "C:\Program Files\QdrModule\QdrModule9.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack9] "C:\Program Files\QdrPack\QdrPack9.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reminder] "C:\Windows\Creator\Remind_XP.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL] RTHDCPL.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Scbu] "C:\DOCUME~1\HP_ADM~1\APPLIC~1\DOBE~1\dvdplay.exe" -vt yazb [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w] C:\Documents and Settings\HP_Administrator\Application Data\Microsoft\Windows\nnhuw.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] "C:\Program Files\Winamp\Winampa.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch] C:\Documents and Settings\HP_Administrator\Application Data\WinTouch\WinTouch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{B1-14-4D-D5-ZN}] c:\windows\system32\msdsrngo.exe CHD003 [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ERSvc"=2 (0x2) "CryptSvc"=3 (0x3) "wuauserv"=2 (0x2) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J] AutoRun\command- J:\LaunchU3.exe -a -- End of Deckard's System Scanner: finished at 2008-04-07 02:08:00 ------------

04-10-2008, 01:26 PM	#2 (permalink)
tetonbob Manager, Security Center, TSF Academy; Analyst, Security Team Join Date: Jan 2005 Location: Transylvania County, North Carolina, USA Posts: 23,729 OS: 2000 Pro; XP Pro; XP Home	Re: Bluescreen Smithfraud infection, Help! Hello, and welcome. I see that you've stated you already downloaded ComboFix. This tool is frequently updated. So, please delete any existing copies you have, and then follow these instructions: Please visit this webpage for instructions for downloading and running ComboFix: http://www.bleepingcomputer.com/comb...o-use-combofix Please ensure you read this guide carefully and install the Recovery Console first. The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. Post the log from ComboFix when you've accomplished that, along with a new HijackThis log. If you have any questions along the way, STOP and ask them before proceeding. To produce an extra.txt: Please run Deckard's System Scanner once again, this time using these instructions: Click the Windows 'Start' button > Select 'Run' - then copy/paste this into the run box & click OK "C:\Documents and Settings\HP_Administrator\Desktop\spyware crap\dss.exe" /config Click on "Check All" Click on "Uncheck All" On the right side, under Extra Log, check all except "Event Logs". Click Scan! When finished, it shall produce a log for you. Post that log in your next reply. __________________ Practice Safe Surfing PC Safety and Security--What Do I Need? Proud Member of ASAP since 2005 Proud Member of UNITE since 2006 Our help is voluntary, but this site needs donations to operate. Please consider Donating to the Forum. Please do not ask for help via Private Message. Ask in the forums, so all may gain from the experience.