Trojan.Dropper.Vundo.E plus...

[jc47]

Hi,

I think I have followed the 5 steps as best I could. Was unable to run DSS as I can only run in Safe Mode. I could not get updates from MS, kept getting errors. Wasn't long ago that I updated though. I am not very computer literate, so don't assume I understand some of your directions.

In addition to Highjack this, I have also run Avast, Ad-Aware, Kaspersky and Jotti's.

Jotti's finally came up with names after Kaspersky found the files. In addition to Vundo... Trojan.MulDrop.9328, AdWare.Win32.Virtumonde.cli, Trojan.Virtumod.253 and a few more in several files. Almost all of them so far show up in C:\System Volume Information\_restore and C:\qoobox\Quarantine\C\WINDOWS\mrofinu72.exe.vir. When this happened, all of my restore points were deleted.

Hope this post meets the posting criteria.

Thank you for any help.
jc


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:36:44 PM, on 12/31/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\taskmgr.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0061019
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - S-1-5-21-2563160767-2867521304-1145967176-1007 Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe (User '?')
O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1188876984718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1198534158250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5960 bytes

[jc47]

Is it something I did or didn't do? I seem to be sliding down the list. Please let me know if I need to do something else.

Thank you,
jc

[jc47]

Ok. What do I need to do to get at least one response in this forum. I need help too, you know.

Is it something I said?

Thanks.
jc

[forhockey]

Hi jc47,

Sorry for the delay, as this section of the forum is always busy. We are all volunteers and help others out on our spare time, so it is impossible to attend to every thread created.

Those places you mentioned where the viruses where detected are ok... As long as you don't restore to an earlier restore point you won't get the virus. The qoobox folder is a quarantine folder, which you can leave for now and we can deal with it later. Can you please post the results from C:\ComboFix.txt (When you ran ComboFix earlier) and a fresh HiJackThis Log. Thanks.



Please subscribe to this thread so that you are notified when you receive a reply. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Add Subscription.

[jc47]

Thank you Forhockey. I thought I had done something wrong.

I jsut ran a VundoFix scan, found nothing.


ComboFix 07-12-26.3 - JOE 2007-12-30 19:36:45.2 - NTFSx86 NETWORK
Running from: C:\Documents and Settings\JOE\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-31 )))))))))))))))))))))))))))))))
.

2007-12-29 22:30 . 2007-12-29 22:30 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-29 22:30 . 2007-12-04 07:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-29 22:30 . 2004-01-09 03:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-29 22:30 . 2007-12-04 06:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-29 22:30 . 2007-12-04 08:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-29 22:30 . 2007-12-04 08:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-29 22:30 . 2007-12-04 08:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-29 22:30 . 2007-12-04 08:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-29 22:30 . 2007-12-04 08:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-29 16:36 . 2007-12-29 16:36 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-28 22:04 . 2007-12-28 22:04 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-27 21:56 . 2007-12-27 21:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-25 22:17 . 2007-12-25 22:17 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-24 15:54 . 2007-12-24 16:04 689,398,085 --a------ C:\Battle of Britain II.rar
2007-12-24 13:11 . 2007-08-01 16:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-24 13:04 . 2007-12-24 13:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6
2007-12-24 00:33 . 2007-12-28 03:47 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\HouseCall 6.6
2007-12-23 23:09 . 2007-12-24 10:42 <DIR> d-------- C:\Documents and Settings\JOE\.housecall6.6
2007-12-23 22:14 . 2007-12-23 22:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-12-22 15:07 . 2007-12-29 19:05 <DIR> d-------- C:\Program Files\Windows Defender
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 14:24 . 2007-12-22 14:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-22 04:56 . 2007-12-22 04:56 0 --ahs---- C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat
2007-12-22 03:24 . 2007-12-22 03:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 02:59 . 2007-12-24 17:02 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe
2007-11-29 22:01 . 2007-11-29 22:01 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\Uniblue
2007-11-26 22:39 . 2007-10-12 15:14 3,734,536 --a------ C:\WINDOWS\system32\d3dx9_36.dll
2007-11-26 22:39 . 2007-10-12 15:14 1,374,232 --a------ C:\WINDOWS\system32\D3DCompiler_36.dll
2007-11-26 22:39 . 2007-10-02 09:56 444,776 --a------ C:\WINDOWS\system32\d3dx10_36.dll
2007-11-26 22:39 . 2007-10-22 03:39 267,272 --a------ C:\WINDOWS\system32\xactengine2_10.dll
2007-11-05 22:51 . 2007-11-05 22:51 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\vlc
2007-11-05 22:29 . 2007-11-05 22:29 <DIR> d-------- C:\Program Files\VideoLAN
2007-11-04 14:48 . 2007-11-05 22:20 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-11-04 14:45 . 2007-11-10 01:00 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-11-04 14:29 . 2007-07-09 07:16 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-31 01:29 --------- d-----w C:\Documents and Settings\JOE\Application Data\Temporary
2007-12-30 04:03 --------- d-----w C:\Program Files\Samsung
2007-12-30 04:03 --------- d-----w C:\Documents and Settings\JOE\Application Data\Samsung
2007-12-30 04:01 --------- d-----w C:\Program Files\Microsoft Games
2007-12-22 21:39 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-12-22 19:59 --------- d-----w C:\Program Files\QuickTime
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-22 19:58 --------- d-----w C:\Program Files\Dell Support
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-22 09:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 23:55 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:55 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 10:59 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-09-30 18:50 1,096 ----a-w C:\Documents and Settings\JOE\hof.dat
2007-01-11 21:07 58,032,562 -c--a-w C:\Documents and Settings\JOE\Samsung_PC_Studio_311_FKB.exe
2006-11-01 17:11 8 -csh--r C:\WINDOWS\system32\EAAA20B113.sys
2006-11-04 06:48 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 13:19 C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="RUNDLL32.exe" [2004-08-04 04:00 C:\WINDOWS\system32\rundll32.exe]
"nwiz"="nwiz.exe" [2007-06-28 23:43 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="RUNDLL32.exe" [2004-08-04 04:00 C:\WINDOWS\system32\rundll32.exe]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-10-19 14:33:46]
Bluetooth.lnk - C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe [2005-05-31 14:29:16]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-10-19 14:32:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MskService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"MpfService"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b27c3bd-d344-11db-9518-000272cef255}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-12-30 23:01:36 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2007-12-30 03:25:33 C:\WINDOWS\Tasks\User_Feed_Synchronization-{7C817AB3-B00C-4813-A516-650DBD50047D}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 19:39:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-30 19:40:11
C:\ComboFix2.txt ... 2007-12-27 22:13
.
2007-12-30 03:26:29 --- E O F ---


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:51:39 PM, on 1/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0061019
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - S-1-5-21-2563160767-2867521304-1145967176-1007 Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe (User '?')
O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1188876984718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1198534158250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 5938 bytes

[forhockey]

Hi jc47,

Can you please carry all these instructions in Normal Mode.

--------------------------------------------------------------

Please copy this page to Notepad and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.

Also be sure to carry out the instructions in the sequence listed below.

--------------------------------------------------------------

Please go to: VirusTotal

• On the page you'll find a "Browse" button.
• Next to the browse button you'll see a box to enter text.
• Please copy/paste the following in BOLD:
  
  C:\WINDOWS\system32\EAAA20B113.sys
  
  
• Then click the "Send File" button just below.
• This will scan the file. Please be patient.
• Once scanned, copy and paste the results in your next reply.

Please repeat the same instructions for the following file in BOLD:

C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat

If VirusTotal is busy, try the same at Jotti

--------------------------------------------------------------

Delete ComboFix.exe from your desktop, and get an updated copy from one of the following links below:

Download Combofix from Here or Alternate link

**Save it directly to your desktop**

Double click on combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

A log will be produced that will ultimately be named C:\ComboFix.txt I'll need that in your next reply

--------------------------------------------------------------

Do you still happen to have the Kaspersky Log, which you were talking about in the first post? I'd like to see it if you still got it. If not, then don't worry.

--------------------------------------------------------------

Reply back with the following:

VirusTotal Results
C:\ComboFix.txt
Kaspersky Log (If you still have it)

[jc47]

Thanks Forhockey.

Was able to get only the ComoFix scan done in Normal" mode. Took over 45 minutes.
Just to get to my desktop took 10 + minutes. each click of the mouse also took a lot of time also. Internet, forget about it.

Ran the other scans in safe mode. Could not scan C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat. Kept getting "The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file." I disabled the firewall, same result.

Here are the results...

ComboFix 08-01-03.4 - JOE 2008-01-03 14:59:33.5 - NTFSx86
Running from: C:\Documents and Settings\JOE\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-03 to 2008-01-03 )))))))))))))))))))))))))))))))
.

2008-01-02 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 23:21 . 2008-01-01 23:21 <DIR> d-------- C:\VundoFix Backups
2007-12-31 22:15 . 2007-12-31 22:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-31 20:27 . 2007-12-31 20:27 <DIR> d-------- C:\Deckard
2007-12-31 19:54 . 2007-12-31 19:54 <DIR> d-------- C:\ie-spyad_zo
2007-12-31 19:21 . 2008-01-01 00:26 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-31 19:21 . 2007-12-31 19:21 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-29 22:30 . 2007-12-29 22:30 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-29 22:30 . 2007-12-04 07:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-29 22:30 . 2004-01-09 03:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-29 22:30 . 2007-12-04 06:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-29 22:30 . 2007-12-04 08:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-29 22:30 . 2007-12-04 08:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-29 22:30 . 2007-12-04 08:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-29 22:30 . 2007-12-04 08:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-29 22:30 . 2007-12-04 08:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-29 16:36 . 2007-12-29 16:36 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-28 22:04 . 2007-12-28 22:04 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-27 21:56 . 2007-12-27 21:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-25 22:17 . 2007-12-31 19:21 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-24 15:54 . 2007-12-24 16:04 689,398,085 --a------ C:\Battle of Britain II.rar
2007-12-24 13:11 . 2007-08-01 16:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-24 13:04 . 2007-12-24 13:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6
2007-12-24 00:33 . 2007-12-28 03:47 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\HouseCall 6.6
2007-12-23 23:09 . 2007-12-24 10:42 <DIR> d-------- C:\Documents and Settings\JOE\.housecall6.6
2007-12-23 22:14 . 2007-12-23 22:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-12-22 15:07 . 2007-12-31 19:59 <DIR> d-------- C:\Program Files\Windows Defender
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 14:24 . 2007-12-22 14:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-22 04:56 . 2007-12-22 04:56 0 --ahs---- C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat
2007-12-22 03:24 . 2007-12-22 03:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 02:59 . 2007-12-24 17:02 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 01:56 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-01 01:52 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-31 01:29 --------- d-----w C:\Documents and Settings\JOE\Application Data\Temporary
2007-12-30 04:03 --------- d-----w C:\Program Files\Samsung
2007-12-30 04:03 --------- d-----w C:\Documents and Settings\JOE\Application Data\Samsung
2007-12-30 04:01 --------- d-----w C:\Program Files\Microsoft Games
2007-12-22 19:59 --------- d-----w C:\Program Files\QuickTime
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-22 19:58 --------- d-----w C:\Program Files\Dell Support
2007-11-30 04:01 --------- d-----w C:\Documents and Settings\JOE\Application Data\Uniblue
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 04:51 --------- d-----w C:\Documents and Settings\JOE\Application Data\vlc
2007-11-06 04:29 --------- d-----w C:\Program Files\VideoLAN
2007-11-06 04:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-22 09:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll
2007-10-22 09:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-12 21:14 3,734,536 ----a-w C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 21:14 1,374,232 ----a-w C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 23:55 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:55 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 10:59 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-09-30 18:50 1,096 ----a-w C:\Documents and Settings\JOE\hof.dat
2007-01-11 21:07 58,032,562 -c--a-w C:\Documents and Settings\JOE\Samsung_PC_Studio_311_FKB.exe
2006-11-01 17:11 8 -csh--r C:\WINDOWS\system32\EAAA20B113.sys
2006-11-04 06:48 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

----a-w            63,712 2007-12-22 18:46:50  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe
----a-w            39,792 2007-12-22 11:15:38  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w            77,824 2007-12-22 18:46:46  C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt .exe
----a-w            50,736 2007-12-22 19:04:28  C:\Program Files\Common Files\AOL\1161576282\EE\aolsoftware .exe
----a-w            71,216 2007-12-22 18:46:29  C:\Program Files\Common Files\AOL\ACS\AOLDial .exe
----a-w            79,448 2007-12-22 18:46:56  C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
----a-w            81,920 2007-12-22 18:46:43  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w            94,208 2007-12-22 18:46:52  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w           389,120 2007-12-22 18:47:23  C:\Program Files\Dell Support\DSAgnt .exe
----a-w         1,838,592 2007-12-22 18:47:05  C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
----a-w            68,856 2007-12-22 18:57:54  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           132,496 2007-12-22 18:46:27  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           204,800 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliPoint\point32 .exe
----a-w           172,032 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliType Pro\type32 .exe
----a-w             8,192 2007-12-22 18:46:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot .exe
----a-w            26,112 2007-12-22 18:46:44  C:\Program Files\Real\RealPlayer\RealPlay .exe
----a-w           233,472 2007-12-22 18:47:12  C:\Program Files\Saitek\SD6\Software\ProfilerU .exe
----a-w           131,072 2007-12-22 18:47:15  C:\Program Files\Saitek\SD6\Software\SaiMfd .exe
----a-w            15,360 2007-12-24 23:02:35  C:\WINDOWS\system32\ctfmon .exe

((((((((((((((((((((((((((((( snapshot_2008-01-01_ 0.49.47.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-03 20:49:58 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_5f0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 13:19 282624 C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43 8466432]
"nwiz"="nwiz.exe" [2007-06-28 23:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-10-19 14:33:46]
Bluetooth.lnk - C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe [2005-05-31 14:29:16]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-10-19 14:32:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MskService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"MpfService"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b27c3bd-d344-11db-9518-000272cef255}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2007-12-31 01:50:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-03 21:05:00 C:\WINDOWS\Tasks\User_Feed_Synchronization-{7C817AB3-B00C-4813-A516-650DBD50047D}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-03 15:04:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-03 15:05:17
ComboFix-quarantined-files.txt 2008-01-03 21:05:15
ComboFix2.txt 2008-01-03 20:44:31
ComboFix3.txt 2008-01-01 06:50:12
ComboFix4.txt 2007-12-31 01:40:14
ComboFix5.txt 2007-12-28 04:13:12
.
2007-12-30 03:26:29 --- E O F ---


Jotti's malware scan 2.99-TRANSITION_TO_3.00-R1

File to upload & scan:
Service
Service load: 0% 100%

File: EAAA20B113.sys
Status: OK
MD5: 0641a46f1e58529a42ead4573a3a0861
Packers detected: -
Bit9 reports: File not found

Scanner results
Scan taken on 02 Jan 2008 20:33:28 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Ikarus Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing

Powered by

Disclaimer
This service is by no means 100% safe. If this scanner says 'OK', it does not necessarily mean the file is clean. There could be a whole new virus on the loose. NEVER EVER rely on one single product only, not even this service, even though it utilizes several products. Therefore, We cannot and will not be held responsible for any damage caused by results presented by this non-profit online service.

Also, we are aware of the implications of a setup like this. We are sure this whole thing is by no means scientifically correct, since this is a fully automated service (although manual correction is possible). We are aware, in spite of efforts to proactively counter these, false positives might occur, for example. We do not consider this a very big issue, so please do not e-mail us about it. This is a simple online scan service, not the university of Wichita.

Scanning can take a while, since several scanners are being used, plus the fact some scanners use very high levels of (time consuming) heuristics. Scanners used are Linux versions, differences with Windows scanners may or may not occur. Another note: some scanners will only report one virus when scanning archives with multiple pieces of malware.

Virus definitions are updated every hour. There is a 10Mb limit per file. Please refrain from uploading tons of hex-edited or repacked variants of the same sample.

Please do not ask for viruses uploaded here, unless you work for an anti-virus vendor. They are not for trade. This is a legitimate service, not a VX site. Viruses uploaded here will be distributed to antivirus vendors without exception. Read more about this in our privacy policy. If you do not want your files to be distributed, please do not send them at all.

Sponsored by HotelScraper.com.
--------------------------------------------------------------------------------


Statistics
Last file scanned at least one scanner reported something about: AutoSummon.exe (MD5: c41836b0dd26ea508d371f25724b2f02, size: 533735 bytes), detected by:

Scanner Malware name
A-Squared X
AntiVir X
ArcaVir X
Avast X
AVG Antivirus X
BitDefender X
ClamAV X
CPsecure X
Dr.Web X
F-Prot Antivirus X
F-Secure Anti-Virus X
Fortinet X
Ikarus Worm.Win32.AutoIt.d
Kaspersky Anti-Virus X
NOD32 X
Norman Virus Control X
Panda Antivirus X
Rising Antivirus X
Sophos Antivirus X
VirusBuster X
VBA32 X


You're free to (mis)interpret these automated, flawed statistics at your own discretion. For antivirus comparisons, visit AV comparatives
We are not affiliated with any third parties that conduct tests using this service.





Frequently asked questions - Feedback - Privacy policy



Page generated by JTPL

© 2004-2008 Jordi Bosveld <jotti@jotti.org>


KASPERSKY ONLINE SCANNER REPORT
2007-12-30 18:33
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 30/12/2007
Kaspersky Anti-Virus database records: 500486


Scan Settings
Scan using the following antivirus database extended
Scan Archives true
Scan Mail Bases false

Scan Target My Computer
C:\
D:\

Scan Statistics
Total number of scanned objects 84422
Number of viruses found 7
Number of infected objects 23
Number of suspicious objects 2
Duration of the scan process 01:13:16

Infected Object Name Virus Name Last Action
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip/Yazzle1552OinUninstaller.exe Suspicious: Password-protected-EXE skipped

C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\Yazzle.zip ZIP: suspicious - 1 skipped

C:\Documents and Settings\JOE\Application Data\$_hpcst$.hpc Object is locked skipped

C:\Documents and Settings\JOE\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\History\History.IE5\MSHist012007123020071231\index.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Temp\WCESLog.log Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Temp\~DF45FC.tmp Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Temp\~DF4607.tmp Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped

C:\Documents and Settings\JOE\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\JOE\ntuser.dat Object is locked skipped

C:\Documents and Settings\JOE\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\qoobox\Quarantine\C\WINDOWS\mrofinu72.exe.vir Infected: Trojan-Downloader.Win32.Agent.gwh skipped

C:\qoobox\Quarantine\catchme2007-12-27_221028.42.zip/rqrqonl.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.clz skipped

C:\qoobox\Quarantine\catchme2007-12-27_221028.42.zip ZIP: infected - 1 skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP294\A0053564.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP295\A0053566.exe Infected: Trojan-Downloader.Win32.Osel.bx skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP295\A0053653.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP296\A0053767.exe Infected: not-a-virus:AdWare.Win32.Agent.vv skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP296\A0053836.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059631.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gq skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059646.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059656.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0059707.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0060840.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062836.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062841.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062843.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062849.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062851.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062865.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0065867.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0065880.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0066899.exe Infected: not-a-virus:AdWare.Win32.Virtumonde.cli skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0066902.exe Infected: Trojan-Downloader.Win32.Agent.gwh skipped

C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\DEFAULT Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\Internet.evt Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SYSTEM Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

Scan process completed.

Thanks for your help. Much appreciated.

jc

[jc47]

forhockey...

Had some time on my hands so ran an Eset scan and a end of the day HJT.
Haven't taken any action, awaiting your instructions.

Eset Scan:

# version=4
# OnlineScanner.ocx=1.0.0.56
# OnlineScannerDLLA.dll=1, 0, 0, 51
# OnlineScannerDLLW.dll=1, 0, 0, 51
# OnlineScannerUninstaller.exe=1, 0, 0, 49
# vers_standard_module=2762 (20080102)
# vers_arch_module=1.060 (20071228)
# vers_adv_heur_module=1.064 (20070717)
# EOSSerial=e177d233fdf3b6418ad09b47388eb989
# end=finished
# remove_checked=false
# unwanted_checked=true
# utc_time=2008-01-04 04:38:45
# local_time=2008-01-03 10:38:45 (-0600, Central Standard Time)
# country="United States"
# osver=5.1.2600 NT Service Pack 2
# scanned=430218
# found=24
# scan_time=2251
C:\AOL Instant Messenger\AIM.exe Win32/Adware.WBug.A application 68FBA6AB00E8A0C0CB5191D7B0A76EA2
C:\AOL Instant Messenger\AIM.exe »WISE »MiniBugTransporter.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\AOL Instant Messenger\AIM.exe »WISE »MiniBugTransporter.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059631.exe probably a variant of Win32/Adware.PurityScan application 1A351793FCDC288B0A144590D32EA3E0
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059646.exe Win32/Adware.Virtumonde.CLI application 15E6D8768CD05D6F6160648ACEC29FF0
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP307\A0059656.exe Win32/Adware.Virtumonde.CLI application 15E6D8768CD05D6F6160648ACEC29FF0
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0060840.exe Win32/Adware.Virtumonde.CLI application 71B1C96A9EDA43F76B07EA0355912450
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062836.exe Win32/Adware.Virtumonde.CLI application 15E6D8768CD05D6F6160648ACEC29FF0
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062841.exe Win32/Adware.Virtumonde.CLI application DD5E3C5DA83D6B70DD2E1B0C13224601
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062843.exe Win32/Adware.Virtumonde.CLI application 71B1C96A9EDA43F76B07EA0355912450
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062849.exe Win32/Adware.Virtumonde.CLI application DD5E3C5DA83D6B70DD2E1B0C13224601
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062851.exe Win32/Adware.Virtumonde.CLI application 71B1C96A9EDA43F76B07EA0355912450
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0062865.exe Win32/Adware.Virtumonde.CLI application DD5E3C5DA83D6B70DD2E1B0C13224601
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0065867.exe Win32/Adware.Virtumonde.CLI application 71B1C96A9EDA43F76B07EA0355912450
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0065880.exe Win32/Adware.Virtumonde.CLI application 15E6D8768CD05D6F6160648ACEC29FF0
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP308\A0066899.exe Win32/Adware.Virtumonde.CLI application 71B1C96A9EDA43F76B07EA0355912450
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\A0075297.exe Win32/Adware.WBug.A application 68FBA6AB00E8A0C0CB5191D7B0A76EA2
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\A0075297.exe »WISE »MiniBugTransporter.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\A0075297.exe »WISE »MiniBugTransporter.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP311\A0075335.dll Win32/Adware.Virtumonde application E6E20C84A9D16330094F43FA5449710D
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP312\A0077632.dll Win32/Adware.Virtumonde application E6E20C84A9D16330094F43FA5449710D
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP312\A0077640.exe Win32/Adware.WBug.A application 68FBA6AB00E8A0C0CB5191D7B0A76EA2
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP312\A0077640.exe »WISE »MiniBugTransporter.EXE Win32/Adware.WBug.A application 00000000000000000000000000000000
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP312\A0077640.exe »WISE »MiniBugTransporter.EXE »WISE »MiniBugTransporter.dll Win32/Adware.WBug.A application 00000000000000000000000000000000


HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 01:46:42 AM, on 1/4/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0061019
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - S-1-5-21-2563160767-2867521304-1145967176-1007 Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe (User '?')
O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1188876984718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1198534158250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 6112 bytes

[jc47]

Forhockey, you alright?

Finally got DSS to run in "Normal" Only took 1.5 hours. LoL.

Here it is:

Deckard's System Scanner v20071014.68
Run by JOE on 2008-01-04 18:21:57
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Unable to create WMI object; The operation completed successfully.


Backed up registry hives.
Performed disk cleanup.



-- HijackThis (run as JOE.exe) -------------------------------------------------

Unable to find log (file not found); running clone.
-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-01-04 18:30:15
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Documents and Settings\JOE\Desktop\dss.exe
C:\Program Files\Trend Micro\HijackThis\JOE.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://www.google.com/keyword/%s
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0061019
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\GoogleToolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\GoogleToolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth.lnk = C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O15 - Trusted Zone: https://online.musicmatch.com (HKLM)
O15 - Trusted Zone: https://office.microsoft.com (HKCU)
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://download.microsoft.com/downlo...eckControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1188876984718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab Class) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1198534158250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/pub...sh/swflash.cab
O18 - Protocol: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O18 - Protocol: mso-offdap11 - {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL
O18 - Filter: text/xml - {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe


--
End of file - 8150 bytes

-- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

backup-20071231-225605-906 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
backup-20071231-230633-990 R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

2 BTSERIAL (Bluetooth Serial Driver) - c:\windows\system32\drivers\btserial.sys (file missing)
2 BTSLBCSP (Bluetooth Port Client Driver) - c:\windows\system32\drivers\btslbcsp.sys (file missing)
3 btwmodem (Bluetooth Modem) - c:\windows\system32\drivers\btwmodem.sys <Not Verified; Broadcom Corporation.; Bluetooth Software 4.0.1.2101>
3 catchme - c:\docume~1\joe\locals~1\temp\catchme.sys (file missing)
3 DSproct - c:\program files\dell support\gtaction\triggers\dsproct.sys <Not Verified; GTek Technologies Ltd.; processt>
3 SaiIFFB5 (Immersion's HID USB Driver (FFB5)) - c:\windows\system32\drivers\saiiffb5.sys <Not Verified; Saitek; Configuration Software>
3 SaiMini - c:\windows\system32\drivers\saimini.sys <Not Verified; Saitek; Configuration Software>
3 SaiNtBus - c:\windows\system32\drivers\saibus.sys <Not Verified; Saitek; Configuration Software>
0 sfdrv01 (StarForce Protection Environment Driver (version 1.x)) - c:\windows\system32\drivers\sfdrv01.sys <Not Verified; Protection Technology; StarForce Protection System>
0 sfhlp02 (StarForce Protection Helper Driver (version 2.x)) - c:\windows\system32\drivers\sfhlp02.sys <Not Verified; Protection Technology; StarForce Protection System>
0 sfvfs02 (StarForce Protection VFS Driver (version 2.x)) - c:\windows\system32\drivers\sfvfs02.sys <Not Verified; Protection Technology; StarForce Protection System>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

2 aawservice (Ad-Aware 2007 Service) - c:\program files\lavasoft\ad-aware 2007\aawservice.exe


-- Device Manager: Disabled ----------------------------------------------------

Unable to create WMI object.

-- Scheduled Tasks -------------------------------------------------------------

2008-01-04 18:16:30 418 --ah----- C:\WINDOWS\Tasks\User_Feed_Synchronization-{7C817AB3-B00C-4813-A516-650DBD50047D}.job
2007-12-30 19:50:46 330 --ah----- C:\WINDOWS\Tasks\MP Scheduled Scan.job


-- Files created between 2007-12-04 and 2008-01-04 -----------------------------

2008-01-03 18:54:42 0 d-------- C:\Program Files\EsetOnlineScanner
2008-01-01 23:21:28 0 d-------- C:\VundoFix Backups
2007-12-31 22:15:08 0 d-------- C:\Program Files\SpywareBlaster
2007-12-31 19:54:12 0 d-------- C:\ie-spyad_zo
2007-12-31 19:21:23 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-12-30 22:42:17 0 dr-h----- C:\Documents and Settings\JOE\Recent
2007-12-29 22:30:22 0 d-------- C:\Program Files\Alwil Software
2007-12-29 19:29:32 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-29 19:29:31 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 16:36:17 0 d-------- C:\Program Files\Trend Micro
2007-12-28 22:04:50 0 d-------- C:\Program Files\Enigma Software Group
2007-12-27 22:12:13 11272192 --a------ C:\Documents and Settings\JOE\ntuser.dat
2007-12-27 21:56:38 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-24 13:08:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
2007-12-24 13:04:19 0 d-------- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6
2007-12-24 13:03:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Sun
2007-12-24 00:33:37 0 d-------- C:\Documents and Settings\JOE\Application Data\HouseCall 6.6
2007-12-23 23:09:48 0 d-------- C:\Documents and Settings\JOE\.housecall6.6
2007-12-23 22:49:26 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2007-12-23 22:49:26 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2007-12-23 22:49:26 0 dr-h----- C:\Documents and Settings\Administrator\Recent
2007-12-23 22:49:26 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2007-12-23 22:49:26 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2007-12-23 22:49:26 0 d-------- C:\Documents and Settings\Administrator\Desktop
2007-12-23 22:49:26 0 d-------- C:\Documents and Settings\Administrator\Application Data\Identities
2007-12-23 22:16:18 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2007-12-23 22:14:22 0 d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-12-23 22:14:21 0 d--h----- C:\Documents and Settings\Administrator\Templates
2007-12-23 22:14:21 0 dr------- C:\Documents and Settings\Administrator\My Documents
2007-12-23 22:14:21 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2007-12-23 22:14:21 0 dr------- C:\Documents and Settings\Administrator\Favorites
2007-12-23 22:14:21 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2007-12-23 22:14:21 0 dr------- C:\Documents and Settings\Administrator\Application Data
2007-12-23 22:14:21 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft
2007-12-23 22:14:20 1048576 --a------ C:\Documents and Settings\Administrator\NTUSER.DAT
2007-12-22 15:07:06 0 d-------- C:\Program Files\Windows Defender
2007-12-22 14:25:06 0 d-------- C:\Program Files\Lavasoft
2007-12-22 14:25:05 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 14:24:24 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-22 04:56:29 0 --ahs---- C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat
2007-12-22 03:24:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy


-- Find3M Report ---------------------------------------------------------------

2007-12-31 19:56:29 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-12-31 19:52:11 0 d-------- C:\Program Files\Common Files\aolshare
2007-12-30 19:29:52 0 d-------- C:\Documents and Settings\JOE\Application Data\Temporary
2007-12-29 22:03:34 0 d-------- C:\Documents and Settings\JOE\Application Data\Samsung
2007-12-29 22:03:28 0 d-------- C:\Program Files\Samsung
2007-12-29 22:01:46 0 d-------- C:\Program Files\Microsoft Games
2007-12-22 14:24:24 0 d-------- C:\Program Files\Common Files
2007-12-22 13:59:06 0 d-------- C:\Program Files\QuickTime
2007-12-22 13:58:08 0 d-------- C:\Program Files\Microsoft IntelliType Pro
2007-12-22 13:58:07 0 d-------- C:\Program Files\Microsoft IntelliPoint
2007-12-22 13:58:04 0 d-------- C:\Program Files\Dell Support
2007-11-29 22:01:05 0 d-------- C:\Documents and Settings\JOE\Application Data\Uniblue
2007-11-05 22:51:12 0 d-------- C:\Documents and Settings\JOE\Application Data\vlc
2007-11-05 22:29:56 0 d-------- C:\Program Files\VideoLAN
2007-11-05 22:20:47 0 d-------- C:\Program Files\Windows Media Connect 2


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [07/27/2006 01:19 PM C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [06/28/2007 11:43 PM]
"nwiz"="nwiz.exe" [06/28/2007 11:43 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [06/28/2007 11:43 PM]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [12/04/2007 07:00 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MskService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"MpfService"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b27c3bd-d344-11db-9518-000272cef255}]
AutoRun\command- E:\LaunchU3.exe -a




-- End of Deckard's System Scanner: finished at 2008-01-04 18:45:43 ------------

Help as soon as you can.

Thanks.
jc

[forhockey]

Hi jc47,

Yes, I'm alright. Just really busy lately and haven't had enough time to respond to all my threads. Just got to yours.

-------------------------------------

You shouldn't be doing anything while running ComboFix. Each mouse-click can cause ComboFix to freeze/stall and take longer, as you described in your earlier post.


Open notepad and copy/paste the text in the quotebox below into it:

RENV::
----a-w 63,712 2007-12-22 18:46:50 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe
----a-w 39,792 2007-12-22 11:15:38 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w 77,824 2007-12-22 18:46:46 C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt .exe
----a-w 50,736 2007-12-22 19:04:28 C:\Program Files\Common Files\AOL\1161576282\EE\aolsoftware .exe
----a-w 71,216 2007-12-22 18:46:29 C:\Program Files\Common Files\AOL\ACS\AOLDial .exe
----a-w 79,448 2007-12-22 18:46:56 C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
----a-w 81,920 2007-12-22 18:46:43 C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w 94,208 2007-12-22 18:46:52 C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w 389,120 2007-12-22 18:47:23 C:\Program Files\Dell Support\DSAgnt .exe
----a-w 1,838,592 2007-12-22 18:47:05 C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
----a-w 68,856 2007-12-22 18:57:54 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w 132,496 2007-12-22 18:46:27 C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w 204,800 2007-12-22 18:46:27 C:\Program Files\Microsoft IntelliPoint\point32 .exe
----a-w 172,032 2007-12-22 18:46:27 C:\Program Files\Microsoft IntelliType Pro\type32 .exe
----a-w 8,192 2007-12-22 18:46:42 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot .exe
----a-w 26,112 2007-12-22 18:46:44 C:\Program Files\Real\RealPlayer\RealPlay .exe
----a-w 233,472 2007-12-22 18:47:12 C:\Program Files\Saitek\SD6\Software\ProfilerU .exe
----a-w 131,072 2007-12-22 18:47:15 C:\Program Files\Saitek\SD6\Software\SaiMfd .exe
----a-w 15,360 2007-12-24 23:02:35 C:\WINDOWS\system32\ctfmon .exe

Save this as CFScript




Referring to the picture above, drag CFScript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

[jc47]

Ran it in safe mode. Forgot, hope it's alright. Normal is such a chore...sloooooooow.
Does it look dangerous? Do I need to call credit card company's etc.?

Thanks...here it is:

ComboFix 08-01-03.4 - JOE 2008-01-04 20:53:19.7 - NTFSx86 NETWORK
Running from: C:\Documents and Settings\JOE\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\JOE\Desktop\CFScript.txt
.

((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-03 18:54 . 2008-01-03 19:36 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-01-02 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 23:21 . 2008-01-01 23:21 <DIR> d-------- C:\VundoFix Backups
2007-12-31 22:15 . 2007-12-31 22:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-31 20:27 . 2007-12-31 20:27 <DIR> d-------- C:\Deckard
2007-12-31 19:54 . 2007-12-31 19:54 <DIR> d-------- C:\ie-spyad_zo
2007-12-31 19:21 . 2008-01-01 00:26 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-31 19:21 . 2007-12-31 19:21 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-29 22:30 . 2007-12-29 22:30 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-29 22:30 . 2007-12-04 07:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-29 22:30 . 2004-01-09 03:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-29 22:30 . 2007-12-04 06:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-29 22:30 . 2007-12-04 08:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-29 22:30 . 2007-12-04 08:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-29 22:30 . 2007-12-04 08:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-29 22:30 . 2007-12-04 08:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-29 22:30 . 2007-12-04 08:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-29 16:36 . 2007-12-29 16:36 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-28 22:04 . 2007-12-28 22:04 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-27 21:56 . 2007-12-27 21:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-25 22:17 . 2007-12-31 19:21 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-24 15:54 . 2007-12-24 16:04 689,398,085 --a------ C:\Battle of Britain II.rar
2007-12-24 13:11 . 2007-08-01 16:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-24 13:04 . 2007-12-24 13:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6
2007-12-24 00:33 . 2007-12-28 03:47 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\HouseCall 6.6
2007-12-23 23:09 . 2007-12-24 10:42 <DIR> d-------- C:\Documents and Settings\JOE\.housecall6.6
2007-12-23 22:14 . 2007-12-23 22:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-12-22 15:07 . 2007-12-31 19:59 <DIR> d-------- C:\Program Files\Windows Defender
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 14:24 . 2007-12-22 14:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-22 04:56 . 2007-12-22 04:56 0 --ahs---- C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat
2007-12-22 03:24 . 2007-12-22 03:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-12-22 02:59 . 2007-12-24 17:02 15,360 --a------ C:\WINDOWS\system32\ctfmon .exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-01 01:56 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-01 01:52 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-31 01:29 --------- d-----w C:\Documents and Settings\JOE\Application Data\Temporary
2007-12-30 04:03 --------- d-----w C:\Program Files\Samsung
2007-12-30 04:03 --------- d-----w C:\Documents and Settings\JOE\Application Data\Samsung
2007-12-30 04:01 --------- d-----w C:\Program Files\Microsoft Games
2007-12-22 19:59 --------- d-----w C:\Program Files\QuickTime
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2007-12-22 19:58 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2007-12-22 19:58 --------- d-----w C:\Program Files\Dell Support
2007-11-30 04:01 --------- d-----w C:\Documents and Settings\JOE\Application Data\Uniblue
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 04:51 --------- d-----w C:\Documents and Settings\JOE\Application Data\vlc
2007-11-06 04:29 --------- d-----w C:\Program Files\VideoLAN
2007-11-06 04:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-22 09:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll
2007-10-22 09:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-12 21:14 3,734,536 ----a-w C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 21:14 1,374,232 ----a-w C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 23:55 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:55 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 10:59 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-09-30 18:50 1,096 ----a-w C:\Documents and Settings\JOE\hof.dat
2007-01-11 21:07 58,032,562 -c--a-w C:\Documents and Settings\JOE\Samsung_PC_Studio_311_FKB.exe
2006-11-01 17:11 8 -csh--r C:\WINDOWS\system32\EAAA20B113.sys
2006-11-04 06:48 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

----a-w            63,712 2007-12-22 18:46:50  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe
----a-w            39,792 2007-12-22 11:15:38  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w            77,824 2007-12-22 18:46:46  C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt .exe
----a-w            50,736 2007-12-22 19:04:28  C:\Program Files\Common Files\AOL\1161576282\EE\aolsoftware .exe
----a-w            71,216 2007-12-22 18:46:29  C:\Program Files\Common Files\AOL\ACS\AOLDial .exe
----a-w            79,448 2007-12-22 18:46:56  C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
----a-w            81,920 2007-12-22 18:46:43  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w            94,208 2007-12-22 18:46:52  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w           389,120 2007-12-22 18:47:23  C:\Program Files\Dell Support\DSAgnt .exe
----a-w         1,838,592 2007-12-22 18:47:05  C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
----a-w            68,856 2007-12-22 18:57:54  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           132,496 2007-12-22 18:46:27  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           204,800 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliPoint\point32 .exe
----a-w           172,032 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliType Pro\type32 .exe
----a-w             8,192 2007-12-22 18:46:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot .exe
----a-w            26,112 2007-12-22 18:46:44  C:\Program Files\Real\RealPlayer\RealPlay .exe
----a-w           233,472 2007-12-22 18:47:12  C:\Program Files\Saitek\SD6\Software\ProfilerU .exe
----a-w           131,072 2007-12-22 18:47:15  C:\Program Files\Saitek\SD6\Software\SaiMfd .exe
----a-w            15,360 2007-12-24 23:02:35  C:\WINDOWS\system32\ctfmon .exe

((((((((((((((((((((((((((((( snapshot_2008-01-01_ 0.49.47.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-07-27 21:49:02 196,683 ----a-w C:\WINDOWS\system32\lnod32apiA.dll
+ 2007-07-27 21:49:02 225,355 ----a-w C:\WINDOWS\system32\lnod32apiW.dll
+ 2005-12-06 02:25:22 139,264 ----a-w C:\WINDOWS\system32\lnod32umc.dll
+ 2005-12-05 19:37:10 106,496 ----a-w C:\WINDOWS\system32\lnod32upd.dll
+ 2007-08-03 00:11:28 253,952 ----a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll
+ 2007-08-03 00:11:14 241,664 ----a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll
+ 2007-08-08 22:30:12 19,456 ----a-w C:\WINDOWS\system32\OnlineScannerLang.dll
+ 2007-06-13 17:10:34 77,824 ----a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
+ 2004-12-07 17:11:34 258,352 ----a-w C:\WINDOWS\system32\unicows.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 13:19 282624 C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43 8466432]
"nwiz"="nwiz.exe" [2007-06-28 23:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-10-19 14:33:46]
Bluetooth.lnk - C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe [2005-05-31 14:29:16]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-10-19 14:32:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MskService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"MpfService"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b27c3bd-d344-11db-9518-000272cef255}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-12-31 01:50:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-05 00:16:30 C:\WINDOWS\Tasks\User_Feed_Synchronization-{7C817AB3-B00C-4813-A516-650DBD50047D}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 20:56:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-04 20:56:53
ComboFix-quarantined-files.txt 2008-01-05 02:56:45
ComboFix2.txt 2008-01-04 19:49:29
ComboFix3.txt 2008-01-03 21:05:18
ComboFix4.txt 2008-01-03 20:44:31
ComboFix5.txt 2008-01-01 06:50:12
.
2007-12-30 03:26:29 --- E O F ---

[forhockey]

No need to call the credit card company. Lets try a different method:


Open NOTEPAD.exe and copy/paste the text in the quotebox below into it:

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt .exe
C:\Program Files\Common Files\AOL\1161576282\EE\aolsoftware .exe
C:\Program Files\Common Files\AOL\ACS\AOLDial .exe
C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
C:\Program Files\Dell\Media Experience\DMXLauncher .exe
C:\Program Files\Dell Support\DSAgnt .exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
C:\Program Files\Microsoft IntelliPoint\point32 .exe
C:\Program Files\Microsoft IntelliType Pro\type32 .exe
C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot .exe
C:\Program Files\Real\RealPlayer\RealPlay .exe
C:\Program Files\Saitek\SD6\Software\ProfilerU .exe
C:\Program Files\Saitek\SD6\Software\SaiMfd .exe
C:\WINDOWS\system32\ctfmon .exe

Save this as Log.txt

Please download this tool :> http://download.bleepingcomputer.com/sUBs/Beta/RenV.exe
Place the tool next to Log.txt




Refering to the picture above, drag Log.txt into RenV.exe

When finished, it shall produce a log for you. Post that log in your next reply.

[jc47]

Nothing showed on the current one. I had run one at an earlier date, so thought I would add it to the post fyi.

Ran on Fri 01/04/2008 - 22:28:51.01

 Entries:                0  (0)
 Directories:            0  Files:             0
 Bytes:                  0  Blocks:            0

Thanks.


Earlier scan:

Ran on Tue 01/01/2008 - 22:39:32.70

----a-w            63,712 2007-12-22 18:46:50  C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy .exe
----a-w            39,792 2007-12-22 11:15:38  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w            77,824 2007-12-22 18:46:46  C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt .exe
----a-w            50,736 2007-12-22 19:04:28  C:\Program Files\Common Files\AOL\1161576282\EE\aolsoftware .exe
----a-w            71,216 2007-12-22 18:46:29  C:\Program Files\Common Files\AOL\ACS\AOLDial .exe
----a-w            79,448 2007-12-22 18:46:56  C:\Program Files\Common Files\AOL\AOL Spyware Protection\AOLSP Scheduler .exe
----a-w            81,920 2007-12-22 18:46:43  C:\Program Files\Common Files\InstallShield\UpdateService\issch .exe
----a-w            94,208 2007-12-22 18:46:52  C:\Program Files\Dell\Media Experience\DMXLauncher .exe
----a-w           389,120 2007-12-22 18:47:23  C:\Program Files\Dell Support\DSAgnt .exe
----a-w         1,838,592 2007-12-22 18:47:05  C:\Program Files\Google\Google Desktop Search\GoogleDesktop .exe
----a-w            68,856 2007-12-22 18:57:54  C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier .exe
----a-w           132,496 2007-12-22 18:46:27  C:\Program Files\Java\jre1.6.0_03\bin\jusched .exe
----a-w           204,800 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliPoint\point32 .exe
----a-w           172,032 2007-12-22 18:46:27  C:\Program Files\Microsoft IntelliType Pro\type32 .exe
----a-w             8,192 2007-12-22 18:46:42  C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mimboot .exe
----a-w            26,112 2007-12-22 18:46:44  C:\Program Files\Real\RealPlayer\RealPlay .exe
----a-w           233,472 2007-12-22 18:47:12  C:\Program Files\Saitek\SD6\Software\ProfilerU .exe
----a-w           131,072 2007-12-22 18:47:15  C:\Program Files\Saitek\SD6\Software\SaiMfd .exe
----a-w            15,360 2007-12-24 23:02:35  C:\WINDOWS\system32\ctfmon .exe

 Entries:               19  (19)
 Directories:            0  Files:            19
 Bytes:          3,778,960  Blocks:        7,385

[forhockey]

The current one looks good. Its done its job :)

Please do the following from Normal Mode.

Please run ComboFix.exe again. Just double-click on ComboFix.exe to run it this time.

Post back with the results from C:\ComboFix.txt and a New HiJackThis Log

[jc47]

Here they are:

ComboFix 08-01-03.4 - JOE 2008-01-04 23:28:48.8 - NTFSx86
Running from: C:\Documents and Settings\JOE\Desktop\ComboFix.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-05 to 2008-01-05 )))))))))))))))))))))))))))))))
.

2008-01-03 18:54 . 2008-01-03 19:36 <DIR> d-------- C:\Program Files\EsetOnlineScanner
2008-01-02 14:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-01 23:21 . 2008-01-01 23:21 <DIR> d-------- C:\VundoFix Backups
2007-12-31 22:15 . 2007-12-31 22:15 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-31 20:27 . 2007-12-31 20:27 <DIR> d-------- C:\Deckard
2007-12-31 19:54 . 2007-12-31 19:54 <DIR> d-------- C:\ie-spyad_zo
2007-12-31 19:21 . 2008-01-01 00:26 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-31 19:21 . 2007-12-31 19:21 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-29 22:30 . 2007-12-29 22:30 <DIR> d-------- C:\Program Files\Alwil Software
2007-12-29 22:30 . 2007-12-04 07:04 837,496 --a------ C:\WINDOWS\system32\aswBoot.exe
2007-12-29 22:30 . 2004-01-09 03:13 380,928 --a------ C:\WINDOWS\system32\actskin4.ocx
2007-12-29 22:30 . 2007-12-04 06:54 95,608 --a------ C:\WINDOWS\system32\AvastSS.scr
2007-12-29 22:30 . 2007-12-04 08:55 94,544 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-29 22:30 . 2007-12-04 08:56 93,264 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-29 22:30 . 2007-12-04 08:51 42,912 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-29 22:30 . 2007-12-04 08:49 26,624 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-29 22:30 . 2007-12-04 08:53 23,152 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-12-29 19:29 . 2007-12-29 19:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-29 16:36 . 2007-12-29 16:36 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-28 22:04 . 2007-12-28 22:04 <DIR> d-------- C:\Program Files\Enigma Software Group
2007-12-27 21:56 . 2007-12-27 21:57 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2007-12-25 22:17 . 2007-12-31 19:21 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-24 15:54 . 2007-12-24 16:04 689,398,085 --a------ C:\Battle of Britain II.rar
2007-12-24 13:11 . 2007-08-01 16:47 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2007-12-24 13:04 . 2007-12-24 13:15 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HouseCall 6.6
2007-12-24 00:33 . 2007-12-28 03:47 <DIR> d-------- C:\Documents and Settings\JOE\Application Data\HouseCall 6.6
2007-12-23 23:09 . 2007-12-24 10:42 <DIR> d-------- C:\Documents and Settings\JOE\.housecall6.6
2007-12-23 22:14 . 2007-12-23 22:49 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek
2007-12-22 15:07 . 2007-12-31 19:59 <DIR> d-------- C:\Program Files\Windows Defender
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-22 14:25 . 2007-12-22 14:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-22 14:24 . 2007-12-22 14:24 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-22 04:56 . 2007-12-22 04:56 0 --ahs---- C:\Documents and Settings\JOE\Application Data\d843a2561c6ede711c67a769c3bb03f9e966ef01.dat
2007-12-22 03:24 . 2007-12-22 03:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-05 04:40 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2008-01-05 04:40 --------- d-----w C:\Program Files\Microsoft IntelliPoint
2008-01-05 04:40 --------- d-----w C:\Program Files\Dell Support
2008-01-01 01:56 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-01-01 01:52 --------- d-----w C:\Program Files\Common Files\aolshare
2007-12-31 01:29 --------- d-----w C:\Documents and Settings\JOE\Application Data\Temporary
2007-12-30 04:03 --------- d-----w C:\Program Files\Samsung
2007-12-30 04:03 --------- d-----w C:\Documents and Settings\JOE\Application Data\Samsung
2007-12-30 04:01 --------- d-----w C:\Program Files\Microsoft Games
2007-12-22 19:59 --------- d-----w C:\Program Files\QuickTime
2007-11-30 04:01 --------- d-----w C:\Documents and Settings\JOE\Application Data\Uniblue
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 04:51 --------- d-----w C:\Documents and Settings\JOE\Application Data\vlc
2007-11-06 04:29 --------- d-----w C:\Program Files\VideoLAN
2007-11-06 04:20 --------- d-----w C:\Program Files\Windows Media Connect 2
2007-10-30 23:42 3,590,656 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 23:40 227,328 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-22 09:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll
2007-10-22 09:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
2007-10-12 21:14 3,734,536 ----a-w C:\WINDOWS\system32\d3dx9_36.dll
2007-10-12 21:14 1,374,232 ----a-w C:\WINDOWS\system32\D3DCompiler_36.dll
2007-10-10 23:56 824,832 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56 1,159,680 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55 671,232 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ----a-w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ----a-w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ----a-w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ----a-w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 23:55 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:55 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 10:59 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-09-30 18:50 1,096 ----a-w C:\Documents and Settings\JOE\hof.dat
2007-01-11 21:07 58,032,562 -c--a-w C:\Documents and Settings\JOE\Samsung_PC_Studio_311_FKB.exe
2006-11-01 17:11 8 -csh--r C:\WINDOWS\system32\EAAA20B113.sys
2006-11-04 06:48 2,516 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot_2008-01-01_ 0.49.47.62 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-07-27 21:49:02 196,683 ----a-w C:\WINDOWS\system32\lnod32apiA.dll
+ 2007-07-27 21:49:02 225,355 ----a-w C:\WINDOWS\system32\lnod32apiW.dll
+ 2005-12-06 02:25:22 139,264 ----a-w C:\WINDOWS\system32\lnod32umc.dll
+ 2005-12-05 19:37:10 106,496 ----a-w C:\WINDOWS\system32\lnod32upd.dll
+ 2007-08-03 00:11:28 253,952 ----a-w C:\WINDOWS\system32\OnlineScannerDLLA.dll
+ 2007-08-03 00:11:14 241,664 ----a-w C:\WINDOWS\system32\OnlineScannerDLLW.dll
+ 2007-08-08 22:30:12 19,456 ----a-w C:\WINDOWS\system32\OnlineScannerLang.dll
+ 2007-06-13 17:10:34 77,824 ----a-w C:\WINDOWS\system32\OnlineScannerUninstaller.exe
+ 2004-12-07 17:11:34 258,352 ----a-w C:\WINDOWS\system32\unicows.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 13:19 282624 C:\WINDOWS\stsystra.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-06-28 23:43 8466432]
"nwiz"="nwiz.exe" [2007-06-28 23:43 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-06-28 23:43 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
America Online 9.0 Tray Icon.lnk - C:\Program Files\America Online 9.0\aoltray.exe [2006-10-19 14:33:46]
Bluetooth.lnk - C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe [2005-05-31 14:29:16]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-10-19 14:32:05]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\McafWelcome]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OASClnt]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MskService"=2 (0x2)
"McTskshd.exe"=2 (0x2)
"McShield"=2 (0x2)
"McDetect.exe"=2 (0x2)
"mcupdmgr.exe"=3 (0x3)
"MpfService"=2 (0x2)


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8b27c3bd-d344-11db-9518-000272cef255}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
Contents of the 'Scheduled Tasks' folder
"2007-12-31 01:50:46 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2008-01-05 00:16:30 C:\WINDOWS\Tasks\User_Feed_Synchronization-{7C817AB3-B00C-4813-A516-650DBD50047D}.job"
- C:\WINDOWS\system32\msfeedssync.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-04 23:32:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-04 23:33:10
ComboFix-quarantined-files.txt 2008-01-05 05:33:08
ComboFix2.txt 2008-01-05 02:56:54
ComboFix3.txt 2008-01-04 19:49:29
ComboFix4.txt 2008-01-03 21:05:18
ComboFix5.txt 2008-01-03 20:44:31
.
2007-12-30 03:26:29 --- E O F ---


HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:04:27 AM, on 1/5/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\stsystra.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&...us&ibd=0061019
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - S-1-5-21-2563160767-2867521304-1145967176-1007 Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe (User '?')
O4 - Startup: Registration Pacific Fighters.LNK = D:\registration_us\RegistrationReminder.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1188876984718
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1198534158250
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 6568 bytes

[forhockey]

Hi jc47,

Can you update me on how your system is behaving in Normal Mode now?

Thanks

[jc47]

Hi forhockey,

Running the same. 10 minutes to load desktop, each click at least 5 minutes to load programs. Once they're loaded, ComboFix and HJT run about the same as they do in Safe. Internet, I don't know, I gave up waiting.

Thanks,
jc

[forhockey]

There may also be a possibility for the reason your system is running slow is that McAfee didn't uninstall cleanly, as I still see stuff left behind in the logs.



Step 1 - Download and run the McAfee Removal tool

Note: You should first attempt to remove your McAfee consumer products using Add/Remove Programs in the Windows Control Panel (Programs and Features, in Windows Vista). This is the best method. After uninstalling using Windows Add/Remove Programs, run the McAfee Consumer Removal Tool (MCPR.EXE) to ensure successful removal of all McAfee references.

1. Download the removal tool from:

http://download.mcafee.com/products/...tches/MCPR.exe

2. Click Save and save the file to any folder on your computer.
3. Navigate to the folder where the file is saved.
4. Make sure all McAfee windows are closed.
5. Double-click MCPR.EXE to run the removal tool.


6. Restart your computer after receiving the message CleanUp Successful.

All McAfee products are now removed from your computer.


Let me know how the system behaves. Please do not run ComboFix unless instructed to.

[jc47]

Hello forhockey...

No change. Ran in safe mode. Got a window saying "Error obtaining full permission for cleanup. Some products may not be fully removed."

Ran again as administrator. Same results. Both times at the end of the scan, window said cleaning successful.

Thanks,
jc

[forhockey]

jc47,

Could you please run DSS from normal mode, and post back the results.

Thanks