QueenDawn1

here is my hijack this log..........

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:20 PM, on 5/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\QuickTime\bak\qttask.exe
C:\WINDOWS\LOGI_MWX.EXE
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\HJT\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
O2 - BHO: {f53af9ea-46ac-8878-3884-204712e73f53} - {35f37e21-7402-4883-8788-ca64ae9fa35f} - C:\WINDOWS\system32\jdqujcjj.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {B3102264-D09D-4322-B625-503FBF18DD7E} - C:\WINDOWS\system32\awtrRKBr.dll (file missing)
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\bak\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Logitech Utility] LOGI_MWX.EXE
O4 - HKLM\..\Run: [zzzHPSETUP] D:\Setup.exe \RESET
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\PROGRA~1\Symantec\osCheck.exe"
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe (User 'Default user')
O4 - Startup: TrueAssistant.lnk = C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - ?p=ZU
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O15 - Trusted Zone: *.olivegarden.com
O16 - DPF: {01012101-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Script Runner Class) - http://www.comcastsupport.com/sdcxuser/asp/tgctlsr.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Hidden%20Relics/Images/stg_drm.ocx
O16 - DPF: {2A510DC8-C9B5-4269-B9BA-E5B04D47D981} (CPlayFirstDDSonicControl Object) - http://www.shockwave.com/content/din...c.1.0.0.92.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) - http://webiq005.webiqonline.com/WebIQ/DataServer/Pub/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
O16 - DPF: {352797A0-EFD0-4FA6-B229-145120EA4B8A} (Walt Disney Internet Group Hardware Control) - https://disneyblast.go.com/v3/setup/...areControl.cab
O16 - DPF: {3FE16C08-D6A7-4133-84FC-D5BFB4F7D886} (WebGameLoader Class) - http://zone.msn.com/bingame/rtlw/def...GameLoader.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1146266670413
O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/def...jolauncher.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - file://C:\TempEI4\EI40_\msxml4.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6...ws-i586-jc.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab34246.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/sh...26/mcgdmgr.cab
O16 - DPF: {C52439A0-2693-4E40-B141-9F9AD5257241} (Lexmark eDiagnostics Class) - https://ediagnostics.lexmark.com/serval.cab
O16 - DPF: {CC32D4D8-2A0B-4CEB-B105-C9B968379105} (CGameManagerCtrl Object) - https://disney.go.com/games/download...ameManager.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file:///C:/Program%20Files/Turbo%20Pizza/Images/armhelper.ocx
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/G...onGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {D71F9A27-723E-4B8B-B428-B725E47CBA3E} (Imikimi_activex_plugin Control) - http://imikimi.com/download/imikimi_plugin.cab
O16 - DPF: {DC75FEF6-165D-4D25-A518-C8C4BDA7BAA6} (CPlayFirstDinerDashControl Object) - http://comcast.oberon-media.com/onli...h.1.0.0.80.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/is...35/mcfscan.cab
O21 - SSODL: incestuously - {03413bf7-e34c-445b-bfc0-a2b127255871} - (no file)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\PROGRA~1\Symantec\isPwdSvc.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 14874 bytes

Pancake

Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.


O2 - BHO: (no name) - {15651c7c-e812-44a2-a9ac-b467a2233e7d} - (no file)
O2 - BHO: {f53af9ea-46ac-8878-3884-204712e73f53} - {35f37e21-7402-4883-8788-ca64ae9fa35f} - C:\WINDOWS\system32\jdqujcjj.dll
O2 - BHO: (no name) - {622cc208-b014-4fe0-801b-874a5e5e403a} - (no file)
O2 - BHO: (no name) - {9c5b2f29-1f46-4639-a6b4-828942301d3e} - (no file)
O2 - BHO: (no name) - {B3102264-D09D-4322-B625-503FBF18DD7E} - C:\WINDOWS\system32\awtrRKBr.dll (file missing)
O2 - BHO: (no name) - {ffff0001-0002-101a-a3c9-08002b2f49fb} - (no file)
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)

Reboot...........................

=====================================

Ok.We need to download ComboFix.exe. This will give me a better view to the files that are running and also the ones that are hidden on your computer.

Please visit this webpage for download links, and instructions for running ComboFix


When the tool is finished, it will produce a report for you. Please copy and paste the "C:\ComboFix.txt" along with a new 'HijackThis' log so that we can continue to do any further cleaning that your system may require.

Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Mal use can cause serious computer problems

NOTE: Combofix prevents autorun of all CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you - please let me know.

__________________

QueenDawn1

Ok did the hijack this stuff and combo fix below are the logs..........also quick question I was told that there are a bunch of back doors on my computer and I should wipe the hard drive and start over.......are you seeing these and what is our thoughts on this? Thanks


ComboFix 08-05-08.1 - Dawn 2008-05-09 11:42:39.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.597 [GMT -4:00]
Running from: C:\Documents and Settings\Dawn\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dawn\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\123messenger.per
C:\WINDOWS\apphelp32.dll
C:\WINDOWS\asferror32.dll
C:\WINDOWS\asycfilt32.dll
C:\WINDOWS\athprxy32.dll
C:\WINDOWS\ati2dvaa32.dll
C:\WINDOWS\ati2dvag32.dll
C:\WINDOWS\audiosrv32.dll
C:\WINDOWS\autodisc32.dll
C:\WINDOWS\avifile32.dll
C:\WINDOWS\avisynthex32.dll
C:\WINDOWS\aviwrap32.dll
C:\WINDOWS\bjam.dll
C:\WINDOWS\browserad.dll
C:\WINDOWS\cdsm32.dll
C:\WINDOWS\changeurl_30.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\system
C:\WINDOWS\licencia.txt
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\msa64chk.dll
C:\WINDOWS\msapasrc.dll
C:\WINDOWS\mspphe.dll
C:\WINDOWS\mssvr.exe
C:\WINDOWS\muotr.so
C:\WINDOWS\ntnut.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\saiemod.dll
C:\WINDOWS\shdocpe.dll
C:\WINDOWS\shdocpl.dll
C:\WINDOWS\swin32.dll
C:\WINDOWS\system32\gjjte.cfg
C:\WINDOWS\system32\gmnait.cfg
C:\WINDOWS\system32\hsseabhy.ini
C:\WINDOWS\system32\jyjlt.cfg
C:\WINDOWS\system32\kmd.exe
C:\WINDOWS\system32\mupxryhm.ini
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\ututv.ini
C:\WINDOWS\system32\uwDffMoq.ini
C:\WINDOWS\system32\uwDffMoq.ini2
C:\WINDOWS\system32\winfrun32.bin
C:\WINDOWS\system32\xgnfn.cfg
C:\WINDOWS\system32\zgxfdx.dll.LoG
C:\WINDOWS\telefonos.txt
C:\WINDOWS\textos.txt
C:\WINDOWS\Update.dat
C:\WINDOWS\voiceip.dll
C:\WINDOWS\winsb.dll

----- BITS: Possible infected sites -----

hxxp://80.93.48.74
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Service_clbdriver


((((((((((((((((((((((((( Files Created from 2008-04-09 to 2008-05-09 )))))))))))))))))))))))))))))))
.

2008-05-07 10:30 . 2008-05-07 10:30 <DIR> d-------- C:\Program Files\Panda Security
2008-05-05 21:11 . 2008-05-05 21:11 <DIR> d-------- C:\Documents and Settings\Dawn\Application Data\Grisoft
2008-05-05 21:11 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-05-05 09:57 . 2008-05-06 09:58 109,430 --a------ C:\WINDOWS\BM33ccc471.xml
2008-05-04 16:15 . 2008-05-04 16:15 <DIR> d-------- C:\Deckard
2008-05-04 15:19 . 2002-08-29 08:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-05-04 15:18 . 2008-05-05 12:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-04 15:18 . 2008-05-04 15:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-03 23:43 . 2008-05-04 13:06 <DIR> d-------- C:\Program Files\Family Feud III - Dream Home
2008-04-30 16:45 . 2008-04-30 18:35 <DIR> d-------- C:\Program Files\Brainiversity
2008-04-25 13:25 . 2008-04-25 13:25 <DIR> d-------- C:\Documents and Settings\Dawn\Application Data\Jane s Hotel Family Hero
2008-04-20 15:07 . 2008-04-20 15:07 280 --ahs---- C:\WINDOWS\system32\rdthr.cfg
2008-04-20 15:06 . 2008-04-20 15:08 4,530 --a------ C:\WINDOWS\system32\atielf.dat
2008-04-19 21:56 . 2008-04-19 21:57 <DIR> d-------- C:\Program Files\Build-a-lot 2 - Town of the Year
2008-04-12 23:22 . 2008-04-12 23:23 <DIR> d-------- C:\Program Files\Cooking Academy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-09 15:51 --------- d-----w C:\Program Files\TrueSwitchAT&TYahoo
2008-05-09 13:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-08 17:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-06 20:51 --------- d-----w C:\Program Files\Norton Security Scan
2008-05-06 15:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-06 14:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-05 20:35 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Lavasoft
2008-04-29 00:59 --------- d-----w C:\Program Files\LimeWire
2008-04-25 17:24 --------- d-----w C:\Program Files\Yahoo! Games
2008-04-20 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\HipSoft
2008-04-13 03:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fugazo
2008-04-13 03:10 --------- d-----w C:\Program Files\bfgclient
2008-03-31 21:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Astar Games
2008-03-30 19:39 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Boomzap
2008-03-24 22:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-23 23:33 --------- d-----w C:\Program Files\Doggie Dash
2008-03-23 23:33 --------- d-----w C:\Documents and Settings\Dawn\Application Data\PlayFirst
2008-03-23 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-03-21 23:24 --------- d-----w C:\Program Files\Escape From Paradise
2008-03-21 23:24 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Meridian93
2008-03-14 21:29 --------- d-----w C:\Program Files\RealArcade
2008-03-09 02:19 --------- d-----w C:\Documents and Settings\Dawn\Application Data\cerasus.media
2008-03-03 01:33 0 ----a-w C:\Program Files\temp01
2007-01-31 22:10 56 --sh--r C:\WINDOWS\system32\09E8528788.sys
2007-01-31 22:10 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2002-08-29 08:00 13312 414de7cf9d3f19c3ea902f1bb38ec116 C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe
2004-08-04 03:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
2004-08-04 03:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\bak\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 187 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\0.dat

-c--a-w 867 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\1.dat

-c--a-w 944 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\10.dat

-c--a-w 1,154 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\11.dat

-c--a-w 760 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\12.dat

-c--a-w 865 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\13.dat

-c--a-w 1,447 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\14.dat

-c--a-w 1,247 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\15.dat

-c--a-w 900 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\16.dat

-c--a-w 1,218 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\17.dat

-c--a-w 424 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\18.dat

-c--a-w 970 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\19.dat

-c--a-w 978 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\2.dat

-c--a-w 1,092 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\20.dat

-c--a-w 810 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\21.dat

-c--a-w 611 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\22.dat

-c--a-w 949 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\23.dat

-c--a-w 1,058 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\24.dat

-c--a-w 384 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\25.dat

-c--a-w 1,346 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\26.dat

-c--a-w 244 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\27.dat

-c--a-w 1,676 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\28.dat

-c--a-w 1,326 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\29.dat

-c--a-w 89 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\3.dat

-c--a-w 364 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\30.dat

-c--a-w 875 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\31.dat

-c--a-w 941 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\32.dat

-c--a-w 424 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\33.dat

-c--a-w 104 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\34.dat

-c--a-w 421 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\35.dat

-c--a-w 1,178 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\36.dat

-c--a-w 1,078 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\37.dat

-c--a-w 1,132 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\38.dat

-c--a-w 1,073 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\4.dat

-c--a-w 1,167 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\5.dat

-c--a-w 672 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\6.dat

-c--a-w 432 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\7.dat

-c--a-w 600 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\8.dat

-c--a-w 1,037 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\9.dat

-c--a-w 901 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\offsets.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\0.dat

-c--a-w 736 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\1.dat

-c--a-w 1,509 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\10.dat

-c--a-w 1,582 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\11.dat

-c--a-w 651 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\12.dat

-c--a-w 1,579 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\13.dat

-c--a-w 2,365 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\14.dat

-c--a-w 1,229 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\15.dat

-c--a-w 2,413 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\16.dat

-c--a-w 2,427 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\17.dat

-c--a-w 1,762 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\18.dat

-c--a-w 935 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\19.dat

-c--a-w 274 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\2.dat

-c--a-w 1,273 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\20.dat

-c--a-w 1,867 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\21.dat

-c--a-w 804 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\22.dat

-c--a-w 682 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\23.dat

-c--a-w 1,770 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\24.dat

-c--a-w 789 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\25.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\26.dat

-c--a-w 2,309 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\27.dat

-c--a-w 1,105 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\28.dat

-c--a-w 2,082 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\29.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\3.dat

-c--a-w 1,787 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\30.dat

-c--a-w 1,654 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\31.dat

-c--a-w 841 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\32.dat

-c--a-w 2,671 2006-08-08 02:33:33 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\33.dat

-c--a-w 1,826 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\34.dat

-c--a-w 903 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\35.dat

-c--a-w 835 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\36.dat

-c--a-w 2,172 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\37.dat

-c--a-w 1,491 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\38.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\39.dat

-c--a-w 1,055 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\4.dat

-c--a-w 1,878 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\40.dat

-c--a-w 173 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\41.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\42.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\5.dat

-c--a-w 1,760 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\6.dat

-c--a-w 1,701 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\7.dat

-c--a-w 948 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\8.dat

-c--a-w 1,108 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\9.dat

-c--a-w 1,005 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\offsets.dat

-c--a-w 131,057 2007-10-16 00:57:32 C:\Program Files\Ahead\InCD\bak\Error.log
-c--a-w 127,746 2007-09-27 14:48:17 C:\Program Files\Ahead\InCD\Error.log

-c--a-w 1,269,870 2004-02-27 15:02:32 C:\Program Files\Ahead\InCD\bak\InCD.exe

-c--a-w 2,321,600 2007-06-09 21:31:05 C:\Program Files\Common Files\Adobe\Updater5\bak\AdobeUpdater.exe

-c--a-w 50,792 2005-11-03 03:01:14 C:\Program Files\Common Files\AOL\1124841373\ee\bak\AOLSoftware.exe

-c--a-w 180,269 2006-11-11 23:31:46 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

-c--a-w 59,040 2006-04-13 18:20:52 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe
----a-w 115,816 2007-01-10 05:59:52 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

----a-w 6,731,312 2007-06-11 09:25:42 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe
----a-w 6,731,312 2007-06-11 09:25:42 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

----a-w 83,608 2007-03-14 07:43:44 C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe

----a-w 387,584 2005-01-28 10:23:22 C:\Program Files\Labtec\Media Keyboard\V5.0\bak\KbdAp32A.exe

----a-w 802,816 2006-06-23 17:45:35 C:\Program Files\Labtec\Mouse\2.1\bak\moffice.exe

-c--a-w 86,100 2003-03-04 12:49:22 C:\Program Files\Lexmark X5100 Series\bak\lxbabmgr.exe

----a-w 274,432 2005-09-16 13:43:06 C:\Program Files\LimeWire\bak\iTunesHelper.exe

-c--a-w 631,362 2002-11-23 07:15:00 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 155,648 2005-12-25 18:44:09 C:\Program Files\QuickTime\bak\qttask.exe

----a-w 100,056 2006-11-09 17:28:44 C:\Program Files\SymNetDrv\bak\SNDMon.exe

----a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\bak\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-11 21:19 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"QuickTime Task"="C:\Program Files\QuickTime\bak\qttask.exe" [2005-12-25 14:44 155648]
"Logitech Utility"="LOGI_MWX.EXE" [2002-11-08 05:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"zzzHPSETUP"="D:\Setup.exe" [ ]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 20:51 583048]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 16:42 509224]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 03:11 771704]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19 129536]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-07 03:33 8720384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\Dawn\Start Menu\Programs\Startup\
TrueAssistant.lnk - C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe [2007-09-13 08:45:20 1028096]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-01-19 22:28:34 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPEG"= JPEGCODE.DLL
"VIDC.MJPG"= JPEGCODE.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 SGUARD;SGUARD;C:\WINDOWS\system32\drivers\SGuard.sys []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-08 02:55:44 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Dawn.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exe
"2008-05-02 19:17:51 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe)/scan-full /scheduleignorenav /scheduled&C:\Program Files\Norton Security Scan
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-09 11:51:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
.
**************************************************************************
.
Completion time: 2008-05-09 12:15:27 - machine was rebooted [Dawn]
ComboFix-quarantined-files.txt 2008-05-09 16:15:19
ComboFix2.txt 2008-02-29 15:50:53
ComboFix3.txt 2008-02-28 23:40:49
ComboFix4.txt 2008-02-28 22:36:23
ComboFix5.txt 2007-10-07 21:10:17

Pre-Run: 66,881,163,264 bytes free
Post-Run: 67,002,888,192 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

324 --- E O F --- 2008-04-22 02:43:23

--------------------------------hijack this-----------------

ComboFix 08-05-08.1 - Dawn 2008-05-09 11:42:39.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.597 [GMT -4:00]
Running from: C:\Documents and Settings\Dawn\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dawn\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\WINDOWS\123messenger.per
C:\WINDOWS\apphelp32.dll
C:\WINDOWS\asferror32.dll
C:\WINDOWS\asycfilt32.dll
C:\WINDOWS\athprxy32.dll
C:\WINDOWS\ati2dvaa32.dll
C:\WINDOWS\ati2dvag32.dll
C:\WINDOWS\audiosrv32.dll
C:\WINDOWS\autodisc32.dll
C:\WINDOWS\avifile32.dll
C:\WINDOWS\avisynthex32.dll
C:\WINDOWS\aviwrap32.dll
C:\WINDOWS\bjam.dll
C:\WINDOWS\browserad.dll
C:\WINDOWS\cdsm32.dll
C:\WINDOWS\changeurl_30.dll
C:\WINDOWS\cookies.ini
C:\WINDOWS\Fonts\system
C:\WINDOWS\licencia.txt
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\msa64chk.dll
C:\WINDOWS\msapasrc.dll
C:\WINDOWS\mspphe.dll
C:\WINDOWS\mssvr.exe
C:\WINDOWS\muotr.so
C:\WINDOWS\ntnut.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\saiemod.dll
C:\WINDOWS\shdocpe.dll
C:\WINDOWS\shdocpl.dll
C:\WINDOWS\swin32.dll
C:\WINDOWS\system32\gjjte.cfg
C:\WINDOWS\system32\gmnait.cfg
C:\WINDOWS\system32\hsseabhy.ini
C:\WINDOWS\system32\jyjlt.cfg
C:\WINDOWS\system32\kmd.exe
C:\WINDOWS\system32\mupxryhm.ini
C:\WINDOWS\system32\njritc.cfg
C:\WINDOWS\system32\ututv.ini
C:\WINDOWS\system32\uwDffMoq.ini
C:\WINDOWS\system32\uwDffMoq.ini2
C:\WINDOWS\system32\winfrun32.bin
C:\WINDOWS\system32\xgnfn.cfg
C:\WINDOWS\system32\zgxfdx.dll.LoG
C:\WINDOWS\telefonos.txt
C:\WINDOWS\textos.txt
C:\WINDOWS\Update.dat
C:\WINDOWS\voiceip.dll
C:\WINDOWS\winsb.dll

----- BITS: Possible infected sites -----

hxxp://80.93.48.74
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CLBDRIVER
-------\Service_clbdriver


((((((((((((((((((((((((( Files Created from 2008-04-09 to 2008-05-09 )))))))))))))))))))))))))))))))
.

2008-05-07 10:30 . 2008-05-07 10:30 <DIR> d-------- C:\Program Files\Panda Security
2008-05-05 21:11 . 2008-05-05 21:11 <DIR> d-------- C:\Documents and Settings\Dawn\Application Data\Grisoft
2008-05-05 21:11 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-05-05 09:57 . 2008-05-06 09:58 109,430 --a------ C:\WINDOWS\BM33ccc471.xml
2008-05-04 16:15 . 2008-05-04 16:15 <DIR> d-------- C:\Deckard
2008-05-04 15:19 . 2002-08-29 08:00 4,224 --a------ C:\WINDOWS\system32\beep.sys
2008-05-04 15:18 . 2008-05-05 12:33 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-04 15:18 . 2008-05-04 15:18 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-03 23:43 . 2008-05-04 13:06 <DIR> d-------- C:\Program Files\Family Feud III - Dream Home
2008-04-30 16:45 . 2008-04-30 18:35 <DIR> d-------- C:\Program Files\Brainiversity
2008-04-25 13:25 . 2008-04-25 13:25 <DIR> d-------- C:\Documents and Settings\Dawn\Application Data\Jane s Hotel Family Hero
2008-04-20 15:07 . 2008-04-20 15:07 280 --ahs---- C:\WINDOWS\system32\rdthr.cfg
2008-04-20 15:06 . 2008-04-20 15:08 4,530 --a------ C:\WINDOWS\system32\atielf.dat
2008-04-19 21:56 . 2008-04-19 21:57 <DIR> d-------- C:\Program Files\Build-a-lot 2 - Town of the Year
2008-04-12 23:22 . 2008-04-12 23:23 <DIR> d-------- C:\Program Files\Cooking Academy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-09 15:51 --------- d-----w C:\Program Files\TrueSwitchAT&TYahoo
2008-05-09 13:46 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-05-08 17:49 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-06 20:51 --------- d-----w C:\Program Files\Norton Security Scan
2008-05-06 15:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-06 14:26 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-05 20:35 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Lavasoft
2008-04-29 00:59 --------- d-----w C:\Program Files\LimeWire
2008-04-25 17:24 --------- d-----w C:\Program Files\Yahoo! Games
2008-04-20 02:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\HipSoft
2008-04-13 03:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Fugazo
2008-04-13 03:10 --------- d-----w C:\Program Files\bfgclient
2008-03-31 21:58 --------- d-----w C:\Documents and Settings\All Users\Application Data\Astar Games
2008-03-30 19:39 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Boomzap
2008-03-24 22:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-03-23 23:33 --------- d-----w C:\Program Files\Doggie Dash
2008-03-23 23:33 --------- d-----w C:\Documents and Settings\Dawn\Application Data\PlayFirst
2008-03-23 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-03-21 23:24 --------- d-----w C:\Program Files\Escape From Paradise
2008-03-21 23:24 --------- d-----w C:\Documents and Settings\Dawn\Application Data\Meridian93
2008-03-14 21:29 --------- d-----w C:\Program Files\RealArcade
2008-03-09 02:19 --------- d-----w C:\Documents and Settings\Dawn\Application Data\cerasus.media
2008-03-03 01:33 0 ----a-w C:\Program Files\temp01
2007-01-31 22:10 56 --sh--r C:\WINDOWS\system32\09E8528788.sys
2007-01-31 22:10 3,350 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2002-08-29 08:00 13312 414de7cf9d3f19c3ea902f1bb38ec116 C:\WINDOWS\$NtServicePackUninstall$\ctfmon.exe
2004-08-04 03:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\ServicePackFiles\i386\ctfmon.exe
2004-08-04 03:56 15360 24232996a38c0b0cf151c2140ae29fc8 C:\WINDOWS\system32\bak\ctfmon.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
-c--a-w 187 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\0.dat

-c--a-w 867 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\1.dat

-c--a-w 944 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\10.dat

-c--a-w 1,154 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\11.dat

-c--a-w 760 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\12.dat

-c--a-w 865 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\13.dat

-c--a-w 1,447 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\14.dat

-c--a-w 1,247 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\15.dat

-c--a-w 900 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\16.dat

-c--a-w 1,218 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\17.dat

-c--a-w 424 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\18.dat

-c--a-w 970 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\19.dat

-c--a-w 978 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\2.dat

-c--a-w 1,092 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\20.dat

-c--a-w 810 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\21.dat

-c--a-w 611 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\22.dat

-c--a-w 949 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\23.dat

-c--a-w 1,058 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\24.dat

-c--a-w 384 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\25.dat

-c--a-w 1,346 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\26.dat

-c--a-w 244 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\27.dat

-c--a-w 1,676 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\28.dat

-c--a-w 1,326 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\29.dat

-c--a-w 89 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\3.dat

-c--a-w 364 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\30.dat

-c--a-w 875 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\31.dat

-c--a-w 941 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\32.dat

-c--a-w 424 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\33.dat

-c--a-w 104 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\34.dat

-c--a-w 421 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\35.dat

-c--a-w 1,178 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\36.dat

-c--a-w 1,078 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\37.dat

-c--a-w 1,132 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\38.dat

-c--a-w 1,073 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\4.dat

-c--a-w 1,167 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\5.dat

-c--a-w 672 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\6.dat

-c--a-w 432 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\7.dat

-c--a-w 600 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\8.dat

-c--a-w 1,037 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\9.dat

-c--a-w 901 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\4\bak\offsets.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\0.dat

-c--a-w 736 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\1.dat

-c--a-w 1,509 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\10.dat

-c--a-w 1,582 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\11.dat

-c--a-w 651 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\12.dat

-c--a-w 1,579 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\13.dat

-c--a-w 2,365 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\14.dat

-c--a-w 1,229 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\15.dat

-c--a-w 2,413 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\16.dat

-c--a-w 2,427 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\17.dat

-c--a-w 1,762 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\18.dat

-c--a-w 935 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\19.dat

-c--a-w 274 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\2.dat

-c--a-w 1,273 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\20.dat

-c--a-w 1,867 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\21.dat

-c--a-w 804 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\22.dat

-c--a-w 682 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\23.dat

-c--a-w 1,770 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\24.dat

-c--a-w 789 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\25.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\26.dat

-c--a-w 2,309 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\27.dat

-c--a-w 1,105 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\28.dat

-c--a-w 2,082 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\29.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\3.dat

-c--a-w 1,787 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\30.dat

-c--a-w 1,654 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\31.dat

-c--a-w 841 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\32.dat

-c--a-w 2,671 2006-08-08 02:33:33 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\33.dat

-c--a-w 1,826 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\34.dat

-c--a-w 903 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\35.dat

-c--a-w 835 2006-08-08 02:33:29 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\36.dat

-c--a-w 2,172 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\37.dat

-c--a-w 1,491 2006-08-08 02:33:31 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\38.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\39.dat

-c--a-w 1,055 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\4.dat

-c--a-w 1,878 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\40.dat

-c--a-w 173 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\41.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\42.dat

-c--a-w 70 2006-08-08 02:33:28 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\5.dat

-c--a-w 1,760 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\6.dat

-c--a-w 1,701 2006-08-08 02:33:32 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\7.dat

-c--a-w 948 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\8.dat

-c--a-w 1,108 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\9.dat

-c--a-w 1,005 2006-08-08 02:33:30 C:\My Games\Inca Quest\media\graphics\backgrounds\AdventureBackground7\5\bak\offsets.dat

-c--a-w 131,057 2007-10-16 00:57:32 C:\Program Files\Ahead\InCD\bak\Error.log
-c--a-w 127,746 2007-09-27 14:48:17 C:\Program Files\Ahead\InCD\Error.log

-c--a-w 1,269,870 2004-02-27 15:02:32 C:\Program Files\Ahead\InCD\bak\InCD.exe

-c--a-w 2,321,600 2007-06-09 21:31:05 C:\Program Files\Common Files\Adobe\Updater5\bak\AdobeUpdater.exe

-c--a-w 50,792 2005-11-03 03:01:14 C:\Program Files\Common Files\AOL\1124841373\ee\bak\AOLSoftware.exe

-c--a-w 180,269 2006-11-11 23:31:46 C:\Program Files\Common Files\Real\Update_OB\bak\realsched.exe

-c--a-w 59,040 2006-04-13 18:20:52 C:\Program Files\Common Files\Symantec Shared\bak\ccApp.exe
----a-w 115,816 2007-01-10 05:59:52 C:\Program Files\Common Files\Symantec Shared\ccApp.exe

----a-w 6,731,312 2007-06-11 09:25:42 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\bak\avgas.exe
----a-w 6,731,312 2007-06-11 09:25:42 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

----a-w 83,608 2007-03-14 07:43:44 C:\Program Files\Java\jre1.6.0_01\bin\bak\jusched.exe

----a-w 387,584 2005-01-28 10:23:22 C:\Program Files\Labtec\Media Keyboard\V5.0\bak\KbdAp32A.exe

----a-w 802,816 2006-06-23 17:45:35 C:\Program Files\Labtec\Mouse\2.1\bak\moffice.exe

-c--a-w 86,100 2003-03-04 12:49:22 C:\Program Files\Lexmark X5100 Series\bak\lxbabmgr.exe

----a-w 274,432 2005-09-16 13:43:06 C:\Program Files\LimeWire\bak\iTunesHelper.exe

-c--a-w 631,362 2002-11-23 07:15:00 C:\Program Files\Logitech\iTouch\bak\iTouch.exe

----a-w 155,648 2005-12-25 18:44:09 C:\Program Files\QuickTime\bak\qttask.exe

----a-w 100,056 2006-11-09 17:28:44 C:\Program Files\SymNetDrv\bak\SNDMon.exe

----a-w 15,360 2004-08-04 07:56:48 C:\WINDOWS\system32\bak\ctfmon.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-10-11 21:19 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Cmaudio"="cmicnfg.cpl" []
"QuickTime Task"="C:\Program Files\QuickTime\bak\qttask.exe" [2005-12-25 14:44 155648]
"Logitech Utility"="LOGI_MWX.EXE" [2002-11-08 05:50 19968 C:\WINDOWS\LOGI_MWX.EXE]
"zzzHPSETUP"="D:\Setup.exe" [ ]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-11-28 20:51 583048]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 16:42 509224]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 01:59 115816]
"osCheck"="C:\PROGRA~1\Symantec\osCheck.exe" [2007-01-14 03:11 771704]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19 129536]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-07 03:33 8720384]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 03:56 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\Dawn\Start Menu\Programs\Startup\
TrueAssistant.lnk - C:\Program Files\TrueSwitchAT&TYahoo\TrueWizard.exe [2007-09-13 08:45:20 1028096]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 01:48:20 40048]
Adobe Reader Synchronizer.lnk - C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 00:01:50 734872]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-01-19 22:28:34 169472]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 13:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.JPEG"= JPEGCODE.DLL
"VIDC.MJPG"= JPEGCODE.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S3 SGUARD;SGUARD;C:\WINDOWS\system32\drivers\SGuard.sys []

*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-05-08 02:55:44 C:\WINDOWS\Tasks\Norton Security Online - Run Full System Scan - Dawn.job"
- C:\PROGRA~1\Symantec\Norton AntiVirus\Navw32.exe
"2008-05-02 19:17:51 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe)/scan-full /scheduleignorenav /scheduled&C:\Program Files\Norton Security Scan
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-09 11:51:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Ahead\InCD\incdsrv.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
.
**************************************************************************
.
Completion time: 2008-05-09 12:15:27 - machine was rebooted [Dawn]
ComboFix-quarantined-files.txt 2008-05-09 16:15:19
ComboFix2.txt 2008-02-29 15:50:53
ComboFix3.txt 2008-02-28 23:40:49
ComboFix4.txt 2008-02-28 22:36:23
ComboFix5.txt 2007-10-07 21:10:17

Pre-Run: 66,881,163,264 bytes free
Post-Run: 67,002,888,192 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

324 --- E O F --- 2008-04-22 02:43:23

Pancake

No you wont have to wipe your drive.All the malware will be removed when we are done.

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Open *notepad* and copy/paste the text in the quotebox below into it:

Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.




Refering to the picture above, drag CFScript.txt into ComboFix.exe


When finished, it shall produce a log for you at C:\ComboFix.txt

Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please.


*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.Altering this script in any way could damage your computer*

=======================================


Click HERE to download FindAWF.exe and save it to your desktop.
Double-click on the FindAWF.exe file to run it.
It will open a command prompt and ask you to "Press any key to continue".
You will be presented with a Menu.
Type 1, then press Enter.
FindAWF tool will begin scanning.
It may take a few minutes to complete so be patient.
When the scan is finished, a text file in notepad called AWF.txt will automatically open.
Return to this thread and copy and paste the contents of the AWF.txt file in your next reply.

__________________

QueenDawn1

ok I tried combofix twice but it keeps stalling on completed line 31 I waited 2 hours last night finally shut the computer down I then tried this morning and same thing? here is the log I found when I did a serch:

ComboFix 08-05-08.1 - Dawn 2008-05-10 8:23:50.8 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.598 [GMT -4:00]
Running from: C:\Documents and Settings\Dawn\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Dawn\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\atielf.dat
C:\WINDOWS\system32\rdthr.cfg
.

QueenDawn1

ok more problems.......I ran the awf.txt thing and followed the directions and this window poped up.....C:\documents and settings\dawn\desktop\findawf.exe
C:\windows\system32\autoexec.nt. the system file is not suitable for running ms-dos and microsoft windows applications. choose close to terminate the application...........I choose ignore and here is the log file that came up.....also hi jack log


Find AWF report by noahdfear ©2006
Version 1.40

The current date is: 2008-05-10
The current time is: 8:45:23.12


bak folders found
~~~~~~~~~~~