Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Still needing help with pop ups
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
Page 1 of 2 1 2
 
LinkBack Thread Tools
Old 08-11-2007, 09:12 PM   #1 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Still needing help with pop ups
Greetings:
I think that I may not have gotten rid of all the pop-ups on my wife's machine after the last fix. I noticed some kind of installer on the add/remove list so I removed it, but I am still getting some pop-ups.

I ran highjack this and below is my report. I also ran combo-fix thinking that I needed to do that first. I then realized that you only need highjack this first. Sorry if I messed up!

Here is my highjack this and combo fix.

Thanks, Dan

Deckard's System Scanner v20070711.54
Run by Mom on 2007-08-11 at 22:32:56
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-08-11 22:33:26
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee\SpamKiller\MSKAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\ComPlus Applications\vihorug22011.exe
C:\Program Files\NetWaiting\netwaiting.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Mom\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: 0 - {316C3DC2-0EE5-4712-A690-BA0BE6D69BE4} - C:\Program Files\Common Files\zyliv.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\wxvhaeif.dll
O2 - BHO: (no name) - {E959E770-16F3-4212-B0A9-328F636E93C3} - C:\WINDOWS\system32\pmkhg.dll
O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\hgghhef.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [vihorug] C:\Program Files\ComPlus Applications\vihorug22011.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\bluovwxw.dll",forkonce
O4 - HKCU\..\RunOnce: [SynUnInstall] rundll32 "C:\DOCUME~1\Mom\LOCALS~1\Temp\SynISDLL.dll",deleteDirs C:\Program Files\Synaptics\
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://online.musicmatch.com (HKLM)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} () - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O20 - Winlogon Notify: hgghhef - C:\WINDOWS\system32\hgghhef.dll
O20 - Winlogon Notify: pmkhg - C:\WINDOWS\system32\pmkhg.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"
O23 - Service: Apple Mobile Device - Apple, Inc. - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe


-- Files created between 2007-07-11 and 2007-08-11 -----------------------------

2007-08-11 22:21:05 0 d-------- C:\WINDOWS\LastGood
2007-08-11 22:09:07 246 --a------ C:\Program Files\Common Files\zyliv
2007-08-11 22:09:07 70144 --a------ C:\Program Files\Common Files\zyliv.dll
2007-08-11 22:08:58 135168 --a------ C:\WINDOWS\tk58.exe
2007-08-11 21:41:06 246 --a------ C:\Program Files\Common Files\zyliv874
2007-08-11 21:40:12 69184 --a------ C:\WINDOWS\system32\wxvhaeif.dll
2007-08-10 11:03:08 0 --a------ C:\Documents and Settings\Mom\721876
2007-08-10 10:58:07 125504 --a------ C:\WINDOWS\system32\bluovwxw.dll
2007-08-10 10:57:57 69184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51:51 75328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe <Not Verified; ; DDC>
2007-08-10 10:49:37 1685466 ---hs---- C:\WINDOWS\system32\ghkmp.bak2
2007-08-10 09:27:45 52766 --a------ C:\WINDOWS\system32\ljdsrngr.exe <Not Verified; ; Browser Driver>
2007-08-10 09:26:20 9769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:23:17 6421 ---hs---- C:\WINDOWS\system32\ghkmp.bak1
2007-08-10 09:23:06 231520 --a------ C:\WINDOWS\system32\pmkhg.dll
2007-08-10 09:18:22 756352 -r-hs---- C:\WINDOWS\vjcwogxA.exe <Not Verified; System Service; System Monitor Service>
2007-08-10 09:18:18 54784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18:14 192582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18:13 31254 --a------ C:\WINDOWS\system32\gebaaby.dll
2007-08-10 09:18:11 0 d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18:07 52747 --a------ C:\WINDOWS\system32\dwdsrngt.exe <Not Verified; ; Browser Driver>
2007-08-10 09:18:06 0 d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18:05 0 d-------- C:\Temp
2007-08-10 09:18:03 31254 --a------ C:\WINDOWS\system32\hgghhef.dll
2007-08-09 15:54:29 0 d-------- C:\Documents and Settings\James\Application Data\Leadertech
2007-08-09 13:42:26 1421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12:04 0 d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:09:12 0 d-------- C:\WINDOWS\ShellNew
2007-08-05 18:05:17 0 d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04:09 0 d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49:36 0 d-------- C:\Documents and Settings\James\Application Data\CyberLink
2007-07-28 22:40:24 0 d-------- C:\Documents and Settings\James\Application Data\AdobeUM
2007-07-28 22:40:16 0 d-------- C:\Documents and Settings\James\Application Data\Adobe
2007-07-27 17:57:07 0 d-------- C:\Documents and Settings\James\Application Data\Apple Computer
2007-07-25 21:23:54 41984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23:54 0 d-------- C:\Program Files\Xtreme Desktop
2007-07-25 21:23:39 0 d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42:18 0 d-------- C:\Documents and Settings\Mom\Application Data\acccore
2007-07-21 11:37:16 0 d---s---- C:\Documents and Settings\James\UserData
2007-07-18 21:58:26 0 d-------- C:\Documents and Settings\Jill\Application Data\acccore
2007-07-18 13:04:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-18 13:04:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-17 12:23:36 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-07-17 12:23:35 0 d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18:35 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57:03 0 d-------- C:\Program Files\Lavasoft
2007-07-16 19:57:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-16 19:55:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41:33 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29:21 0 d-------- C:\Program Files\EA GAMES


-- Find3M Report ---------------------------------------------------------------

2007-08-10 0952 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 0950 88 -r-hs---- C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 18:15:12 0 d-------- C:\Documents and Settings\Mom\Application Data\BayScribe
2007-07-28 0422 135 --a------ C:\Program Files\Common Files\dirtok.html
2007-07-20 21:22:05 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-07-19 11:16:49 0 d-------- C:\Program Files\DocQscribe
2007-07-17 22:12:37 0 d-------- C:\Program Files\Windows NT
2007-07-17 11:39:31 0 d-------- C:\Program Files\Winamp
2007-07-17 11:39:17 0 d-------- C:\Program Files\SmartFTP Client
2007-07-17 11:38:40 0 d-------- C:\Program Files\NetWaiting
2007-07-17 11:38:11 0 d-------- C:\Program Files\MSN Messenger
2007-07-17 11:37:58 0 d-------- C:\Program Files\Messenger
2007-07-17 11:37:30 0 d-------- C:\Program Files\iTunes
2007-07-17 11:37:04 0 d-------- C:\Program Files\Google
2007-07-17 11:36:41 0 d-------- C:\Program Files\Digital Line Detect
2007-07-17 11:36:41 0 d-------- C:\Program Files\DellSupport
2007-07-17 11:35:55 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-17 11:35:19 0 d-------- C:\Program Files\BayScribe
2007-07-16 19:08:12 0 d-------- C:\Program Files\Dell
2007-07-01 17:29:58 0 d-------- C:\Program Files\iPod
2007-07-01 17:29:36 0 d-------- C:\Program Files\QuickTime
2007-07-01 17:28:55 0 d-------- C:\Program Files\Apple Software Update
2007-07-01 17:28:27 0 d-------- C:\Program Files\Common Files\Apple
2007-07-01 17:09:00 0 d-------- C:\Program Files\Windows Media Connect 2
2007-06-30 16:47:11 0 d-------- C:\Documents and Settings\Mom\Application Data\Skype
2007-06-28 16:54:26 0 d-------- C:\Program Files\Skype
2007-06-28 16:54:22 0 d-------- C:\Program Files\Common Files\Skype
2007-06-27 09:04:14 0 d-------- C:\Program Files\Online Services
2007-06-26 16:27:04 0 d-------- C:\Documents and Settings\Mom\Application Data\Corel Photo Album
2007-06-25 09:43:45 0 d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2007-06-23 22:47:19 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-23 22:43:44 0 d-------- C:\Program Files\MSXML 4.0
2007-06-23 16:02:00 0 d-------- C:\Program Files\Real
2007-06-22 11:52:32 0 d-------- C:\Program Files\AIM6
2007-06-22 11:52:03 0 d-------- C:\Program Files\Common Files\AOL
2007-06-21 08:46:13 0 d-------- C:\Documents and Settings\Mom\Application Data\CyberLink
2007-06-21 08:05:28 0 d-------- C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 07:45:35 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-21 07:45:35 0 d-------- C:\Documents and Settings\Mom\Application Data\Adobe
2007-06-21 07:42:06 0 d-------- C:\Documents and Settings\Mom\Application Data\Macromedia
2007-06-21 07:41:53 0 d-------- C:\Documents and Settings\Mom\Application Data\GTek
2007-06-21 07:40:50 0 d-------- C:\Documents and Settings\Mom\Application Data\Google
2007-06-21 07:36:26 0 d-------- C:\Documents and Settings\Mom\Application Data\McAfee.com Personal Firewall
2007-06-20 19:09:57 0 d-------- C:\Program Files\Audacity
2007-06-20 18:53:16 0 d-------- C:\Program Files\McAfee
2007-06-20 18:53:07 0 d-------- C:\Program Files\McAfee.com
2007-06-20 18:51:36 0 d-------- C:\Program Files\Corel Corporation
2007-06-20 18:51:10 0 d-------- C:\Program Files\Corel
2007-06-20 18:51:10 0 d-------- C:\Program Files\Common Files\Corel
2007-06-20 18:50:15 0 d-------- C:\Program Files\MUSICMATCH
2007-06-20 18:49:43 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-20 18:49:03 0 d-------- C:\Program Files\Norton Ghost
2007-06-20 18:48:10 0 d-------- C:\Documents and Settings\Mom\Application Data\Symantec
2007-06-20 18:47:58 0 d-------- C:\Program Files\Symantec
2007-06-20 18:47:01 0 d-------- C:\Program Files\Common Files\Sonic Shared
2007-06-20 18:46:36 0 d-------- C:\Program Files\Sonic
2007-06-20 18:46:29 0 d-------- C:\Program Files\EarthLink Setup
2007-06-20 18:46:22 0 d-------- C:\Program Files\America Online 9.0
2007-06-20 18:46:21 0 d-------- C:\Program Files\AOL Companion
2007-06-20 18:46:18 0 d-------- C:\Program Files\Common Files\aolshare
2007-06-20 18:46:08 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-06-20 18:46:04 0 d-------- C:\Program Files\Common Files\Real
2007-06-20 18:45:08 335 --a------ C:\WINDOWS\nsreg.dat
2007-06-20 18:45:04 0 d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 18:45:02 0 d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 18:43:00 0 d-------- C:\Program Files\CyberLink
2007-06-20 18:42:36 0 d-------- C:\Program Files\Modem Helper
2007-06-20 18:41:42 0 d-------- C:\Program Files\Broadcom
2007-06-20 18:41:19 0 d-------- C:\Program Files\Synaptics
2007-06-20 18:41:06 0 d-------- C:\Documents and Settings\Mom\Application Data\InstallShield
2007-06-20 18:39:31 0 d-------- C:\Program Files\CONEXANT
2007-06-20 18:39:25 0 d-------- C:\Program Files\Sigmatel
2007-06-20 18:36:13 0 d-------- C:\Documents and Settings\Mom\Application Data\Sun
2007-06-20 18:36:11 0 d-------- C:\Program Files\Java
2007-06-20 18:36:00 0 d-------- C:\Program Files\Common Files\Java


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{316C3DC2-0EE5-4712-A690-BA0BE6D69BE4} C:\Program Files\Common Files\zyliv.dll
{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} c:\program files\mcafee\spamkiller\mcapfbho.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
{5E028439-81C7-4B82-BC74-25156306F532} C:\Program Files\BayScribe\bayscribe.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} C:\WINDOWS\system32\wxvhaeif.dll
{E959E770-16F3-4212-B0A9-328F636E93C3} C:\WINDOWS\system32\pmkhg.dll
{E9BD0828-1FD9-410C-A50F-43EBE65D310F} C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SigmatelSysTrayApp"="stsystra.exe"
"Dell QuickSet"="C:\\Program Files\\Dell\\QuickSet\\quickset.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
@=""
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcupdate.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"VirusScan Online"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"XDc"="C:\\Program Files\\Xtreme Desktop\\xdc\\startxdc.exe"
"WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe"
"Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"vihorug"="C:\\Program Files\\ComPlus Applications\\vihorug22011.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ModemOnHold"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"SystemOptimizer"="rundll32.exe \"C:\\WINDOWS\\system32\\bluovwxw.dll\",forkonce"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"SynUnInstall"="rundll32 \"C:\\DOCUME~1\\Mom\\LOCALS~1\\Temp\\SynISDLL.dll\",deleteDirs C:\\Program Files\\Synaptics\\"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ C:\Program Files\Common Files\dirtok.html

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"=""

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgghhef
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhg

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
Shell\AutoRun\command F:\setupSNK.exe


-- End of Deckard's System Scanner: finished at 2007-08-11 at 22:35:06 ---------


"Mom" - 2007-08-11 21:52:18 - ComboFix 07-07-17.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\dirtok.html
C:\Program Files\Common Files\zyliv.dll
C:\Program Files\Common Files\zyliv870.dll
C:\Program Files\Common Files\zyliv874.dll
C:\Program Files\inetget2
C:\Program Files\inetget2\popinstall.exe
C:\Program Files\web buying
C:\Program Files\web buying\v1.8.1\wbuninst.exe
C:\Program Files\winpop
C:\Program Files\winpop\UnInstall.exe
C:\Program Files\winpop\winpop.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\dls0523pmw.exe
C:\WINDOWS\offun.exe
C:\WINDOWS\rau001978.exe
C:\WINDOWS\system32\A1
C:\WINDOWS\system32\A1\kq22011.exe
C:\WINDOWS\system32\B1
C:\WINDOWS\system32\ldcore.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\win
C:\WINDOWS\system32\win\w7q.exe
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\X2
C:\WINDOWS\system32\X2\x5.exe
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\TISKY009.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\wbun.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NET_AGENT
-------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
-------\DomainService
-------\Net Agent
-------\Windows Overlay Components


((((((((((((((((((((((((( Files Created from 2007-07-12 to 2007-08-12 )))))))))))))))))))))))))))))))


2007-08-11 21:40 69,184 --a------ C:\WINDOWS\system32\wxvhaeif.dll
2007-08-10 10:58 125,504 --a------ C:\WINDOWS\system32\bluovwxw.dll
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 10:49 1,685,466 ---hs---- C:\WINDOWS\system32\ghkmp.bak2
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:23 6,421 ---hs---- C:\WINDOWS\system32\ghkmp.bak1
2007-08-10 09:23 231,520 --a------ C:\WINDOWS\system32\pmkhg.dll
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 31,254 --a------ C:\WINDOWS\system32\hgghhef.dll
2007-08-10 09:18 31,254 --a------ C:\WINDOWS\system32\gebaaby.dll
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 13:21 <DIR> d-------- C:\Deckard
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES
2007-07-13 14:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-13 14:56 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-12 02:49:53 -------- d-----w C:\Program Files\Soulseek
2007-08-10 1452 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 1450 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-21 02:22:05 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-17 12:18:40 -------- d-----w C:\Program Files\Windows Live Toolbar
2007-07-17 00:08:12 -------- d-----w C:\Program Files\Dell
2007-07-17 00:07:25 -------- d-----w C:\Program Files\Ares
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 01:58:30 -------- d-----w C:\Program Files\Power Tab Software
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:20 -------- d-----w C:\Program Files\Learn2.com
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:49 -------- d-----w C:\Program Files\NetZeroInstallers
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 23:39:25 -------- d-----w C:\Program Files\Sigmatel
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1}]
2007-08-11 21:40 69184 --a------ C:\WINDOWS\system32\wxvhaeif.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E959E770-16F3-4212-B0A9-328F636E93C3}]
2007-08-10 09:23 231520 --a------ C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9BD0828-1FD9-410C-A50F-43EBE65D310F}]
2007-08-10 09:18 31254 --a------ C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2007-02-20 12:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-08 11:48]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]
"vihorug"="C:\Program Files\ComPlus Applications\vihorug22011.exe" [2007-08-07 15:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"SystemOptimizer"="C:\WINDOWS\system32\bluovwxw.dll,forkonce" []

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"="C:\WINDOWS\system32\hgghhef.dll" [2007-08-10 09:18]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgghhef]
hgghhef.dll --a------ 2007-08-10 09:18 31254 C:\WINDOWS\system32\hgghhef.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmkhg]
C:\WINDOWS\system32\pmkhg.dll --a------ 2007-08-10 09:23 231520 C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-10 19:07:01 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-11 22:05:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-11 22:10:09 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-11 22:10
C:\ComboFix2.txt ... 2007-07-18 11:36
C:\ComboFix3.txt ... 2007-07-18 11:22

--- E O F ---
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Sponsored Links
Old 08-12-2007, 07:06 PM   #2 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
HI...

Yes you do have some things to fix...

Please download VundoFix.exe to your desktop.
  • Double-click VundoFix.exe to run it.
  • Put a check next to Run VundoFix as a task.
  • You will receive a message saying vundofix will close and re-open in a minute or less. Click OK
  • When VundoFix re-opens, click the Scan for Vundo button.
  • Once it's done scanning, click the Remove Vundo button.
  • You will receive a prompt asking if you want to remove the files, click YES
  • Once you click yes, your desktop will go blank as it starts removing Vundo.
  • When completed, it will prompt that it will shutdown your computer, click OK.
  • Turn your computer back on.
  • Please post the contents of C:\vundofix.txt and a new HiJackThis log.
=================================

Will you then re-run ComboFix, posting it along with the vundofix.txt and a new HJT log.
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-12-2007, 08:18 PM   #3 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hi,

here is my vundofix file, hihack this file and combo fix file.

Thank you.
VundoFix V6.5.7

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 9:31:17 PM 8/12/2007

Listing files found while scanning....

C:\windows\system32\bluovwxw.dll
C:\windows\system32\gebaaby.dll
C:\WINDOWS\system32\ghkmp.bak1
C:\WINDOWS\system32\ghkmp.bak2
C:\WINDOWS\system32\ghkmp.ini
C:\windows\system32\hchbjnxt.ini
C:\WINDOWS\system32\hgghhef.dll
C:\WINDOWS\system32\pmkhg.dll
C:\windows\system32\txnjbhch.dll
C:\WINDOWS\system32\wxvhaeif.dll
C:\windows\system32\wxwvoulb.ini
C:\windows\system32\xxyyaby.dll

Beginning removal...

Attempting to delete C:\windows\system32\bluovwxw.dll
C:\windows\system32\bluovwxw.dll Has been deleted!

Attempting to delete C:\windows\system32\gebaaby.dll
C:\windows\system32\gebaaby.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\ghkmp.bak1
C:\WINDOWS\system32\ghkmp.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ghkmp.bak2
C:\WINDOWS\system32\ghkmp.bak2 Has been deleted!

Attempting to delete C:\WINDOWS\system32\ghkmp.ini
C:\WINDOWS\system32\ghkmp.ini Has been deleted!

Attempting to delete C:\windows\system32\hchbjnxt.ini
C:\windows\system32\hchbjnxt.ini Has been deleted!

Attempting to delete C:\WINDOWS\system32\hgghhef.dll
C:\WINDOWS\system32\hgghhef.dll Could not be deleted.

Attempting to delete C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmkhg.dll Has been deleted!

Attempting to delete C:\windows\system32\txnjbhch.dll
C:\windows\system32\txnjbhch.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\wxvhaeif.dll
C:\WINDOWS\system32\wxvhaeif.dll Has been deleted!

Attempting to delete C:\windows\system32\wxwvoulb.ini
C:\windows\system32\wxwvoulb.ini Has been deleted!

Attempting to delete C:\windows\system32\xxyyaby.dll
C:\windows\system32\xxyyaby.dll Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.5.7

Checking Java version...

Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.

Scan started at 9:43:59 PM 8/12/2007

Listing files found while scanning....

C:\windows\system32\hgghhef.dll

Beginning removal...

Attempting to delete C:\windows\system32\hgghhef.dll
C:\windows\system32\hgghhef.dll Has been deleted!

Performing Repairs to the registry.
Done!
Deckard's System Scanner v20070711.54
Run by Mom on 2007-08-12 at 21:55:06
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis Clone ------------------------------------------------------------

Emulating logfile of HijackThis v1.99.1
Scan saved at 2007-08-12 21:55:36
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (6.00.2900.2180)

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\system32\WLTRYSVC.EXE
C:\WINDOWS\system32\BCMWLTRY.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\SmFycm9k\command.exe
C:\WINDOWS\system32\cmivcwsv.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\McAfee.com\Agent\Mcdetect.exe
C:\Program Files\McAfee.com\VSO\McShield.exe
C:\Program Files\McAfee.com\Agent\McTskshd.exe
C:\WINDOWS\explorer.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
C:\Program Files\McAfee.com\VSO\mcvsshld.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\Network Monitor\netmon.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee\SpamKiller\MSKAgent.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\ComPlus Applications\vihorug22011.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\retadpu77.exe
C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe
C:\Program Files\NetWaiting\netwaiting.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Common Files\W?nSxS\alg.exe
C:\Documents and Settings\Mom\Application Data\WinTouch\WinTouch.exe
C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe
C:\Program Files\Common Files\ukqw\ukqwm.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\McAfee.com\Personal Firewall\MpfAgent.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Program Files\Common Files\ukqw\ukqwa.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\alg.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\Mom\Desktop\dss.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/search?q=%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O2 - BHO: 0 - {4EE12DE6-FBEF-469F-65AC-24F3CF35EDE5} - C:\Program Files\Common Files\zyliv944.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: (no name) - {770D2125-C293-4531-AA78-53BFEEEB49BF} - C:\WINDOWS\system32\pmkhg.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - C:\Program Files\McAfee.com\VSO\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKLM\..\Run: [vihorug] C:\Program Files\ComPlus Applications\vihorug22011.exe
O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [Salestart] "C:\Program Files\Common Files\WinAntiSpyware 2007\WAS7Mon.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Sen] "C:\PROGRA~1\COMMON~1\WNSXS~1\alg.exe" -vt yazb
O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Mom\Application Data\WinTouch\WinTouch.exe
O4 - HKCU\..\Run: [SfKg6w] C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe
O4 - HKCU\..\Run: [ukqw] C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - (no file)
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - C:\Program Files\McAfee\SpamKiller\McApfBHO.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (file missing)
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra 'Tools' menuitem: (no name) - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: https://online.musicmatch.com (HKLM)
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} () - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - "C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe"
O23 - Service: Apple Mobile Device - Apple, Inc. - "C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\SmFycm9k\command.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\cmivcwsv.exe /service
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\Mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - C:\Program Files\McAfee.com\VSO\McShield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\McTskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\Program Files\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\Program Files\McAfee.com\Personal Firewall\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\Program Files\McAfee\SpamKiller\MSKSrvr.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe service
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE %SystemRoot%\System32\bcmwltry.exe


-- Files created between 2007-07-12 and 2007-08-12 -----------------------------

2007-08-12 21:48:49 246 --a------ C:\Program Files\Common Files\zyliv944
2007-08-12 21:48:27 70144 --a------ C:\Program Files\Common Files\zyliv944.dll
2007-08-12 21:31:17 0 d-------- C:\VundoFix Backups
2007-08-12 2148 0 d-------- C:\WINDOWS\ukqw
2007-08-12 2148 127578 --a------ C:\WINDOWS\system32\tsuninst.exe
2007-08-12 2148 0 d-------- C:\Program Files\Common Files\ukqw
2007-08-12 2141 70144 --a------ C:\Program Files\Common Files\zyliv782.dll
2007-08-12 15:04:54 70144 --a------ C:\Program Files\Common Files\zyliv173.dll
2007-08-12 15:04:46 0 d-------- C:\Documents and Settings\Mom\Application Data\WinTouch
2007-08-12 14:52:54 0 d-------- C:\Documents and Settings\LocalService\Application Data\NetMon
2007-08-12 14:46:54 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Google
2007-08-12 14:46:53 0 d-------- C:\Documents and Settings\NetworkService\Application Data\BayScribe
2007-08-12 14:46:52 0 dr------- C:\Documents and Settings\NetworkService\Favorites
2007-08-12 14:18:02 687592 --a------ C:\WINDOWS\system32\atmtd.dll
2007-08-12 14:17:56 0 d-------- C:\Documents and Settings\NetworkService\Application Data\NetMon
2007-08-12 14:17:51 32177 ---hs---- C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
2007-08-12 14:17:50 1989 --a------ C:\WINDOWS\uninstall_nmon.vbs
2007-08-12 14:17:50 0 d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17:50 0 d-------- C:\Program Files\Network Monitor
2007-08-12 14:17:48 0 d-------- C:\Program Files\Common Files\W?nSxS
2007-08-12 14:17:07 0 d-------- C:\Documents and Settings\Mom\Application Data\WinAntiSpyware 2007
2007-08-12 14:16:54 0 dr------- C:\Documents and Settings\All Users\Application Data\SalesMonitor
2007-08-12 14:16:51 79872 --a------ C:\WINDOWS\system32\drivers\FOPN.sys <Not Verified; Windows (R) Codename Longhorn DDK provider; Windows (R) Codename Longhorn DDK driver>
2007-08-12 14:16:40 0 d-------- C:\Program Files\Common Files\WinAntiSpyware 2007
2007-08-12 14:16:38 0 d-------- C:\Documents and Settings\All Users\Application Data\WinAntiSpyware 2007
2007-08-12 14:14:44 0 d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:14:30 39424 --a------ C:\WINDOWS\retadpu77.exe
2007-08-12 14:14:29 0 d-------- C:\Program Files\svhost
2007-08-12 14:14:17 37888 --a------ C:\WINDOWS\svhost.exe <Not Verified; ; svhost>
2007-08-12 14:00:37 75328 --a------ C:\WINDOWS\system32\cmivcwsv.exe <Not Verified; ; DDC>
2007-08-12 14:00:11 70144 --a------ C:\Program Files\Common Files\zyliv496.dll
2007-08-11 22:09:07 70144 --a------ C:\Program Files\Common Files\zyliv.dll
2007-08-11 22:08:58 135168 --a------ C:\WINDOWS\tk58.exe
2007-08-11 21:41:06 246 --a------ C:\Program Files\Common Files\zyliv874
2007-08-10 11:03:08 0 --a------ C:\Documents and Settings\Mom\721876
2007-08-10 10:57:57 69184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51:51 75328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe <Not Verified; ; DDC>
2007-08-10 09:27:45 52766 --a------ C:\WINDOWS\system32\ljdsrngr.exe <Not Verified; ; Browser Driver>
2007-08-10 09:26:20 9769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18:22 756352 -r-hs---- C:\WINDOWS\vjcwogxA.exe <Not Verified; System Service; System Monitor Service>
2007-08-10 09:18:18 54784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18:14 192582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18:11 0 d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18:07 52747 --a------ C:\WINDOWS\system32\dwdsrngt.exe <Not Verified; ; Browser Driver>
2007-08-10 09:18:06 0 d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18:05 0 d-------- C:\Temp
2007-08-09 15:54:29 0 d-------- C:\Documents and Settings\James\Application Data\Leadertech
2007-08-09 13:42:26 1421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12:04 0 d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:09:12 0 d-------- C:\WINDOWS\ShellNew
2007-08-05 18:05:17 0 d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04:09 0 d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49:36 0 d-------- C:\Documents and Settings\James\Application Data\CyberLink
2007-07-28 22:40:24 0 d-------- C:\Documents and Settings\James\Application Data\AdobeUM
2007-07-28 22:40:16 0 d-------- C:\Documents and Settings\James\Application Data\Adobe
2007-07-27 17:57:07 0 d-------- C:\Documents and Settings\James\Application Data\Apple Computer
2007-07-25 21:23:54 41984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23:54 0 d-------- C:\Program Files\Xtreme Desktop
2007-07-25 21:23:39 0 d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42:18 0 d-------- C:\Documents and Settings\Mom\Application Data\acccore
2007-07-21 11:37:16 0 d---s---- C:\Documents and Settings\James\UserData
2007-07-18 21:58:26 0 d-------- C:\Documents and Settings\Jill\Application Data\acccore
2007-07-18 13:04:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-07-18 13:04:54 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-17 12:23:36 118784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL <Not Verified; Microsoft Corporation; MSSTDFMT Object Library>
2007-07-17 12:23:35 0 d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18:35 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57:03 0 d-------- C:\Program Files\Lavasoft
2007-07-16 19:57:03 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-07-16 19:55:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41:33 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29:21 0 d-------- C:\Program Files\EA GAMES


-- Find3M Report ---------------------------------------------------------------

2007-08-12 14:51:57 0 d-------- C:\Program Files\Dell
2007-08-12 14:48:28 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-08-12 14:17:48 0 d-------- C:\Program Files\Common Files\W?nSxS
2007-08-10 0952 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 0950 88 -r-hs---- C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 18:15:12 0 d-------- C:\Documents and Settings\Mom\Application Data\BayScribe
2007-07-28 0422 135 --a------ C:\Program Files\Common Files\dirtok.html
2007-07-19 11:16:49 0 d-------- C:\Program Files\DocQscribe
2007-07-17 22:12:37 0 d-------- C:\Program Files\Windows NT
2007-07-17 11:39:31 0 d-------- C:\Program Files\Winamp
2007-07-17 11:39:17 0 d-------- C:\Program Files\SmartFTP Client
2007-07-17 11:38:40 0 d-------- C:\Program Files\NetWaiting
2007-07-17 11:38:11 0 d-------- C:\Program Files\MSN Messenger
2007-07-17 11:37:58 0 d-------- C:\Program Files\Messenger
2007-07-17 11:37:30 0 d-------- C:\Program Files\iTunes
2007-07-17 11:37:04 0 d-------- C:\Program Files\Google
2007-07-17 11:36:41 0 d-------- C:\Program Files\Digital Line Detect
2007-07-17 11:36:41 0 d-------- C:\Program Files\DellSupport
2007-07-17 11:35:55 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-17 11:35:19 0 d-------- C:\Program Files\BayScribe
2007-07-11 02:29:38 22016 --a------ C:\WINDOWS\b138.exe
2007-07-11 02:29:38 28160 --a------ C:\WINDOWS\b103.exe
2007-07-01 17:29:58 0 d-------- C:\Program Files\iPod
2007-07-01 17:29:36 0 d-------- C:\Program Files\QuickTime
2007-07-01 17:28:55 0 d-------- C:\Program Files\Apple Software Update
2007-07-01 17:28:27 0 d-------- C:\Program Files\Common Files\Apple
2007-07-01 17:09:00 0 d-------- C:\Program Files\Windows Media Connect 2
2007-06-30 16:47:11 0 d-------- C:\Documents and Settings\Mom\Application Data\Skype
2007-06-28 16:54:26 0 d-------- C:\Program Files\Skype
2007-06-28 16:54:22 0 d-------- C:\Program Files\Common Files\Skype
2007-06-27 09:04:14 0 d-------- C:\Program Files\Online Services
2007-06-26 16:27:04 0 d-------- C:\Documents and Settings\Mom\Application Data\Corel Photo Album
2007-06-25 09:43:45 0 d-------- C:\Documents and Settings\Mom\Application Data\AdobeUM
2007-06-23 22:47:19 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-23 22:43:44 0 d-------- C:\Program Files\MSXML 4.0
2007-06-23 16:02:00 0 d-------- C:\Program Files\Real
2007-06-22 11:52:32 0 d-------- C:\Program Files\AIM6
2007-06-22 11:52:03 0 d-------- C:\Program Files\Common Files\AOL
2007-06-21 08:46:13 0 d-------- C:\Documents and Settings\Mom\Application Data\CyberLink
2007-06-21 08:05:28 0 d-------- C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 07:45:35 0 d-------- C:\Program Files\Common Files\Adobe
2007-06-21 07:45:35 0 d-------- C:\Documents and Settings\Mom\Application Data\Adobe
2007-06-21 07:42:06 0 d-------- C:\Documents and Settings\Mom\Application Data\Macromedia
2007-06-21 07:41:53 0 d-------- C:\Documents and Settings\Mom\Application Data\GTek
2007-06-21 07:40:50 0 d-------- C:\Documents and Settings\Mom\Application Data\Google
2007-06-21 07:36:26 0 d-------- C:\Documents and Settings\Mom\Application Data\McAfee.com Personal Firewall
2007-06-20 19:09:57 0 d-------- C:\Program Files\Audacity
2007-06-20 18:53:16 0 d-------- C:\Program Files\McAfee
2007-06-20 18:53:07 0 d-------- C:\Program Files\McAfee.com
2007-06-20 18:51:36 0 d-------- C:\Program Files\Corel Corporation
2007-06-20 18:51:10 0 d-------- C:\Program Files\Corel
2007-06-20 18:51:10 0 d-------- C:\Program Files\Common Files\Corel
2007-06-20 18:50:15 0 d-------- C:\Program Files\MUSICMATCH
2007-06-20 18:49:43 0 d-------- C:\Program Files\Common Files\InstallShield
2007-06-20 18:49:03 0 d-------- C:\Program Files\Norton Ghost
2007-06-20 18:48:10 0 d-------- C:\Documents and Settings\Mom\Application Data\Symantec
2007-06-20 18:47:58 0 d-------- C:\Program Files\Symantec
2007-06-20 18:47:01 0 d-------- C:\Program Files\Common Files\Sonic Shared
2007-06-20 18:46:36 0 d-------- C:\Program Files\Sonic
2007-06-20 18:46:29 0 d-------- C:\Program Files\EarthLink Setup
2007-06-20 18:46:22 0 d-------- C:\Program Files\America Online 9.0
2007-06-20 18:46:21 0 d-------- C:\Program Files\AOL Companion
2007-06-20 18:46:18 0 d-------- C:\Program Files\Common Files\aolshare
2007-06-20 18:46:08 0 d-------- C:\Program Files\Common Files\Nullsoft
2007-06-20 18:46:04 0 d-------- C:\Program Files\Common Files\Real
2007-06-20 18:45:08 335 --a------ C:\WINDOWS\nsreg.dat
2007-06-20 18:45:04 0 d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 18:45:02 0 d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 18:43:00 0 d-------- C:\Program Files\CyberLink
2007-06-20 18:42:36 0 d-------- C:\Program Files\Modem Helper
2007-06-20 18:41:42 0 d-------- C:\Program Files\Broadcom
2007-06-20 18:41:19 0 d-------- C:\Program Files\Synaptics
2007-06-20 18:41:06 0 d-------- C:\Documents and Settings\Mom\Application Data\InstallShield
2007-06-20 18:39:31 0 d-------- C:\Program Files\CONEXANT
2007-06-20 18:36:13 0 d-------- C:\Documents and Settings\Mom\Application Data\Sun
2007-06-20 18:36:11 0 d-------- C:\Program Files\Java
2007-06-20 18:36:00 0 d-------- C:\Program Files\Common Files\Java


-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
{41D68ED8-4CFF-4115-88A6-6EBB8AF19000} c:\program files\mcafee\spamkiller\mcapfbho.dll
{4EE12DE6-FBEF-469F-65AC-24F3CF35EDE5} C:\Program Files\Common Files\zyliv944.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\system32\dla\tfswshx.dll
{5E028439-81C7-4B82-BC74-25156306F532} C:\Program Files\BayScribe\bayscribe.dll
{770D2125-C293-4531-AA78-53BFEEEB49BF} C:\WINDOWS\system32\pmkhg.dll [x]
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar1.dll
{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SigmatelSysTrayApp"="stsystra.exe"
"PCMService"="\"C:\\Program Files\\Dell\\Media Experience\\PCMService.exe\""
"DVDLauncher"="\"C:\\Program Files\\CyberLink\\PowerDVD\\DVDLauncher.exe\""
"ISUSPM Startup"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\isuspm.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"Norton Ghost 10.0"="\"C:\\Program Files\\Norton Ghost\\Agent\\GhostTray.exe\""
@=""
"VSOCheckTask"="\"C:\\PROGRA~1\\McAfee.com\\VSO\\mcmnhdlr.exe\" /checktask"
"OASClnt"="C:\\Program Files\\McAfee.com\\VSO\\oasclnt.exe"
"MCAgentExe"="c:\\PROGRA~1\\mcafee.com\\agent\\mcagent.exe"
"MCUpdateExe"="C:\\PROGRA~1\\mcafee.com\\agent\\McUpdate.exe"
"MSKDetectorExe"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MSKDetct.exe /startup"
"MSKAGENTEXE"="C:\\PROGRA~1\\McAfee\\SPAMKI~1\\MskAgent.exe"
"VirusScan Online"="c:\\PROGRA~1\\mcafee.com\\vso\\mcvsshld.exe"
"MPFExe"="C:\\PROGRA~1\\McAfee.com\\PERSON~1\\MpfTray.exe"
"WinampAgent"="C:\\Program Files\\Winamp\\winampa.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"XDc"="C:\\Program Files\\Xtreme Desktop\\xdc\\startxdc.exe"
"WorksFUD"="C:\\Program Files\\Microsoft Works\\wkfud.exe"
"Microsoft Works Portfolio"="C:\\Program Files\\Microsoft Works\\WksSb.exe /AllUsers"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Photo Album 6\\MediaDetect.exe"
"vihorug"="C:\\Program Files\\ComPlus Applications\\vihorug22011.exe"
"svhost"="\"C:\\WINDOWS\\svhost.exe\""
"runner1"="C:\\WINDOWS\\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A"
"Salestart"="\"C:\\Program Files\\Common Files\\WinAntiSpyware 2007\\WAS7Mon.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ModemOnHold"="C:\\Program Files\\NetWaiting\\netWaiting.exe"
"DellSupport"="\"C:\\Program Files\\DellSupport\\DSAgnt.exe\" /startup"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"Sen"="\"C:\\PROGRA~1\\COMMON~1\\WNSXS~1\\alg.exe\" -vt yazb"
"WinTouch"="C:\\Documents and Settings\\Mom\\Application Data\\WinTouch\\WinTouch.exe"
"SfKg6w"="C:\\Documents and Settings\\Mom\\Application Data\\Microsoft\\Windows\\sunvj.exe"
"ukqw"="C:\\PROGRA~1\\COMMON~1\\ukqw\\ukqwm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source REG_SZ C:\Program Files\Common Files\dirtok.html

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"=""

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
Shell\AutoRun\command F:\setupSNK.exe


-- End of Deckard's System Scanner: finished at 2007-08-12 at 21:56:02 ---------
"Mom" - 2007-08-12 21:56:45 - ComboFix 07-07-17.8 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\Abbr
C:\DOCUME~1\ALLUSE~1\APPLIC~1.\winantispyware 2007\Data\ProductCode
C:\DOCUME~1\Mom\APPLIC~1.\winantispyware 2007
C:\DOCUME~1\Mom\APPLIC~1.\winantispyware 2007\Logs\update.log
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\wintouch.cfg
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\WinTouch.exe
C:\DOCUME~1\Mom\APPLIC~1\WinTouch\WTUninstaller.exe
C:\Program Files\Common Files\dirtok.html
C:\Program Files\Common Files\winantispyware 2007
C:\Program Files\Common Files\winantispyware 2007\err.log
C:\Program Files\Common Files\winantispyware 2007\uwas7cw.exe
C:\Program Files\Common Files\winantispyware 2007\WAS7Mon.exe
C:\Program Files\Common Files\wnsxs~1
C:\Program Files\Common Files\wnsxs~1\alg.exe
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\zyliv.dll
C:\Program Files\Common Files\zyliv173.dll
C:\Program Files\Common Files\zyliv496.dll
C:\Program Files\Common Files\zyliv782.dll
C:\Program Files\Common Files\zyliv944.dll
C:\Program Files\network monitor
C:\Program Files\network monitor\netmon.exe
C:\Program Files\svhost
C:\Program Files\svhost\wr-1-0000077.exe
C:\WINDOWS\retadpu77.exe
C:\WINDOWS\SmFycm9k\asappsrv.dll
C:\WINDOWS\SmFycm9k\command.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\drivers\fopn.sys
C:\WINDOWS\system32\tsuninst.exe
C:\WINDOWS\tk58.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\wr.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CMDSERVICE
-------\LEGACY_DOMAINSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\cmdService
-------\DomainService
-------\Network Monitor


((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))


2007-08-12 21:31 <DIR> d-------- C:\VundoFix Backups
2007-08-12 21:06 <DIR> d-------- C:\WINDOWS\ukqw
2007-08-12 21:06 <DIR> d-------- C:\Program Files\Common Files\ukqw
2007-08-12 14:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\BayScribe
2007-08-12 14:17 <DIR> d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-12 14:14 <DIR> d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:00 75,328 --a------ C:\WINDOWS\system32\cmivcwsv.exe
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 13:21 <DIR> d-------- C:\Deckard
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES
2007-07-13 14:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-13 14:56 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-13 02:51:49 246 ----a-w C:\Program Files\Common Files\zyliv944
2007-08-12 19:51:57 -------- d-----w C:\Program Files\Dell
2007-08-12 19:48:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-10 1452 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 1450 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-11 07:29:38 28,160 ----a-w C:\WINDOWS\b103.exe
2007-07-11 07:29:38 22,016 ----a-w C:\WINDOWS\b138.exe
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\SmFycm9k\mAIVwA64.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1A4DE1F2-CF89-4F5A-EAA6-7CBB4EE9114B}]
2007-08-12 22:03 70144 --a------ C:\Program Files\Common Files\zyliv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]
"vihorug"="C:\Program Files\ComPlus Applications\vihorug22011.exe" [2007-08-07 15:30]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"Sen"="C:\PROGRA~1\COMMON~1\WNSXS~1\alg.exe" []
"SfKg6w"="C:\Documents and Settings\Mom\Application Data\Microsoft\Windows\sunvj.exe" [2007-08-12 15:05]
"ukqw"="C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe" [2006-07-19 14:56]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-10 19:07:01 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-12 22:02:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-12 22:04:38 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-12 22:04
C:\ComboFix2.txt ... 2007-08-11 22:10

--- E O F ---
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-12-2007, 10:06 PM   #4 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
Ok....few more things to clean out.


Have "Hijack This" fix all the following items in the list below by placing a check in the appropriate boxes.Confirm that you have only the listed ones checked, then press <Fix checked> and Close HJT.

O2 - BHO: 0 - {316C3DC2-0EE5-4712-A690-BA0BE6D69BE4} - C:\Program Files\Common Files\zyliv.dll
O2 - BHO: (no name) - {CF46BFB3-2ACC-441b-B82B-36B9562C7FF1} - C:\WINDOWS\system32\wxvhaeif.dll
O2 - BHO: (no name) - {E959E770-16F3-4212-B0A9-328F636E93C3} - C:\WINDOWS\system32\pmkhg.dll
O2 - BHO: (no name) - {E9BD0828-1FD9-410C-A50F-43EBE65D310F} - C:\WINDOWS\system32\hgghhef.dll
O4 - HKLM\..\Run: [vihorug] C:\Program Files\ComPlus Applications\vihorug22011.exe
O4 - HKCU\..\Run: [SystemOptimizer] rundll32.exe "C:\WINDOWS\system32\bluovwxw.dll",forkonce
O20 - Winlogon Notify: hgghhef - C:\WINDOWS\system32\hgghhef.dll
O20 - Winlogon Notify: pmkhg - C:\WINDOWS\system32\pmkhg.dll

Reboot...............
==============================

Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.


1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


Open *notepad* and copy/paste the text in the quotebox below into it:


Quote:
File::
C:\Program Files\Common Files\zyliv944
C:\Program Files\Common Files\zyliv944.dll
C:\WINDOWS\ukqw
C:\WINDOWS\system32\tsuninst.exe
C:\Program Files\Common Files\ukqw
C:\Program Files\Common Files\zyliv782.dll
C:\Program Files\Common Files\zyliv173.dll
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\W?nSxSC:\WINDOWS\system32\f10WtR
C:\WINDOWS\retadpu77.exe
C:\Program Files\svhost
C:\WINDOWS\svhost.exe
C:\Program Files\Common Files\zyliv496.dll
C:\Program Files\Common Files\zyliv.dll
C:\WINDOWS\tk58.exe
C:\Program Files\Common Files\zyliv874
C:\WINDOWS\system32\cojydbmm.dll
C:\WINDOWS\system32\xtkfqqqe.exe
C:\WINDOWS\system32\ljdsrngr.exe
C:\WINDOWS\rassb0578.exe
C:\WINDOWS\vjcwogxA.exe
C:\WINDOWS\vjcwogx.exe
C:\WINDOWS\system32\mwinkmdt.exe
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\b138.exe
C:\WINDOWS\b103.exe
Folder::
C:\VundoFix Backups
Save this as *CFScript.txt*, in the same location as ComboFix.exe


Image: http://img.photobucket.com/albums/v6...s/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt*

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*


===================================================
Please post back ...

C:\ComboFix.txt and a New HijackThis log
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 06:15 PM   #5 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hello,
My highjack this does not offer me those options to check. Am I doing something wrong?

Thanks, Dan
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 06:55 PM   #6 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
All you have to do is tick the box next to the entry to be removed and the at the bottom, hit "Fix checked"
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 08:06 PM   #7 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hi, I just want to make sure I am doing the right thing. I had the Deckard scanner running highjack this. It just produced a log with no check box options. After I ran it again, it loaded a version of trend micro highjack this on my desktop. When I ran that one, it had the options box. But not all the options that you had listed in your previous post were there.
Just curious what I should do?

Thanks, Dan
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 08:22 PM   #8 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
OK.See if this is any easier for you.Download HJT and run the scan then do the fix..

http://www.majorgeeks.com/download3155.html
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 10:01 PM   #9 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hello,

Here is my hijack this file and combofix file.

Thanks, Dan

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:53:13 PM, on 8/13/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\GEARSec.exe
c:\program files\mcafee.com\agent\mcdetect.exe
C:\WINDOWS\Explorer.EXE
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
c:\PROGRA~1\mcafee.com\vso\OasClnt.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
c:\program files\mcafee.com\agent\mcagent.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\PROGRA~1\COMMON~1\ukqw\ukqwa.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ukqw] C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - C:\Program Files\Common Files\dirtok.html

--
End of file - 10275 bytes


"Mom" - 2007-08-13 23:33:09 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Mom\Desktop\CFScrpt.txt


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\dirtok.html
C:\Program Files\Common Files\zyliv.dll
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\winpfz32.sys
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\tk58.exe


((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 )))))))))))))))))))))))))))))))


2007-08-13 23:32 6,810 ---hs---- C:\WINDOWS\system32\fgjlm.bak2
2007-08-13 23:06 <DIR> d-------- C:\Deckard
2007-08-13 22:21 231,520 --------- C:\WINDOWS\system32\mljgf.dll
2007-08-13 22:16 31,254 --a------ C:\WINDOWS\system32\efcyvuu.dll
2007-08-13 22:16 192,579 --a------ C:\WINDOWS\system32\kwinpmdt.exe
2007-08-13 20:05 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-12 21:31 <DIR> d-------- C:\VundoFix Backups
2007-08-12 21:06 <DIR> d-------- C:\WINDOWS\ukqw
2007-08-12 21:06 <DIR> d-------- C:\Program Files\Common Files\ukqw
2007-08-12 14:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\BayScribe
2007-08-12 14:17 <DIR> d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-12 14:14 <DIR> d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:00 75,328 --a------ C:\WINDOWS\system32\cmivcwsv.exe
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES
2007-07-13 14:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-07-13 14:56 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-14 04:15:50 246 ----a-w C:\Program Files\Common Files\zyliv
2007-08-13 02:51:49 246 ----a-w C:\Program Files\Common Files\zyliv944
2007-08-12 19:51:57 -------- d-----w C:\Program Files\Dell
2007-08-12 19:48:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-10 1452 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 1450 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-11 07:29:38 28,160 ----a-w C:\WINDOWS\b103.exe
2007-07-11 07:29:38 22,016 ----a-w C:\WINDOWS\b138.exe
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\SmFycm9k\mAIVwA64.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C8B5E32-E4A7-44DD-BC81-82C7BCF3E50D}]
2007-08-13 22:21 231520 --------- C:\WINDOWS\system32\mljgf.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"ukqw"="C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe" [2006-07-19 14:56]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"="C:\WINDOWS\system32\efcyvuu.dll" [2007-08-13 22:16]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcyvuu]
efcyvuu.dll --a------ 2007-08-13 22:16 31254 C:\WINDOWS\system32\efcyvuu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljgf]
C:\WINDOWS\system32\mljgf.dll --------- 2007-08-13 22:21 231520 C:\WINDOWS\system32\mljgf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-13 17:29:41 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-13 23:37:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-13 23:39:16
C:\ComboFix-quarantined-files.txt ... 2007-08-13 23:39
C:\ComboFix2.txt ... 2007-08-12 22:04
C:\ComboFix3.txt ... 2007-08-11 22:10

--- E O F ---
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 10:02 PM   #10 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
please disregard this post
Last edited by danster64; 08-13-2007 at 10:10 PM. Reason: duplicate post
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 10:05 PM   #11 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Please disregard this one also

Thanks, Dan
Last edited by danster64; 08-13-2007 at 10:14 PM. Reason: duplicate post
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-13-2007, 10:38 PM   #12 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
And still more to come out...Cant understand where they are all coming from.We may have to do more Vundo fixing if this does not fix them this time..

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


Open *notepad* and copy/paste the text in the quotebox below into it:


Quote:
File::
C:\WINDOWS\system32\fgjlm.bak2
C:\WINDOWS\system32\mljgf.dll
C:\WINDOWS\system32\efcyvuu.dll
C:\WINDOWS\system32\kwinpmdt.exe
C:\WINDOWS\system32\cmivcwsv.exe
C:\WINDOWS\system32\cojydbmm.dll
C:\WINDOWS\system32\xtkfqqqe.exe
C:\WINDOWS\system32\ljdsrngr.exe
C:\WINDOWS\rassb0578.exe
C:\WINDOWS\vjcwogxA.exe
C:\WINDOWS\vjcwogx.exe
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\mwinkmdt.exe
C:\Program Files\Common Files\zyliv
C:\Program Files\Common Files\zyliv944
C:\WINDOWS\b103.exe
C:\WINDOWS\b138.exe

Folder::
C:\VundoFix Backups
C:\WINDOWS\ukqw
C:\Program Files\Common Files\ukqw
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\configs
C:\Temp\fse
C:\Temp\1cb

DirLook::
C:\Temp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0C8B5E32-E4A7-44DD-BC81-82C7BCF3E50D}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ukqw"=-
[-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcyvuu]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljgf]
Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt*

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-14-2007, 07:39 PM   #13 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hi,

Here is what I have from Combofix after doing what you instructed in the last post.

Thanks, Dan

"Mom" - 2007-08-14 21:16:40 - ComboFix 07-07-17.8 - Service Pack 2 NTFS
Command switches used :: C:\Documents and Settings\Mom\Desktop\CFScrpt.txt


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 )))))))))))))))))))))))))))))))


2007-08-14 21:20 69,184 --a------ C:\WINDOWS\system32\olcbeanq.dll
2007-08-14 21:12 75,328 --a------ C:\WINDOWS\system32\mbwsgswy.exe
2007-08-13 23:32 1,684,901 ---hs---- C:\WINDOWS\system32\fgjlm.bak2
2007-08-13 23:06 <DIR> d-------- C:\Deckard
2007-08-13 22:21 231,520 --------- C:\WINDOWS\system32\mljgf.dll
2007-08-13 22:16 31,254 --a------ C:\WINDOWS\system32\efcyvuu.dll
2007-08-13 22:16 192,579 --a------ C:\WINDOWS\system32\kwinpmdt.exe
2007-08-13 20:05 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-12 21:31 <DIR> d-------- C:\VundoFix Backups
2007-08-12 21:06 <DIR> d-------- C:\WINDOWS\ukqw
2007-08-12 21:06 <DIR> d-------- C:\Program Files\Common Files\ukqw
2007-08-12 14:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\BayScribe
2007-08-12 14:17 <DIR> d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-12 14:14 <DIR> d-------- C:\WINDOWS\system32\f10WtR
2007-08-12 14:00 75,328 --a------ C:\WINDOWS\system32\cmivcwsv.exe
2007-08-10 10:57 69,184 --a------ C:\WINDOWS\system32\cojydbmm.dll
2007-08-10 10:51 75,328 --a------ C:\WINDOWS\system32\xtkfqqqe.exe
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:26 9,769 --a------ C:\WINDOWS\rassb0578.exe
2007-08-10 09:18 756,352 -r-hs---- C:\WINDOWS\vjcwogxA.exe
2007-08-10 09:18 54,784 --a------ C:\WINDOWS\vjcwogx.exe
2007-08-10 09:18 52,747 --a------ C:\WINDOWS\system32\dwdsrngt.exe
2007-08-10 09:18 192,582 --a------ C:\WINDOWS\system32\mwinkmdt.exe
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\f02WtR
2007-08-10 09:18 <DIR> d-------- C:\WINDOWS\system32\configs
2007-08-10 09:18 <DIR> d-------- C:\Temp\fse
2007-08-10 09:18 <DIR> d-------- C:\Temp\1cb
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d-------- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-15 02:26:51 125,504 ----a-w C:\WINDOWS\system32\kjvjlkcf.dll
2007-08-14 04:15:50 246 ----a-w C:\Program Files\Common Files\zyliv
2007-08-13 02:51:49 246 ----a-w C:\Program Files\Common Files\zyliv944
2007-08-12 19:51:57 -------- d-----w C:\Program Files\Dell
2007-08-12 19:48:28 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-08-12 02:55:28 246 ----a-w C:\Program Files\Common Files\zyliv874
2007-08-10 1452 3,766 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-10 1450 88 --sh--r C:\WINDOWS\system32\94F63881E8.sys
2007-08-07 23:15:12 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-19 16:16:49 -------- d-----w C:\Program Files\DocQscribe
2007-07-18 03:12:37 -------- d-----w C:\Program Files\Windows NT
2007-07-17 16:39:31 -------- d-----w C:\Program Files\Winamp
2007-07-17 16:39:17 -------- d-----w C:\Program Files\SmartFTP Client
2007-07-17 16:38:40 -------- d-----w C:\Program Files\NetWaiting
2007-07-17 16:38:11 -------- d-----w C:\Program Files\MSN Messenger
2007-07-17 16:37:58 -------- d-----w C:\Program Files\Messenger
2007-07-17 16:37:30 -------- d-----w C:\Program Files\iTunes
2007-07-17 16:37:04 -------- d-----w C:\Program Files\Google
2007-07-17 16:36:41 -------- d-----w C:\Program Files\Digital Line Detect
2007-07-17 16:36:41 -------- d-----w C:\Program Files\DellSupport
2007-07-17 16:35:55 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-07-17 16:35:19 -------- d-----w C:\Program Files\BayScribe
2007-07-14 22:41:39 12,400 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-11 07:29:38 28,160 ----a-w C:\WINDOWS\b103.exe
2007-07-11 07:29:38 22,016 ----a-w C:\WINDOWS\b138.exe
2007-07-01 22:29:58 -------- d-----w C:\Program Files\iPod
2007-07-01 22:29:36 -------- d-----w C:\Program Files\QuickTime
2007-07-01 22:28:55 -------- d-----w C:\Program Files\Apple Software Update
2007-07-01 22:28:27 -------- d-----w C:\Program Files\Common Files\Apple
2007-07-01 22:09:00 -------- d-----w C:\Program Files\Windows Media Connect 2
2007-06-30 21:47:11 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 21:54:26 -------- d-----w C:\Program Files\Skype
2007-06-28 21:54:22 -------- d-----w C:\Program Files\Common Files\Skype
2007-06-27 14:04:14 -------- d-----w C:\Program Files\Online Services
2007-06-26 21:27:04 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 14:43:45 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-24 03:47:19 -------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-24 03:43:44 -------- d-----w C:\Program Files\MSXML 4.0
2007-06-23 21:02:00 -------- d-----w C:\Program Files\Real
2007-06-22 16:52:32 -------- d-----w C:\Program Files\AIM6
2007-06-22 16:52:03 -------- d-----w C:\Program Files\Common Files\AOL
2007-06-21 13:46:13 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 13:05:28 -------- d-----w C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 12:41:53 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 12:40:50 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 12:36:26 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-21 00:09:57 -------- d-----w C:\Program Files\Audacity
2007-06-20 23:53:16 -------- d-----w C:\Program Files\McAfee
2007-06-20 23:53:07 -------- d-----w C:\Program Files\McAfee.com
2007-06-20 23:51:36 -------- d-----w C:\Program Files\Corel Corporation
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Corel
2007-06-20 23:51:10 -------- d-----w C:\Program Files\Common Files\Corel
2007-06-20 23:50:15 -------- d-----w C:\Program Files\MUSICMATCH
2007-06-20 23:49:43 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-20 23:49:04 4,608 ----a-w C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 23:49:03 -------- d-----w C:\Program Files\Norton Ghost
2007-06-20 23:48:10 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 23:47:58 -------- d-----w C:\Program Files\Symantec
2007-06-20 23:47:01 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-06-20 23:46:36 -------- d-----w C:\Program Files\Sonic
2007-06-20 23:46:29 -------- d-----w C:\Program Files\EarthLink Setup
2007-06-20 23:46:22 -------- d-----w C:\Program Files\America Online 9.0
2007-06-20 23:46:21 -------- d-----w C:\Program Files\AOL Companion
2007-06-20 23:46:18 -------- d-----w C:\Program Files\Common Files\aolshare
2007-06-20 23:46:08 -------- d-----w C:\Program Files\Common Files\Nullsoft
2007-06-20 23:46:04 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 23:46:04 -------- d-----w C:\Program Files\Common Files\Real
2007-06-20 23:45:08 335 ----a-w C:\WINDOWS\nsreg.dat
2007-06-20 23:45:04 -------- d-----w C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 23:45:02 -------- d-----w C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 23:43:00 -------- d-----w C:\Program Files\CyberLink
2007-06-20 23:42:36 -------- d-----w C:\Program Files\Modem Helper
2007-06-20 23:41:42 -------- d-----w C:\Program Files\Broadcom
2007-06-20 23:41:19 -------- d-----w C:\Program Files\Synaptics
2007-06-20 23:41:06 -------- d-----w C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 23:39:31 -------- d-----w C:\Program Files\CONEXANT
2007-06-20 01:47:50 6,171 ----a-w C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\SmFycm9k\mAIVwA64.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2003-11-03 14:17 54248 --a------ C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{41D68ED8-4CFF-4115-88A6-6EBB8AF19000}]
2005-07-12 18:02 262236 --a------ c:\program files\mcafee\spamkiller\mcapfbho.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5CA3D70E-1895-11CF-8E15-001234567890}]
2004-12-06 01:05 118842 --a------ C:\WINDOWS\system32\dla\tfswshx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9027850B-3AAF-4554-83A1-985786E28052}]
2007-08-13 22:21 231520 --------- C:\WINDOWS\system32\mljgf.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 20:33 322368 --a------ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
2007-06-20 22:05 2403392 -ra------ c:\program files\google\googletoolbar1.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
2007-07-04 23:08 325048 --a------ C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF46BFB3-2ACC-441b-B82B-36B9562C7FF1}]
2007-08-14 21:20 69184 --a------ C:\WINDOWS\system32\olcbeanq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E9BD0828-1FD9-410C-A50F-43EBE65D310F}]
2007-08-13 22:16 31254 --a------ C:\WINDOWS\system32\efcyvuu.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"@"="" []
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]
"SystemOptimizer"="C:\WINDOWS\system32\kjvjlkcf.dll" [2007-08-14 21:26]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"ukqw"="C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe" [2006-07-19 14:56]

C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E9BD0828-1FD9-410C-A50F-43EBE65D310F}"="C:\WINDOWS\system32\efcyvuu.dll" [2007-08-13 22:16]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcyvuu]
efcyvuu.dll --a------ 2007-08-13 22:16 31254 C:\WINDOWS\system32\efcyvuu.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljgf]
C:\WINDOWS\system32\mljgf.dll --------- 2007-08-13 22:21 231520 C:\WINDOWS\system32\mljgf.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-13 17:29:41 C:\WINDOWS\tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job

**************************************************************************

catchme 0.3.1040 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 21:24:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-14 21:28:49 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-14 21:28
C:\ComboFix2.txt ... 2007-08-13 23:39
C:\ComboFix3.txt ... 2007-08-12 22:04

--- E O F ---
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-14-2007, 08:55 PM   #14 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
Hi
I did not notice it but just been informed that you saved the combo script wrong.You saved it as C:\Documents and Settings\Mom\Desktop\CFScrpt.txt .
It should read ... as C:\Documents and Settings\Mom\Desktop\cfscript.txt (case insensitive) for it to work.

So what we will do is to go back and start a fresh.....

Delete your existing version of ComboFix now.

Next, do this:

Download combofix.exe to your desktop.
http://download.bleepingcomputer.com...a/ComboFix.exe

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
===========

Please post a new HJT log as well as the combo fix.
__________________
Eddy
Last edited by Pancake; 08-14-2007 at 09:04 PM.
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-14-2007, 09:35 PM   #15 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hi,

Here is latest highjack this with new combofix log.

Thanks, Dan


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:29:33 PM, on 8/14/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\GEARSec.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
C:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\AIM6\aim6.exe
C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
C:\PROGRA~1\COMMON~1\ukqw\ukqwa.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: (no name) - {770D2125-C293-4531-AA78-53BFEEEB49BF} - C:\WINDOWS\system32\pmkhg.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ukqw] C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - C:\Program Files\Common Files\dirtok.html

--
End of file - 11424 bytes


ComboFix 07-08-15.3 - "Mom" 2007-08-14 23:14:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.577 [GMT -5:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\ComPlus Applications\vihorug22011.exe
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\rassb0578.exe
C:\WINDOWS\system32\cmivcwsv.exe
C:\WINDOWS\system32\cojydbmm.dll
C:\WINDOWS\system32\configs
C:\WINDOWS\system32\dwdsrngt.exe
C:\WINDOWS\system32\efcyvuu.dll
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
C:\WINDOWS\system32\f10WtR
C:\WINDOWS\system32\f10WtR\f10WtR1099.exe
C:\WINDOWS\system32\fckljvjk.ini
C:\WINDOWS\system32\fgjlm.bak2
C:\WINDOWS\system32\fgjlm.ini
C:\WINDOWS\system32\kjvjlkcf.dll
C:\WINDOWS\system32\kwinpmdt.exe
C:\WINDOWS\system32\mbwsgswy.exe
C:\WINDOWS\system32\mljgf.dll
C:\WINDOWS\system32\mwinkmdt.exe
C:\WINDOWS\system32\olcbeanq.dll
C:\WINDOWS\system32\xtkfqqqe.exe
C:\WINDOWS\vjcwogx.exe
C:\WINDOWS\vjcwogxA.exe


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_FOPN
-------\ApiMon


((((((((((((((((((((((((( Files Created from 2007-07-15 to 2007-08-15 )))))))))))))))))))))))))))))))


2007-08-13 23:06 <DIR> d-------- C:\Deckard
2007-08-13 20:05 <DIR> d-------- C:\Program Files\Trend Micro
2007-08-12 21:31 <DIR> d-------- C:\VundoFix Backups
2007-08-12 21:06 <DIR> d-------- C:\WINDOWS\ukqw
2007-08-12 21:06 <DIR> d-------- C:\Program Files\Common Files\ukqw
2007-08-12 14:52 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\Google
2007-08-12 14:46 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\BayScribe
2007-08-12 14:17 <DIR> d--hs---- C:\WINDOWS\SmFycm9k
2007-08-12 14:17 <DIR> d-------- C:\DOCUME~1\NETWOR~1\APPLIC~1\NetMon
2007-08-10 09:27 52,766 --a------ C:\WINDOWS\system32\ljdsrngr.exe
2007-08-10 09:18 <DIR> d-------- C:\Temp
2007-08-09 15:54 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Leadertech
2007-08-09 13:42 1,421 --a------ C:\WINDOWS\checkip.dat
2007-08-05 18:12 <DIR> d-------- C:\Program Files\Microsoft Encarta
2007-08-05 18:09 <DIR> d--h----- C:\WINDOWS\ShellNew
2007-08-05 18:09 <DIR> d-------- C:\Program Files\Microsoft ActiveSync
2007-08-05 18:05 <DIR> d-------- C:\Program Files\Microsoft Works
2007-08-05 18:04 <DIR> d-------- C:\Program Files\Microsoft Works Suite 2002
2007-07-29 18:49 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\CyberLink
2007-07-28 22:40 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\AdobeUM
2007-07-27 17:57 <DIR> d-------- C:\DOCUME~1\James\APPLIC~1\Apple Computer
2007-07-25 21:23 41,984 --a------ C:\WINDOWS\system32\xd2.dll
2007-07-25 21:23 <DIR> d--hs---- C:\WINDOWS\ftpcache
2007-07-23 18:42 <DIR> d-------- C:\DOCUME~1\Mom\APPLIC~1\acccore
2007-07-21 11:37 <DIR> d---s---- C:\DOCUME~1\James\UserData
2007-07-18 21:58 <DIR> d-------- C:\DOCUME~1\Jill\APPLIC~1\acccore
2007-07-18 13:04 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-07-18 13:04 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-07-17 22:07 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-17 12:23 118,784 --a------ C:\WINDOWS\system32\MSSTDFMT.DLL
2007-07-17 12:23 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-07-16 23:18 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-07-16 19:57 <DIR> d-------- C:\Program Files\Lavasoft
2007-07-16 19:57 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-16 19:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-07-14 17:41 760 --a------ C:\WINDOWS\eReg.dat
2007-07-14 17:29 <DIR> d-------- C:\Program Files\EA GAMES


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-13 23:15 246 --a------ C:\Program Files\Common Files\zyliv
2007-08-12 21:51 246 --a------ C:\Program Files\Common Files\zyliv944
2007-08-12 14:51 --------- d-------- C:\Program Files\Dell
2007-08-12 14:48 --------- d--h----- C:\Program Files\InstallShield Installation Information
2007-08-11 21:55 246 --a------ C:\Program Files\Common Files\zyliv874
2007-08-10 09:06 88 -r-hs---- C:\WINDOWS\system32\94F63881E8.sys
2007-08-10 09:06 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2007-08-07 18:15 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\BayScribe
2007-07-19 11:16 --------- d-------- C:\Program Files\DocQscribe
2007-07-17 22:12 --------- d-------- C:\Program Files\Windows NT
2007-07-17 11:39 --------- d-------- C:\Program Files\Winamp
2007-07-17 11:39 --------- d-------- C:\Program Files\SmartFTP Client
2007-07-17 11:38 --------- d-------- C:\Program Files\NetWaiting
2007-07-17 11:38 --------- d-------- C:\Program Files\MSN Messenger
2007-07-17 11:37 --------- d-------- C:\Program Files\Messenger
2007-07-17 11:37 --------- d-------- C:\Program Files\iTunes
2007-07-17 11:37 --------- d-------- C:\Program Files\Google
2007-07-17 11:36 --------- d-------- C:\Program Files\Digital Line Detect
2007-07-17 11:36 --------- d-------- C:\Program Files\DellSupport
2007-07-17 11:35 --------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-07-17 11:35 --------- d-------- C:\Program Files\BayScribe
2007-07-14 17:41 12400 --a------ C:\WINDOWS\system32\drivers\secdrv.sys
2007-07-01 17:29 --------- d-------- C:\Program Files\QuickTime
2007-07-01 17:29 --------- d-------- C:\Program Files\iPod
2007-07-01 17:28 --------- d-------- C:\Program Files\Common Files\Apple
2007-07-01 17:28 --------- d-------- C:\Program Files\Apple Software Update
2007-07-01 17:09 --------- d-------- C:\Program Files\Windows Media Connect 2
2007-06-30 16:47 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\Skype
2007-06-28 16:54 --------- d-------- C:\Program Files\Skype
2007-06-28 16:54 --------- d-------- C:\Program Files\Common Files\Skype
2007-06-27 09:04 --------- d-------- C:\Program Files\Online Services
2007-06-26 16:27 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\Corel Photo Album
2007-06-25 09:43 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\AdobeUM
2007-06-23 22:47 --------- d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-06-23 22:43 --------- d-------- C:\Program Files\MSXML 4.0
2007-06-23 16:02 --------- d-------- C:\Program Files\Real
2007-06-22 11:52 --------- d-------- C:\Program Files\Common Files\AOL
2007-06-22 11:52 --------- d-------- C:\Program Files\AIM6
2007-06-21 08:46 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\CyberLink
2007-06-21 08:05 --------- d-------- C:\Program Files\Common Files\Philips Speech Shared
2007-06-21 07:41 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\GTek
2007-06-21 07:40 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\Google
2007-06-21 07:36 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\McAfee.com Personal Firewall
2007-06-20 19:09 --------- d-------- C:\Program Files\Audacity
2007-06-20 18:53 --------- d-------- C:\Program Files\McAfee.com
2007-06-20 18:53 --------- d-------- C:\Program Files\McAfee
2007-06-20 18:51 --------- d-------- C:\Program Files\Corel Corporation
2007-06-20 18:51 --------- d-------- C:\Program Files\Corel
2007-06-20 18:51 --------- d-------- C:\Program Files\Common Files\Corel
2007-06-20 18:50 --------- d-------- C:\Program Files\MUSICMATCH
2007-06-20 18:49 4608 --a------ C:\WINDOWS\system32\drivers\symlcbrd.sys
2007-06-20 18:49 --------- d-------- C:\Program Files\Norton Ghost
2007-06-20 18:49 --------- d-------- C:\Program Files\Common Files\InstallShield
2007-06-20 18:48 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\Symantec
2007-06-20 18:47 --------- d-------- C:\Program Files\Symantec
2007-06-20 18:47 --------- d-------- C:\Program Files\Common Files\Sonic Shared
2007-06-20 18:46 8552 --a------ C:\WINDOWS\system32\drivers\asctrm.sys
2007-06-20 18:46 --------- d-------- C:\Program Files\Sonic
2007-06-20 18:46 --------- d-------- C:\Program Files\EarthLink Setup
2007-06-20 18:46 --------- d-------- C:\Program Files\Common Files\Real
2007-06-20 18:46 --------- d-------- C:\Program Files\Common Files\Nullsoft
2007-06-20 18:46 --------- d-------- C:\Program Files\Common Files\aolshare
2007-06-20 18:46 --------- d-------- C:\Program Files\AOL Companion
2007-06-20 18:46 --------- d-------- C:\Program Files\America Online 9.0
2007-06-20 18:45 --------- d-------- C:\Program Files\Microsoft Plus! Photo Story 2 LE
2007-06-20 18:45 --------- d-------- C:\Program Files\Microsoft Plus! Digital Media Edition
2007-06-20 18:43 --------- d-------- C:\Program Files\CyberLink
2007-06-20 18:42 --------- d-------- C:\Program Files\Modem Helper
2007-06-20 18:41 --------- d-------- C:\Program Files\Synaptics
2007-06-20 18:41 --------- d-------- C:\Program Files\Broadcom
2007-06-20 18:41 --------- d-------- C:\DOCUME~1\Mom\APPLIC~1\InstallShield
2007-06-20 18:39 --------- d-------- C:\Program Files\CONEXANT
2007-06-20 18:34 4166 --a------ C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-06-20 18:33 9328 --a------ C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-06-19 20:47 6171 --a------ C:\WINDOWS\system32\drivers\1028_Dell_INS_I6400.mrk
2007-05-16 10:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
2007-05-16 10:12 85504 --------- C:\WINDOWS\system32\dllcache\wabimp.dll
2007-05-16 10:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-05-16 10:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
2007-05-16 10:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
2007-05-16 10:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll
2005-07-29 21:24:26 472 --sha-r C:\WINDOWS\SmFycm9k\mAIVwA64.vbs


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5E028439-81C7-4B82-BC74-25156306F532}]
2007-06-14 09:10 258048 --a------ C:\Program Files\BayScribe\bayscribe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 16:30 C:\WINDOWS\stsystra.exe]
"PCMService"="C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 20:15]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]
"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 22:02]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-07-01 19:22]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2005-08-26 14:26]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-07-12 19:05]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-07-12 18:06]
"VirusScan Online"="c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe" [2005-08-10 12:49]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-08-18 17:52]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2004-12-20 13:41]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-28 09:14]
"XDc"="C:\Program Files\Xtreme Desktop\xdc\startxdc.exe" [2006-10-02 23:09]
"WorksFUD"="C:\Program Files\Microsoft Works\wkfud.exe" [2001-10-05 19:34]
"Microsoft Works Portfolio"="C:\Program Files\Microsoft Works\WksSb.exe" [2001-08-23 16:52]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2001-08-16 23:41]
"Corel Photo Downloader"="C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe" [2006-02-09 17:34]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ModemOnHold"="C:\Program Files\NetWaiting\netWaiting.exe" [2003-09-10 02:24]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-04 23:08]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 16:17]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
"ukqw"="C:\PROGRA~1\COMMON~1\ukqw\ukqwm.exe" [2006-07-19 14:56]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2007-06-20 18:42:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]
Microsoft Works Calendar Reminders.lnk - C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 1854]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= C:\Program Files\Common Files\dirtok.html
FriendlyName=

R1 V2IMount;V2IMount;C:\WINDOWS\system32\drivers\V2IMount.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c9951c62-3977-11dc-ba67-00038a000015}]
AutoRun\command- F:\setupSNK.exe


Contents of the 'Scheduled Tasks' folder
2007-08-13 17:29:41 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (OSTLUND-Jarrod).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 23:21:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-14 23:23:49 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-08-14 23:23

--- E O F ---
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-15-2007, 02:30 AM   #16 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

It's IMPORTANT to carry out the instructions in the sequence listed below.


1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


Open *notepad* and copy/paste the text in the quotebox below into it:


Quote:
File::
C:\WINDOWS\system32\ljdsrngr.exe
C:\WINDOWS\checkip.dat
C:\Program Files\Common Files\zyliv
C:\Program Files\Common Files\zyliv944
C:\Program Files\Common Files\zyliv874

Folder::
C:\VundoFix Backups
C:\WINDOWS\ukqw
C:\Program Files\Common Files\ukqw
C:\WINDOWS\SmFycm9k\mAIVwA64.vbs
C:\WINDOWS\SmFycm9k


DirLook::
C:\Temp

Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{770D2125-C293-4531-AA78-53BFEEEB49BF}]
C:\WINDOWS\system32\pmkhg.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ukqw"=-
Save this as *CFScript.txt*, in the same location as ComboFix.exe


Image: http://img.photobucket.com/albums/v6...s/CFScript.gif

Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at *C:\ComboFix.txt*

*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*




===================================================
Post back a new HJT log after a reboot
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-15-2007, 06:28 PM   #17 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hi, here is my latest highjack this report.

Thanks, Dan



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:20:28 PM, on 8/15/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\GEARSec.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\stsystra.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\McAfee.com\VSO\oasclnt.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
c:\program files\mcafee.com\vso\mcvsshld.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
C:\Program Files\NetWaiting\netWaiting.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Xtreme Desktop\xdc\xdc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Anti-Phishing Filter - {41D68ED8-4CFF-4115-88A6-6EBB8AF19000} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: BayScribeBHO - {5E028439-81C7-4B82-BC74-25156306F532} - C:\Program Files\BayScribe\bayscribe.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"
O4 - HKLM\..\Run: [VSOCheckTask] "C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" /checktask
O4 - HKLM\..\Run: [OASClnt] C:\Program Files\McAfee.com\VSO\oasclnt.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MSKDetectorExe] C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe /startup
O4 - HKLM\..\Run: [MSKAGENTEXE] C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
O4 - HKLM\..\Run: [VirusScan Online] c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe
O4 - HKLM\..\Run: [MPFExe] C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [XDc] C:\Program Files\Xtreme Desktop\xdc\startxdc.exe
O4 - HKLM\..\Run: [WorksFUD] C:\Program Files\Microsoft Works\wkfud.exe
O4 - HKLM\..\Run: [Microsoft Works Portfolio] C:\Program Files\Microsoft Works\WksSb.exe /AllUsers
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra 'Tools' menuitem: McAfee Anti-Phishing Filter - {39FD89BF-D3F1-45b6-BB56-3582CCF489E1} - c:\program files\mcafee\spamkiller\mcapfbho.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} - https://components.viewpoint.com/MTS...oupe_load.html
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
O16 - DPF: {1EF9F042-C2EB-4293-8213-474CAEEF531D} (TmHcmsX Control) - http://www.trendsecure.com/framework...ex/TmHcmsX.CAB
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsu...?1182429767203
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O16 - DPF: {D9E4E21E-60E0-11DA-91EB-00123F33E209} (DNInstallerOCX Class) - https://mq1webc2.speechmachines.org/...Installer2.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MpfService.exe
O23 - Service: McAfee SpamKiller Server (MskService) - McAfee Inc. - C:\PROGRA~1\McAfee\SPAMKI~1\MSKSrvr.exe
O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE
O24 - Desktop Component 0: (no name) - C:\Program Files\Common Files\dirtok.html

--
End of file - 11056 bytes
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-15-2007, 06:38 PM   #18 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
Looks like we have a win...at last....things should be fine now.You will also need to update your Java to the latest version as that was how all these exploits came in in the first place.You will see how to do that in a later post.

Just to make sure all is well lets do a independent scan..

Download AVG Anti-Spyware saving the installation file to your desktop.
( This is a 30 day trial of the program )
http://www.majorgeeks.com/AVG_Anti-Spyware_d5287.html

Once you have downloaded AVG Anti-Spyware, locate the icon on the desktop and double-click it to launch the set up program.
Once the setup is complete you will need run AVG Anti-Spyware and update the definition files.
On the main screen select the icon "Update" then select the Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Under How to scan?
All checkboxes should be ticked.
Under "Reports" Select "Automatically generate report after every scan" Also, Un-Select "Only if threats were found".
Under What to scan?
Select Scan every file
Now close AVG Anti-Spyware and procede to the next set of instructions.

Reboot your computer into Safe Mode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight Safe Mode then press ENTER.

IMPORTANT: Do not open any other windows or programs while AVG Anti-Spyware is scanning, it may interfere with the scanning proccess:

Now lauch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".

AVG Anti-Spyware will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:

If you have any infections you will prompted, when prompted select Next select the "Reports" icon at the top.
Select the "Save Report As" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-16-2007, 08:20 AM   #19 (permalink)
Registered User
 
Join Date: Oct 2006
Posts: 43
OS: XP


Re: Still needing help with pop ups
Hello,

I ran avg anti-spyware and it showed that I had viruses. However, there was nothing in the reports section. I did everything you instructed regarding set up. Did I do something wrong? Should I run it again?

Thanks, Dan
danster64 is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
Old 08-16-2007, 03:40 PM   #20 (permalink)
Security Team (ret.)
 
Pancake's Avatar
 
Join Date: Nov 2003
Location: Victoria.Australia
Posts: 7,404
OS: XP Pro SP3


Re: Still needing help with pop ups
I need to see the virus report.Read the instructions again and then run it once more..

Quote:
If you have any infections you will prompted, when prompted select Next select the "Reports" icon at the top.
Select the "Save Report As" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). Close AVG Anti-Spyware and reboot your system back into Normal Mode and post the results of the AVG Anti-Spyware report scan.
__________________
Eddy
Pancake is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Bookmark on Thread SoupReddit!
 
Page 1 of 2 1 2

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 11:47 PM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84