Advertising popup help!

[dieparga]

Hi!

I followed all the steps and this is my main.txt, and also the extra.txt
Hope you can help me:

Deckard's System Scanner v20071014.68
Run by DPARRAGA on 2007-12-23 22:41:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 2 Restore Point(s) --
2: 2007-12-23 21:41:28 UTC - RP2 - Deckard's System Scanner Restore Point
1: 2007-12-23 21:15:28 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as DPARRAGA.exe) --------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-23 22:43:52
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\Program Files\Creative\Shared Files\CTDevSrv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Equant\Dialer\EACSvrMngr.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\WINDOWS\ms\sms\clicomp\RemCtrl\Wuser32.exe
C:\WINDOWS\ms\sms\clicomp\apa\Bin\SMSAPM32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Network Associates\VirusScan\shstat.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\TpScrLk.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\Lenovo\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\ms\sms\CORE\BIN\launch32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINDOWS\ms\sms\clicomp\SWDist32\bin\SMSMon32.exe
C:\Program Files\McAfee\Common Framework\Mctray.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Microsoft ActiveSync\rapimgr.exe
C:\Program Files\Microsoft Office Communicator\communicator.exe
C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
C:\Program Files\ThinkPad\Bluetooth Software\BTStackServer.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\Documents and Settings\dparraga\My Documents\Descargas\dss.exe
C:\Program Files\Hijackthis\DPARRAGA.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [TPKBDLED] C:\WINDOWS\system32\TpScrLk.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SMS Application Launcher] C:\WINDOWS\MS\SMS\CORE\BIN\LAUNCH32.EXE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\PROGRA~1\MICROS~3\wcescomm.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [SpyBrowser] "C:\Program Files\SpyBro\SpyBro.exe" /autostart
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [CTZDetec.exe] C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [WMC_WMPDBExport] C:\Program Files\Windows Media Player\wmdbexport.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "C:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [WMC_WMPDBExport] C:\Program Files\Windows Media Player\wmdbexport.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Bluetooth.lnk = C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\NPJPI150_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_03\bin\NPJPI150_03.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra 'Tools' menuitem: Crear un favorito móvil... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O9 - Extra button: Send To Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.capgemini.com (HKLM)
O15 - Trusted Zone: *.capgemini.es (HKLM)
O15 - Trusted Zone: *.capgemini.fr (HKLM)
O15 - Trusted Zone: *.capgemini.com (HKCU)
O15 - Trusted Zone: *.capgemini.es (HKCU)
O15 - Trusted Zone: *.capgemini.fr (HKCU)
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15030/CTSUEng.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1164767317984
O16 - DPF: {74FFE28D-2378-11D5-990C-006094235084} (IBM Access Support) - http://www-307.ibm.com/pc/support/IbmEgath.cab
O16 - DPF: {76E5AF9D-2B3E-4FEB-A31F-A9E63A27FA29} (IASRunner Class) - https://www-307.ibm.com/pc/support/a...tent/AcpIR.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {B785FA3C-1DE9-4D20-8396-613C486FE95E} (AeatCtl Class) - https://www5.aeat.es/es13/h/cactivex.cab
O16 - DPF: {C7DB51B4-BCF7-4923-8874-7F1A0DC92277} (Office Update Installation Engine) - http://office.microsoft.com/officeup...tent/opuc4.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15030/CTPID.cab
O17 - HKLM\Software\..\Telephony: DomainName = spain.capgemini.com
O17 - HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: Domain = spain.capgemini.com
O17 - HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: Domain = spain.capgemini.com
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: Domain = spain.capgemini.com
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\ThinkPad\Bluetooth Software\bin\btwdins.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTSVCCDA.EXE
O23 - Service: CT Device Query service (CTDevice_Srv) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTDevSrv.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: (Equant Access Companion) Services Manager (EACSvrMngr) - Unknown owner - C:\Program Files\Equant\Dialer\EACSvrMngr.exe
O23 - Service: (Equant Access Companion) Devices and Services Monitoring (EACSys) - Unknown owner - C:\Program Files\Equant\Dialer\EACSys.exe
O23 - Service: ThinkPad PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\system32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe


--
End of file - 12115 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 NaiAvTdi1 - c:\windows\system32\drivers\mvstdi5x.sys <Not Verified; Network Associates, Inc.; VirusScan>
R1 TPHKDRV - c:\windows\system32\drivers\tphkdrv.sys <Not Verified; IBM Corporation; ThinkPad OnScreenDisplay>
R2 EGATHDRV (IBM eGatherer) - c:\windows\system32\egathdrv.sys <Not Verified; IBM Corporation; IBM eGatherer>
R2 pmem - c:\windows\system32\drivers\pmemnt.sys <Not Verified; Microsoft Corporation; Microsoft(R) Windows NT(TM) Operating System>
R3 EntDrv51 - c:\windows\system32\drivers\entdrv51.sys <Not Verified; Network Associates, Inc; Virus Scan Enterprise, Entercept>
R3 NaiAvFilter1 - c:\windows\system32\drivers\naiavf5x.sys <Not Verified; Network Associates, Inc.; VirusScan (Enterprise, ASaP & Retail.)>

S3 Ad-Watch Connect Filter (Ad-Watch Connect Kernel Filter) - c:\windows\system32\drivers\nsdriver.sys (file missing)
S3 EQDRV5 (EQUANT NDIS 5 Usermode I/O Protocol) - c:\windows\system32\drivers\eqdrv5.sys <Not Verified; Printing Communications Assoc., Inc. (EQUANT); EQUANT Rawether for Windows>
S3 SE2Bbus (Sony Ericsson Device 043 Driver driver (WDM)) - c:\windows\system32\drivers\se2bbus.sys <Not Verified; MCCI; Sony Ericsson Device 043 Driver>
S3 SE2Bmdfl (Sony Ericsson Device 043 USB WMC Modem Filter) - c:\windows\system32\drivers\se2bmdfl.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB WMC Modem Filter Driver>
S3 SE2Bmdm (Sony Ericsson Device 043 USB WMC Modem Driver) - c:\windows\system32\drivers\se2bmdm.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB WMC Data Modem>
S3 SE2Bmgmt (Sony Ericsson Device 043 USB WMC Device Management Drivers (WDM)) - c:\windows\system32\drivers\se2bmgmt.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB WMC Device Management>
S3 se2Bnd5 (Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (NDIS)) - c:\windows\system32\drivers\se2bnd5.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB Ethernet Emulation>
S3 SE2Bobex (Sony Ericsson Device 043 USB WMC OBEX Interface) - c:\windows\system32\drivers\se2bobex.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB WMC OBEX Interface>
S3 se2Bunic (Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (WDM)) - c:\windows\system32\drivers\se2bunic.sys <Not Verified; MCCI; Sony Ericsson Device 043 USB Ethernet Emulation>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 AntiVirScheduler (AntiVir PersonalEdition Classic Scheduler) - "c:\program files\antivir personaledition classic\sched.exe" <Not Verified; Avira GmbH; Scheduler>
R2 clisvc (SMS Client Service) - c:\windows\ms\sms\core\bin\clisvcl.exe <Not Verified; Microsoft Corporation; Systems Management Server>
R2 CTDevice_Srv (CT Device Query service) - c:\program files\creative\shared files\ctdevsrv.exe <Not Verified; Creative Technology Ltd; CTDevSrv Application>
R2 EACSvrMngr ((Equant Access Companion) Services Manager) - c:\program files\equant\dialer\eacsvrmngr.exe <Not Verified; ; EACSvrMngr Module>
R2 McTaskManager (Network Associates Task Manager) - "c:\program files\network associates\virusscan\vstskmgr.exe" <Not Verified; Network Associates, Inc.; VirusScan Enterprise>
R2 Wuser32 (SMS Remote Control Agent) - c:\windows\ms\sms\clicomp\remctrl\wuser32.exe <Not Verified; Microsoft Corporation; Systems Management Server>

S3 EACSys ((Equant Access Companion) Devices and Services Monitoring) - c:\program files\equant\dialer\eacsys.exe <Not Verified; ; EACSys Module>
S3 SMS Hardware Inventory Agent Service - c:\windows\ms\sms\clicomp\hinv\hinv32.exe <Not Verified; Microsoft Corporation; Systems Management Server>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: Cisco Systems VPN Adapter
Device ID: ROOT\NET\0000
Manufacturer: Cisco Systems
Name: Cisco Systems VPN Adapter
PNP Device ID: ROOT\NET\0000
Service: CVirtA


-- Files created between 2007-11-23 and 2007-12-23 -----------------------------

2007-12-23 22:07:51 0 d-------- C:\Program Files\SpywareBlaster
2007-12-23 22:07:25 0 d-------- C:\ie-spyad_zo
2007-12-23 21:53:29 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-12-23 21:23:59 0 d-------- C:\Documents and Settings\diego\Application Data\Macromedia
2007-12-23 21:22:45 0 d-------- C:\Documents and Settings\diego\Application Data\Mozilla
2007-12-23 18:38:34 0 d-------- C:\Documents and Settings\diego\Application Data\Lavasoft
2007-12-23 18:29:10 0 d-------- C:\Documents and Settings\diego\Application Data\Teleca
2007-12-23 18:28:44 0 d-------- C:\Documents and Settings\diego\Bluetooth Software
2007-12-23 18:28:39 0 d-------- C:\Documents and Settings\diego\Application Data\Sony Ericsson
2007-12-23 18:28:20 0 d-------- C:\Documents and Settings\diego\Application Data\Identities
2007-12-23 17:39:45 0 d--h----- C:\Documents and Settings\diego\Templates
2007-12-23 17:39:45 0 dr------- C:\Documents and Settings\diego\Start Menu
2007-12-23 17:39:45 0 dr-h----- C:\Documents and Settings\diego\SendTo
2007-12-23 17:39:45 0 dr-h----- C:\Documents and Settings\diego\Recent
2007-12-23 17:39:45 0 d--h----- C:\Documents and Settings\diego\PrintHood
2007-12-23 17:39:45 2097152 --ah----- C:\Documents and Settings\diego\NTUSER.DAT
2007-12-23 17:39:45 0 d--h----- C:\Documents and Settings\diego\NetHood
2007-12-23 17:39:45 0 dr------- C:\Documents and Settings\diego\My Documents
2007-12-23 17:39:45 0 d--h----- C:\Documents and Settings\diego\Local Settings
2007-12-23 17:39:45 0 dr------- C:\Documents and Settings\diego\Favorites
2007-12-23 17:39:45 0 d-------- C:\Documents and Settings\diego\Desktop
2007-12-23 17:39:45 0 d---s---- C:\Documents and Settings\diego\Cookies
2007-12-23 17:39:45 0 dr-h----- C:\Documents and Settings\diego\Application Data
2007-12-23 17:39:45 0 d---s---- C:\Documents and Settings\diego\Application Data\Microsoft
2007-12-10 17:51:33 0 d-------- C:\extools2.0
2007-11-28 16:34:13 0 d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2007-11-28 16:32:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Teleca
2007-11-28 16:32:24 0 d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-11-28 16:19:57 0 d-------- C:\Program Files\Sony Ericsson
2007-11-28 16:19:23 0 d-------- C:\Program Files\Sony
2007-11-28 16:18:38 0 d-------- C:\Program Files\Sony Setup


-- Find3M Report ---------------------------------------------------------------

2007-11-28 16:34:19 0 d-------- C:\Program Files\Common Files\Teleca Shared
2007-11-28 16:34:13 0 d-------- C:\Program Files\Common Files
2007-09-24 11:52:02 852131 --a------ C:\WINDOWS\system32\Capgemini_is_40.scr
2007-09-24 11:52:02 852131 --a------ C:\Documents and Settings\dparraga\Application Data\Capgemini_is_40.scr


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [22/09/2004 20:00]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [07/10/2003 09:48]
"TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [08/10/2002 22:28]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [25/07/2006 10:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [14/02/2006 14:17]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [14/02/2006 14:16]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [15/09/2006 09:53]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [15/09/2006 09:50]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [15/09/2006 09:54]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [20/05/2005 08:11]
"SMS Application Launcher"="C:\WINDOWS\MS\SMS\CORE\BIN\LAUNCH32.EXE" [23/02/2003 01:05]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [15/07/2005 22:48]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [09/07/2001 10:50]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" []
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [17/11/2006 02:06]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [22/10/2007 08:25]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [13/06/2007 08:16]
"sjvbhgz"="c:\windows\system32\sjvbhgz.exe" [14/12/2007 10:22]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="C:\PROGRA~1\MICROS~3\wcescomm.exe" [21/06/2006 00:41]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [19/01/2007 11:55]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [12/05/2005 11:40]
"SpyBrowser"="C:\Program Files\SpyBro\SpyBro.exe" []
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [30/03/2006 15:45]
"CTZDetec.exe"="C:\Program Files\Creative\Creative Media Lite\CTZDetec.exe" [15/05/2007 19:25]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"WMC_WMPDBExport"=C:\Program Files\Windows Media Player\wmdbexport.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe"
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [23/09/2005 21:05:26]
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [01/08/2006 19:25:16]
VPN Client.lnk - C:\WINDOWS\Installer\{06624881-CF7D-4F8A-86C0-5114B122E776}\Icon3E5562ED7.ico [29/11/2006 16:42:06]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"RunLogonScriptSync"=1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 05/07/2005 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 30/11/2005 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=Machine_Startup_Script.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\1]
"Script"=Pwd.vbe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1282931748-58997478-800574724-36422\Scripts\Logon\0\0]
"Script"=User_Logon_Script.vbs




-- End of Deckard's System Scanner: finished at 2007-12-23 22:45:12 ------------

[sUBs]

www.bleepingcomputer.com
www.forospyware.com
www.geekstogo.com

1. Please choose from any of the above links. Download the file & Save it to Desktop.

2. Double click on ComboFix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that & a fresh Hijackthis log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[dieparga]

Hi!

Thanks for your reply and help. Here you're what you asked me. Hope you can help me to solve that annoying problem.

I'll be waiting for your netx reply. Thanks.

ComboFix 07-12-27.1 - diego 2007-12-26 22:09:29.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.554 [GMT 1:00]
Running from: C:\Documents and Settings\diego\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\pack.epk
c:\WINDOWS\system32\sjvbhgz.dat
c:\windows\system32\sjvbhgz.exe
C:\WINDOWS\system32\sjvbhgz_nav.dat
c:\WINDOWS\system32\sjvbhgz_navps.dat

.
((((((((((((((((((((((((( Files Created from 2007-11-27 to 2007-12-27 )))))))))))))))))))))))))))))))
.

2007-12-23 22:14 . 2007-12-23 22:14 <DIR> d-------- C:\Deckard
2007-12-23 22:07 . 2007-12-23 22:11 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-23 22:07 . 2007-12-23 22:07 <DIR> d-------- C:\ie-spyad_zo
2007-12-23 22:07 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-23 21:53 . 2007-12-23 21:55 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-23 21:53 . 2007-12-23 22:23 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-23 21:53 . 2007-12-23 22:23 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-23 21:53 . 2007-12-23 22:23 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-23 18:38 . 2007-12-23 18:38 <DIR> d-------- C:\Documents and Settings\diego\Application Data\Lavasoft
2007-12-23 18:29 . 2007-12-23 18:29 <DIR> d-------- C:\Documents and Settings\diego\Application Data\Teleca
2007-12-23 18:28 . 2007-12-23 18:28 <DIR> d-------- C:\Documents and Settings\diego\Bluetooth Software
2007-12-23 18:28 . 2007-12-23 18:28 <DIR> d-------- C:\Documents and Settings\diego\Application Data\Sony Ericsson
2007-12-11 23:35 . 2007-12-11 23:35 524,288 --a------ C:\WINDOWS\system32\DivXsm.exe
2007-12-11 23:35 . 2007-12-11 23:35 4,816 --a------ C:\WINDOWS\system32\divxsm.tlb
2007-12-11 23:34 . 2007-12-11 23:34 3,596,288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2007-12-11 23:34 . 2007-12-11 23:34 1,044,480 --a------ C:\WINDOWS\system32\libdivx.dll
2007-12-11 23:34 . 2007-12-11 23:34 200,704 --a------ C:\WINDOWS\system32\ssldivx.dll
2007-12-11 23:32 . 2007-12-11 23:32 352,401 --a------ C:\WINDOWS\system32\DivXMedia.ax
2007-12-11 23:32 . 2007-12-11 23:32 156,992 --a------ C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-12-11 23:32 . 2007-12-11 23:32 12,288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2007-12-10 17:51 . 2007-12-10 17:53 <DIR> d-------- C:\extools2.0
2007-11-29 10:07 . 2007-04-03 13:57 23,176 -ra------ C:\WINDOWS\system32\drivers\s116nd5.sys
2007-11-28 16:34 . 2007-11-28 16:34 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2007-11-28 16:32 . 2007-11-28 16:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Teleca
2007-11-28 16:32 . 2007-11-28 16:34 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-11-28 16:19 . 2007-11-28 16:34 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-11-28 16:19 . 2007-11-28 16:19 <DIR> d-------- C:\Program Files\Sony
2007-11-28 16:18 . 2007-11-28 16:18 <DIR> d-------- C:\Program Files\Sony Setup

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-24 10:27 --------- d-----w C:\Program Files\DivX
2007-12-11 22:34 9,464 ------w C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-12-11 22:34 9,336 ------w C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-12-11 22:34 43,528 ------w C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-12-11 22:34 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-12-11 22:34 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-12-11 22:34 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-12-11 22:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-12-11 22:33 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-12-11 22:33 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-12-11 22:33 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-12-11 22:33 682,496 ----a-w C:\WINDOWS\system32\DivX.dll
2007-12-11 22:33 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-12-11 22:33 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-12-11 22:33 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-12-11 22:33 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-12-11 22:33 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-12-11 22:33 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-12-11 22:33 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-11-28 15:34 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-09-24 10:52 852,131 ----a-w C:\Documents and Settings\dparraga\Application Data\Capgemini_is_40.scr
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
"TPKBDLED"="C:\WINDOWS\system32\TpScrLk.exe" [2002-10-08 22:28]
"TPHOTKEY"="C:\PROGRA~1\Lenovo\PkgMgr\HOTKEY\TPHKMGR.exe" [2006-07-25 10:19]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2006-02-14 14:17]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-02-14 14:16]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-09-15 09:53]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-09-15 09:50]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-09-15 09:54]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 08:11]
"SMS Application Launcher"="C:\WINDOWS\MS\SMS\CORE\BIN\LAUNCH32.EXE" [2003-02-23 01:05]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 22:48]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 10:50]
"Ad-Watch"="C:\Program Files\Lavasoft\Ad-Aware 2007\Ad-Watch2007.exe" []
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 02:06]
"avgnt"="C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe" [2007-10-22 08:25]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 08:16]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="C:\Program Files\Microsoft Office Communicator\Communicator.exe" [2005-05-12 11:40]
"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 15:38]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WMC_WMPDBExport"="C:\Program Files\Windows Media Player\wmdbexport.exe" [2006-10-18 19:04]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 21:05:26]
Bluetooth.lnk - C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe [2006-08-01 19:25:16]
VPN Client.lnk - C:\WINDOWS\Installer\{06624881-CF7D-4F8A-86C0-5114B122E776}\Icon3E5562ED7.ico [2006-11-29 16:42:06]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tpfnf2]
notifyf2.dll 2005-07-05 23:45 28672 C:\WINDOWS\system32\notifyf2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
tphklock.dll 2005-11-30 20:16 24576 C:\WINDOWS\system32\tphklock.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=Machine_Startup_Script.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\1]
"Script"=Pwd.vbe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1282931748-58997478-800574724-36422\Scripts\Logon\0\0]
"Script"=User_Logon_Script.vbs

R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys [2004-09-22 20:00]
R2 clisvc;SMS Client Service;C:\WINDOWS\MS\SMS\CORE\BIN\CLISVCL.EXE [2003-02-23 01:05]
R2 CTDevice_Srv;CT Device Query service;C:\Program Files\Creative\Shared Files\CTDevSrv.exe [2007-04-02 13:15]
R2 EACSvrMngr;(Equant Access Companion) Services Manager;C:\Program Files\Equant\Dialer\EACSvrMngr.exe [2005-02-01 17:14]
R2 Wuser32;SMS Remote Control Agent;C:\WINDOWS\MS\SMS\CLICOMP\RemCtrl\Wuser32.exe [2003-02-23 01:05]
R3 AEAudioService;AEAudio Service;C:\WINDOWS\system32\drivers\AEAudio.sys [2005-06-07 13:53]
R3 atmeltpm;atmeltpm;C:\WINDOWS\system32\DRIVERS\atmeltpm.sys [2005-05-17 10:20]
R3 idisw2km;idisw2km;C:\WINDOWS\system32\DRIVERS\idisw2km.sys [2003-02-23 01:05]
R3 kbstuff;SMS Virtual Input Device;C:\WINDOWS\system32\DRIVERS\kbstuff5.sys [2003-02-23 01:05]
S3 EACSys;(Equant Access Companion) Devices and Services Monitoring;C:\Program Files\Equant\Dialer\EACSys.exe [2005-03-25 19:25]
S3 EQDRV5;EQUANT NDIS 5 Usermode I/O Protocol;C:\WINDOWS\system32\DRIVERS\eqdrv5.sys [2006-11-29 16:37]
S3 s116bus;Sony Ericsson Device 116 driver (WDM);C:\WINDOWS\system32\DRIVERS\s116bus.sys [2007-04-03 13:57]
S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s116mdfl.sys [2007-04-03 13:57]
S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s116mdm.sys [2007-04-03 13:57]
S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s116mgmt.sys [2007-04-03 13:57]
S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS);C:\WINDOWS\system32\DRIVERS\s116nd5.sys [2007-04-03 13:57]
S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s116obex.sys [2007-04-03 13:57]
S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM);C:\WINDOWS\system32\DRIVERS\s116unic.sys [2007-04-03 13:57]
S3 SE2Bbus;Sony Ericsson Device 043 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\SE2Bbus.sys [2006-11-10 09:46]
S3 SE2Bmdfl;Sony Ericsson Device 043 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\SE2Bmdfl.sys [2006-11-10 09:46]
S3 SE2Bmdm;Sony Ericsson Device 043 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\SE2Bmdm.sys [2006-11-10 09:47]
S3 SE2Bmgmt;Sony Ericsson Device 043 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\SE2Bmgmt.sys [2006-11-10 09:47]
S3 se2Bnd5;Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (NDIS);C:\WINDOWS\system32\DRIVERS\se2Bnd5.sys [2006-11-10 09:47]
S3 SE2Bobex;Sony Ericsson Device 043 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\SE2Bobex.sys [2006-11-10 09:47]
S3 se2Bunic;Sony Ericsson Device 043 USB Ethernet Emulation SEMC43 (WDM);C:\WINDOWS\system32\DRIVERS\se2Bunic.sys [2006-11-10 09:47]
S3 SMS Hardware Inventory Agent Service;SMS Hardware Inventory Agent Service;C:\WINDOWS\MS\SMS\clicomp\hinv\hinv32.exe [2003-02-23 01:05]

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-27 22:12:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tphklock.dll
.
Completion time: 2007-12-27 22:12:52

[sUBs]

Hope you can help me to solve that annoying problem.

LOL ... isn't it solved yet? Haven't you noticed that the pop ups have stopped?


---------


Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

@echo off
pushd %windir%
Vfind -ltf Machine_Startup_Script.vbs Pwd.vbe User_Logon_Script.vbs > ..\Log.txt
Start Notepad ..\Log.txt

Save this as find.bat Choose to "Save type as - All Files"
It should look like this:
Double click on find.bat & allow it to run

Post back to tell me what it says


-------------


Using Internet Explorer, visit http://www.kaspersky.com/service?chapter=161739400

Answer Yes, when prompted to install an ActiveX component.

• The program will then begin downloading the latest definition files.
• Once the files have been downloaded click on NEXT
• Locate the Scan Settings button & configure to:
  • Scan using the following Anti-Virus database:
    • Extended
  • Scan Options:
    • Scan Archives
    • Scan Mail Bases
• Click OK & have it scan My Computer
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  
  
  
  
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

* Turn off the real time scanner of any existing antivirus program while performing the online scan


---------------


In your next post, please update us on how the computer behaves now

[dieparga]

Hi!

I think the problem has disappeared! Popups have stopped! Here you're what you asked me:

Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0

Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0

Entries: 0 (0)
Directories: 0 Files: 0
Bytes: 0 Blocks: 0

Total Entries: 0 (0)
Total Directories: 0 Files: 0
Total Bytes: 0 Blocks: 0

Please confirm that the problem is solved. Thanks a lot for your help!

Diego


-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, December 28, 2007 12:45:31 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 27/12/2007
Kaspersky Anti-Virus database records: 496390
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
O:\

Scan Statistics:
Total number of scanned objects: 30013
Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0
Duration of the scan process: 00:42:37

Infected Object Name / Virus Name / Last Action
C:\AccessProtectionLog.txt Object is locked skipped
C:\BufferOverflowProtectionLog.txt Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\Agent_WXPMLDPARRAG.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\McAfee\Common Framework\Db\PrdMgr_WXPMLDPARRAG.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071228_Time-102525906_EnterceptExceptions.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Network Associates\BOPDATA\_Date-20071228_Time-102525906_EnterceptRules.dat Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\cert8.db Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\history.dat Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\key3.db Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\parent.lock Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\search.sqlite Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\appLauncher_all_log.txt Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\DM_log.txt Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\HookStarter_log.txt Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\SpecificUSB_log.txt Object is locked skipped
C:\Documents and Settings\dparraga\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\TlibCmnDlgs_log.txt Object is locked skipped
C:\Documents and Settings\dparraga\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Microsoft\CardSpace\CardSpace.db.shadow Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Application Data\Mozilla\Firefox\Profiles\8rrvgx5p.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\temp\AcrFBF.tmp Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\temp\hsperfdata_DPARRAGA\3912 Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\dparraga\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\dparraga\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\dparraga\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&\ntuser.dat.LOG Object is locked skipped
C:\OnAccessScanLog.txt Object is locked skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{3D9A82F5-B850-46DF-924A-544148B72F1C}\RP5\change.log Object is locked skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_b1c.dat Object is locked skipped

Scan process completed.

[sUBs]

Number of viruses found: 0
Number of infected objects: 0
Number of suspicious objects: 0

It doesn't get any better than this.
Just some loose ends to tidy up.

Open NOTEPAD.exe and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\1]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-1282931748-58997478-800574724-36422\Scripts\Logon\0\0]

Save this as fix.reg Choose to "Save type as - All Files"
It should look like this:
Double click on fix.reg & allow it to merge into the registry


---------------


Now that your system is clean, kindly follow these simple steps in order to keep your computer clean and secure:

1. Uninstall ComboFix
   This process will perform some post cleanup measures.
   Do this by going to to Start > Run & typing in ComboFix /u
   
   
2. ANTIVIRUS SOFTWARE
   It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
   
   
   
3. FIREWALL
   Without a firewall your computer is succeptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. A tutorial on Firewalls and a listing of some available ones can be found here ? http://www.bleepingcomputer.com/forums/tutorial60.html
   
   
   
4. Microsoft Windows Update ? http://www.windowsupdate.com
   Visit regularly. This will ensure your computer always has the latest security updates. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
   
   
5. SPYWAREBLASTER
   SpywareBlaster prevents the installation of malicious ActiveX, adware, browser hijackers, dialers, and other potentially unwanted software. Blocks spyware/tracking cookies & restricts the actions of potentially unwanted sites.
   
   Unlike other programs, SpywareBlaster does not have to remain running in the background. A tutorial on installing & using this product can be found here ? http://www.bleepingcomputer.com/forums/tutorial49.html
   
   
   
6. IE-SPYAD
   IE/Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here http://www.spywarewarrior.com/uiuc/resource.htm

Update all these programs regularly. Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically. Here are some additional utilities that will further enhance your safety.

• http://www.trillian.cc ? Trillian or http://www.miranda-im.com ? Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN)
  
  
• http://www.mozilla.org/products/firefox/ - Firefox - Use this alternate browser. Whilst Internet Explorer is not a bad browser, almost every exploit crafted is targeted to take advantage of an IE weakness.
  
  
• http://java.com/en/index.jsp - Sun's Java - It's much more secure than Microsoft's Java Virtual Machine.
  
  
• http://www.aumha.org/downloads/erunt-setup.exe - ERUNT - A useful freeware utility for users of Windows 2000/XP. It's made up of two parts - ERUNT & NTREGOPT.
  
  ERUNT will create daily complete backups of your computer's Registry. Whilst System Restore does the same thing, a corrupt registry file may prevent Windows from booting & this effectively renders disables System Restore. With ERUNT, you're able to restore the damaged Registry.
  
  NTREGOPT works by recreating each registry hive "from scratch", thus removing any slack space that may be left from previously modified or deleted keys. In other words, it compacts the Registry to a small size which allows Windows to load & perform faster.

To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein - http://computercops.biz/postlite7736-.html

After doing all these, your system will be optimised against future threats.

It's okay to delete the Hijack This folder in a couple weeks if everything is working okay.
Have a safe & happy computing day.

Kindly respond to this thread once more so we can mark this thread as resolved.

[dieparga]

Thank you very much for all your help and advices.

Good job!

Best regards.

Diego