Welcome to Tech Support Forum home to more then 136,000 problems solved. Issues have included: Spyware, Malware, Virus Issues, Windows, Microsoft, Linux, Networking, Security, Hardware, and Gaming Getting your problem solved is as easy as:
1. Registering for a free account
2. Asking your question
3. Receiving an answer

Registered members:
* Get free support
* Communicate privately with other members (PM).
* Removal of this message
* See fewer ads.
* And much more..

 


Want to know how to post a question? click here Having problems with spyware and pop-ups? First Steps
Go Back   Tech Support Forum > Security Center > Virus/Trojan/Spyware Help > Resolved HJT Threads
Reload this Page Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
User Name
Password
Site Map Register Donate Rules Blogs Mark Forums Read


Resolved HJT Threads Resolved spyware and popup issues.

 
 
LinkBack Thread Tools
Old 07-31-2008, 05:46 PM   #1 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
I'm having problems with this pop-up. Every time I start my computer this error pops up: "Error loading C:\Windows\System32\byXPIbxY.dll The specified module could not be found." I have run many spyware removal programs and virus scans and have found nothing. After running the Panda Activescan it showed that i have some virus's but they cannot be removed by that tool and my other virus scanner(Avast!) won't find it. Any help you could provide would be great, thanks.




Deckard's System Scanner v20071014.68
Run by Dan on 2008-07-31 07:18:32
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- Last 5 Restore Point(s) --
16: 2008-07-31 01:31:41 UTC - RP226 - Windows Update
15: 2008-07-31 01:25:29 UTC - RP225 - Installed Driver Detective
14: 2008-07-29 22:59:20 UTC - RP223 - Scheduled Checkpoint
13: 2008-07-29 02:41:10 UTC - RP222 - Scheduled Checkpoint
12: 2008-07-28 07:00:00 UTC - RP221 - Scheduled Checkpoint


-- First Restore Point --
1: 2008-07-18 18:45:48 UTC - RP210 - Scheduled Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2008-07-31 07:20:23
Platform: Windows Vista Service Pack 1 (6.00.6001)
MSIE: Internet Explorer (7.00.6000.16386)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\System32\csrss.exe
C:\Windows\System32\wininit.exe
C:\Windows\System32\csrss.exe
C:\Windows\System32\services.exe
C:\Windows\System32\lsass.exe
C:\Windows\System32\lsm.exe
C:\Windows\System32\winlogon.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\SLsvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\dlbccoms.exe
C:\Windows\System32\PnkBstrA.exe
C:\Windows\System32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\taskeng.exe
C:\Windows\System32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\taskeng.exe
C:\Windows\System32\dwm.exe
C:\Windows\explorer.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Users\Dan\Desktop\dss.exe
C:\Windows\System32\VSSVC.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\SearchProtocolHost.exe
C:\Windows\System32\SearchFilterHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE} - (no file)
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXPIbxY.dll,#1
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - (file missing)
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} () - http://fpdownload.macromedia.com/get.../ultrashim.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Protocol: ms-help - {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll
O18 - Filter: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL
O21 - SSODL: fdxbameg - {711D8683-355D-407E-831F-916DE75307FB} - (no file)
O21 - SSODL: fsrpknov - {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbc_device - Unknown owner - C:\Windows\System32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\System32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\stacsv.exe


--
End of file - 10125 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

All drivers whitelisted.


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>

S3 FLEXnet Licensing Service - "c:\program files\common files\macrovision shared\flexnet publisher\fnplicensingservice.exe" <Not Verified; Macrovision Europe Ltd.; FLEXnet Publisher (32 bit)>
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S3 WLSetupSvc (Windows Live Setup Service) - "c:\program files\windows live\installer\wlsetupsvc.exe" <Not Verified; Microsoft Corporation; Windows Live installer>


-- Device Manager: Disabled ----------------------------------------------------

Class GUID: {4d36e96c-e325-11ce-bfc1-08002be10318}
Description: IDT HDMI
Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&2E1A2CDF&0&0001
Manufacturer: IDT
Name: IDT HDMI
PNP Device ID: HDAUDIO\FUNC_01&VEN_1002&DEV_AA01&SUBSYS_00AA0100&REV_1000\5&2E1A2CDF&0&0001
Service: STHDA


-- Scheduled Tasks -------------------------------------------------------------

2008-07-31 06:54:34 368 --a------ C:\Windows\Tasks\RegCure.job
2008-07-30 18:38:15 434 --a------ C:\Windows\Tasks\RegCure Program Check.job
2008-07-30 07:32:32 414 --ah----- C:\Windows\Tasks\User_Feed_Synchronization-{4755E1F3-CE53-494D-867D-0CB2680B2C16}.job


-- Files created between 2008-06-30 and 2008-07-31 -----------------------------

2008-07-30 21:26:39 0 d-------- C:\Program Files\Panda Security
2008-07-30 18:26:00 0 d-------- C:\Users\All Users\PC Drivers HeadQuarters
2008-07-21 16:44:17 0 d-------- C:\TempDVD
2008-07-21 16:44:17 0 d-------- C:\dvdsanta
2008-07-21 16:44:12 0 d-------- C:\Program Files\dvdSanta
2008-07-19 11:43:52 0 d-------- C:\Program Files\iPod
2008-07-19 11:43:51 0 d-------- C:\Program Files\iTunes
2008-07-19 11:42:18 0 d-------- C:\Program Files\QuickTime
2008-07-16 20:07:40 0 d-------- C:\Users\All Users\Ubisoft
2008-07-16 07:04:59 0 d-------- C:\Windows\RegCure
2008-07-16 06:48:31 0 d-------- C:\Program Files\RegCure
2008-07-14 20:31:46 0 d-------- C:\Program Files\Ubisoft
2008-07-13 18:37:27 116864 --a------ C:\Windows\system32\xsbyys.dll
2008-07-13 18:37:26 116864 --a------ C:\Windows\system32\gvixdfsf.dll
2008-07-13 12:44:28 0 d-------- C:\Users\All Users\ATI
2008-07-10 21:24:04 116352 --a------ C:\Windows\system32\sjupkd.dll
2008-07-10 21:24:03 116352 --a------ C:\Windows\system32\svnrnwvt.dll
2008-07-10 21:23:22 168608 --ahs---- C:\Windows\system32\llTtDcdd.ini2
2008-07-10 16:51:39 116352 --a------ C:\Windows\system32\ldayvk.dll
2008-07-10 16:51:38 116352 --a------ C:\Windows\system32\eyykqlhl.dll
2008-07-10 16:50:58 164085 --ahs---- C:\Windows\system32\NnTtwyay.ini2
2008-07-10 06:51:48 347 --ahs---- C:\Windows\system32\mlRqqtwa.ini2
2008-07-09 22:12:00 1220 --ahs---- C:\Windows\system32\iPrCKRqr.ini2
2008-07-09 20:59:12 1461 --ahs---- C:\Windows\system32\bJPWxGgh.ini2
2008-07-09 18:22:10 1459 --ahs---- C:\Windows\system32\vEddJkkj.ini2
2008-07-09 08:44:23 163840 --a------ C:\Windows\enxw.exe
2008-07-09 08:39:46 0 -rahs---- C:\MSDOS.SYS
2008-07-09 08:39:46 0 -rahs---- C:\IO.SYS
2008-07-08 23:15:09 348160 --a------ C:\Windows\fsrpknov.dll
2008-07-08 23:14:46 0 d-------- C:\Program Files\PCHealthCenter
2008-07-06 22:05:32 0 d-------- C:\Program Files\DAEMON Tools Toolbar
2008-07-06 22:02:52 717296 --a------ C:\Windows\system32\drivers\sptd.sys
2008-07-03 18:19:38 0 d-------- C:\Program Files\E.M. DVD Copy
2008-07-01 18:05:16 0 d-------- C:\Users\All Users\WindowsSearch
2008-07-01 11:07:12 0 d-------- C:\Users\All Users\FLEXnet
2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-06-30 21:54:06 0 d-------- C:\Program Files\DNA
2008-06-30 21:54:06 0 d-------- C:\Program Files\BitTorrent


-- Find3M Report ---------------------------------------------------------------

2008-07-31 00:54:15 0 d-------- C:\Program Files\Spyware Doctor
2008-07-30 18:36:07 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-29 22:01:09 0 d-------- C:\Program Files\Warcraft III
2008-07-26 11:01:08 0 d-------- C:\Program Files\World of Warcraft
2008-07-21 20:08:56 0 d-------- C:\Users\Dan\AppData\Roaming\BitTorrent
2008-07-16 22:13:42 0 d-------- C:\Users\Dan\AppData\Roaming\DNA
2008-07-16 18:08:30 0 d-------- C:\Program Files\ATI
2008-07-14 20:49:20 0 d-------- C:\Users\Dan\AppData\Roaming\Ubisoft
2008-07-13 12:41:08 0 d-------- C:\Program Files\ATI Technologies
2008-07-09 19:56:05 0 d-------- C:\Users\Dan\AppData\Roaming\DAEMON Tools
2008-07-08 17:28:10 0 d-------- C:\Program Files\Windows Mail
2008-07-03 18:17:04 0 d-------- C:\Users\Dan\AppData\Roaming\Download Manager
2008-07-01 17:19:29 0 d-------- C:\Users\Dan\AppData\Roaming\Ahead
2008-07-01 15:41:07 0 d-------- C:\Program Files\BitLord2
2008-07-01 11:54:47 0 d-------- C:\Users\Dan\AppData\Roaming\Adobe
2008-07-01 11:04:17 0 d-------- C:\Program Files\Common Files\Adobe
2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files
2008-06-27 07:10:38 0 d-------- C:\Users\Dan\AppData\Roaming\Nikon
2008-06-27 07:09:42 0 d-------- C:\Program Files\Common Files\Nikon
2008-06-24 22:23:35 0 d-------- C:\Users\Dan\AppData\Roaming\WinRAR
2008-06-18 23:17:14 0 d-------- C:\Users\Dan\AppData\Roaming\ArcSoft
2008-06-12 22:52:43 0 d-------- C:\Program Files\Nikon
2008-05-31 20:51:42 0 d-------- C:\Program Files\Bethesda Softworks
2008-05-03 19:42:39 669184 --a------ C:\Windows\system32\pbsvc.exe


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{684BFE7F-F5B2-4AB3-A95E-EB5036A2D286}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [07/19/2008 07:38 AM]
"RtHDVCpl"="RtHDVCpl.exe" [09/18/2007 11:50 PM C:\Windows\RtHDVCpl.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM]
"MSServer"="C:\Windows\system32\byXPIbxY.dll" []
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [06/02/2008 06:19 PM]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 12:38 AM]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/10/2008 10:51 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/19/2008 12:33 AM]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [01/19/2008 12:33 AM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 12:33 AM]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [3/22/1999]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [4/1/2008 3:17:27 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"EnableLUA"=0 (0x0)
"EnableUIADesktopToggle"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"fsrpknov"= {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll [07/09/2008 05:09 AM 348160]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\Windows\system32\ddcDtTll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}]
AutoRun\command- wd_windows_tools\setup.exe


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-07-31 07:21:34 ------------
Attached Files
File Type: txt extra.txt (22.0 KB, 2 views)
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Important Information
Join the #1 Tech Support Forum Today - It's Totally Free!

TechSupportForum.com is a leading support website for your computer needs. We offer free, friendly and personalized computer support. Why pay to have your computer fixed when you can do it for free.

Join TechSupportforum.com Today - Click Here

Old 08-05-2008, 01:06 PM   #2 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hello and welcome to TSF.

I see that you are using BitTorrent, which is a p2p file sharing program. I would like to warn you that the nature of P2P filesharing is so that even if one is using a "clean" program, many of the files downloaded from non-documented sources have the potential of being infected. So, regardless of whether one is using a "clean" program, one may still be prone to infection by malware because more than half of all files available for download from peer-to-peer networks have been deliberately infected with some form of malware. Also by default, most P2P file sharing programs are configured to automatically launch at startup. They are also configured to allow other P2P users on the same network open access to a shared directory on your computer. The reason for this is simple, file sharing relies on its members giving and gaining unfettered access to computers across the P2P network. However, this practice can make you vulnerable to data and identity theft.
I recommend very strongly that you remove it from your system via Add/Remove Programs in Control Panel.

===================================

Please disable Spyware Doctor, as it may interfere with the fix. To disable Spyware Doctor:
  • Click the Spyware Doctor icon in the System Tray.
  • Click Settings.
  • Click Startup Settings under Pick a Category.
  • Uncheck Run at Windows startup.
  • Click Apply and Exit Spyware Doctor
Once your log is clean you can re-enable Spyware Doctor.

Please disable Windows Defender too. To disable Windows Defender:
  • Open Windows Defender
  • Click Tools
  • Click General Settings
  • Scroll down to Real Time Protection Options
  • Uncheck Use Real Time Protection (recommended)
  • After you uncheck this, click on the Save button
  • Close Windows Defender
Once your log is clean you can re-enable Windows Defender Real Time Protection.

===================================

Please right click on HijackThis and click Run as administrator

Click on "do a system scan only"
Place a checkmark next to these lines:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/cust...search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/cust.../www.yahoo.com
O2 - BHO: (no name) - {684BFE7F-F5B2-4AB3-A95E-EB5036A2D286} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {D935DD3B-5BD4-40B2-8914-0A4EEC8E84CE} - (no file)
O4 - HKLM\..\Run: [MSServer] rundll32.exe C:\Windows\system32\byXPIbxY.dll,#1
O9 - Extra button: (no name) - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing)
O9 - Extra 'Tools' menuitem: IE Anti-Spyware - {9034A523-D068-4BE8-A284-9DF278BE776E} - http://www.gateietool.com/redirect.php (file missing)
O21 - SSODL: fdxbameg - {711D8683-355D-407E-831F-916DE75307FB} - (no file)
O21 - SSODL: fsrpknov - {D6C9B483-B17D-497F-848D-8804E2D3F483} - C:\Windows\fsrpknov.dll

Then close all windows except HijackThis and click Fix Checked

==================================

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report in your next reply along with a fresh HijackThis log.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-05-2008, 06:55 PM   #3 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi, thanks for helping me out. I posted the mbam log first followed by the HijackThis log. Hopefully all this worked.


Malwarebytes' Anti-Malware 1.24
Database version: 1028
Windows 6.0.6001 Service Pack 1

5:46:14 PM 8/5/2008
mbam-log-8-5-2008 (17-46-14).txt

Scan type: Quick Scan
Objects scanned: 37948
Time elapsed: 2 minute(s), 11 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 18
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 14
Files Infected: 15

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{42e2b43f-3954-48ec-b549-5c05cb7dbd0a} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{07895222-50a5-4598-acb1-806ef2a9babc} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{c5ebee4a-e9ab-4efd-8672-f0166f8ac2c3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{abbafc19-c497-4ec0-9a4d-e19c6c5cf8a3} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{30d9b3f9-a597-447e-9152-22c0988bc44b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5b3cfc71-5900-4ef9-8b07-aca8b9acfefe} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{5c15e2bc-595f-42e7-8a3d-f34b8b8e6723} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7c69df2c-b0ec-41f0-a61a-923676fc6cf7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7f3611c2-2dba-4a15-acdf-0f9c33efc3d7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bd9410e1-0650-4329-b35a-2d6654cf7be7} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{ea87d749-5f8b-4bc6-909d-e22658172f3b} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.baql (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.bwbf (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sqvgnrpx.toolbar.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\videoPl.chl (Trojan.Zlob) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{684bfe7f-f5b2-4ab3-a95e-eb5036a2d286} (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\rhc50nj0ejaa (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKCU (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKCU\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKLM (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\HKLM\RunOnce (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\StartMenuAllUsers (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Autorun\StartMenuCurrentUser (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\BrowserObjects (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Users\Dan\AppData\Roaming\rhc50nj0ejaa\Quarantine\Packages (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Windows\System32\717305 (Trojan.BHO) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\enxw.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Windows\System32\gvixdfsf.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\trzC3F7.tmp (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Windows\System32\xsbyys.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\rhc50nj0ejaa\database.dat (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Program Files\rhc50nj0ejaa\license.txt (Rogue.Multiple) -> Quarantined and deleted successfully.
C:\Windows\fsrpknov.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.




Deckard's System Scanner v20071014.68
Run by Dan on 2008-08-05 17:50:31
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Dan.exe) -------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:50:32 PM, on 8/5/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\dlbccoms.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Dan\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Dan.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe

--
End of file - 7793 bytes

-- Files created between 2008-07-05 and 2008-08-05 -----------------------------

2008-08-05 17:40:17 0 d-------- C:\Users\All Users\Malwarebytes
2008-08-05 17:40:17 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 17:31:54 0 d-------- C:\Program Files\Trend Micro
2008-08-05 16:49:37 0 d-------- C:\Program Files\Apple Software Update
2008-08-05 16:48:59 0 d-------- C:\Program Files\iPod
2008-08-05 16:48:58 0 d-------- C:\Program Files\iTunes
2008-07-31 23:54:49 0 d-------- C:\Users\All Users\ATI
2008-07-31 23:39:31 0 d-------- C:\Users\Dan\{3e3343be-02ec-498e-82b5-b9d266ae2b31}
2008-07-30 21:26:39 0 d-------- C:\Program Files\Panda Security
2008-07-30 18:26:00 0 d-------- C:\Users\All Users\PC Drivers HeadQuarters
2008-07-21 16:44:17 0 d-------- C:\TempDVD
2008-07-21 16:44:17 0 d-------- C:\dvdsanta
2008-07-21 16:44:12 0 d-------- C:\Program Files\dvdSanta
2008-07-19 11:42:18 0 d-------- C:\Program Files\QuickTime
2008-07-16 20:07:40 0 d-------- C:\Users\All Users\Ubisoft
2008-07-16 07:04:59 0 d-------- C:\Windows\RegCure
2008-07-16 06:48:31 0 d-------- C:\Program Files\RegCure
2008-07-14 20:31:46 0 d-------- C:\Program Files\Ubisoft
2008-07-10 21:24:04 116352 --a------ C:\Windows\system32\sjupkd.dll
2008-07-10 21:24:03 116352 --a------ C:\Windows\system32\svnrnwvt.dll
2008-07-10 21:23:22 168608 --ahs---- C:\Windows\system32\llTtDcdd.ini2
2008-07-10 16:51:39 116352 --a------ C:\Windows\system32\ldayvk.dll
2008-07-10 16:51:38 116352 --a------ C:\Windows\system32\eyykqlhl.dll
2008-07-10 16:50:58 164085 --ahs---- C:\Windows\system32\NnTtwyay.ini2
2008-07-10 06:51:48 347 --ahs---- C:\Windows\system32\mlRqqtwa.ini2
2008-07-09 22:12:00 1220 --ahs---- C:\Windows\system32\iPrCKRqr.ini2
2008-07-09 20:59:12 1461 --ahs---- C:\Windows\system32\bJPWxGgh.ini2
2008-07-09 18:22:10 1459 --ahs---- C:\Windows\system32\vEddJkkj.ini2
2008-07-09 08:39:46 0 -rahs---- C:\MSDOS.SYS
2008-07-09 08:39:46 0 -rahs---- C:\IO.SYS
2008-07-06 22:05:32 0 d-------- C:\Program Files\DAEMON Tools Toolbar
2008-07-06 22:02:52 717296 --a------ C:\Windows\system32\drivers\sptd.sys


-- Find3M Report ---------------------------------------------------------------

2008-08-05 17:40:19 0 d-------- C:\Users\Dan\AppData\Roaming\Malwarebytes
2008-08-05 07:51:45 0 d-------- C:\Program Files\Spyware Doctor
2008-08-04 17:20:04 0 d-------- C:\Program Files\World of Warcraft
2008-08-01 09:44:18 0 d-------- C:\Program Files\ATI
2008-07-31 23:42:01 0 d-------- C:\Program Files\ATI Technologies
2008-07-30 18:36:07 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-07-29 22:01:09 0 d-------- C:\Program Files\Warcraft III
2008-07-16 22:13:42 0 d-------- C:\Users\Dan\AppData\Roaming\DNA
2008-07-14 20:49:20 0 d-------- C:\Users\Dan\AppData\Roaming\Ubisoft
2008-07-09 19:56:05 0 d-------- C:\Users\Dan\AppData\Roaming\DAEMON Tools
2008-07-08 17:28:10 0 d-------- C:\Program Files\Windows Mail
2008-07-07 06:44:31 0 d-------- C:\Program Files\E.M. DVD Copy
2008-07-03 18:17:04 0 d-------- C:\Users\Dan\AppData\Roaming\Download Manager
2008-07-01 17:19:29 0 d-------- C:\Users\Dan\AppData\Roaming\Ahead
2008-07-01 15:41:07 0 d-------- C:\Program Files\BitLord2
2008-07-01 11:54:47 0 d-------- C:\Users\Dan\AppData\Roaming\Adobe
2008-07-01 11:04:17 0 d-------- C:\Program Files\Common Files\Adobe
2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files
2008-07-01 10:57:06 0 d-------- C:\Program Files\Common Files\Macrovision Shared
2008-06-30 21:54:06 0 d-------- C:\Program Files\DNA
2008-06-27 07:10:38 0 d-------- C:\Users\Dan\AppData\Roaming\Nikon
2008-06-27 07:09:42 0 d-------- C:\Program Files\Common Files\Nikon
2008-06-24 22:23:35 0 d-------- C:\Users\Dan\AppData\Roaming\WinRAR
2008-06-18 23:17:14 0 d-------- C:\Users\Dan\AppData\Roaming\ArcSoft
2008-06-12 22:52:43 0 d-------- C:\Program Files\Nikon


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [07/19/2008 07:38 AM]
"RtHDVCpl"="RtHDVCpl.exe" [09/18/2007 11:50 PM C:\Windows\RtHDVCpl.exe]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [08/24/2007 07:00 AM]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [01/21/2008 12:17 PM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [01/19/2008 12:38 AM]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [07/10/2008 09:47 AM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [05/27/2008 10:50 AM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [07/30/2008 10:47 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [01/19/2008 12:33 AM]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [01/19/2008 12:33 AM]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [01/19/2008 12:33 AM]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [3/22/1999]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [4/1/2008 3:17:27 PM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"=2 (0x2)
"EnableLUA"=0 (0x0)
"EnableUIADesktopToggle"=0 (0x0)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\Windows\system32\ddcDtTll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}]
@="IEEE 1394 Bus host controllers"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}]
@="SBP2 IEEE 1394 Devices"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}]
@="SecurityDevices"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
"C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
"C:\Program Files\DNA\btdna.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
C:\Windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalService nsi lltdsvc SSDPSRV upnphost SCardSvr w32time EventSystem RemoteRegistry WinHttpAutoProxySvc lanmanworkstation TBS SLUINotify THREADORDER fdrespub netprofm fdphost wcncsvc QWAVE Mcx2Svc WebClient SstpSvc
LocalSystemNetworkRestricted hidserv UxSms WdiSystemHost Netman trkwks AudioEndpointBuilder WUDFSvc irmon sysmain IPBusEnum dot3svc PcaSvc EMDMgmt TabletInputService wlansvc WPDBusEnum


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}]
AutoRun\command- wd_windows_tools\setup.exe

*Newly Created Service* - PAVBOOT

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}]
C:\Windows\system32\unregmp2.exe /ShowWMP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}]
%SystemRoot%\system32\unregmp2.exe /FirstLogon /Shortcuts /RegBrowsers /ResetMUI



-- End of Deckard's System Scanner: finished at 2008-08-05 17:50:53 ------------
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-06-2008, 01:36 AM   #4 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,

Please download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/comb...o-use-combofix

Link 1
Link 2
Link 3


**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Right click on ComboFix.exe and run as administrator & follow the prompts.
  • When finished, it will produce a report for you.
  • Please post the C:\ComboFix.txt along with a new HijackThis log for further review.
Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-06-2008, 11:45 PM   #5 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
I downloaded Combofix and it says it's not compatable with my OS. I have Windows Vista with SP1.
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2008, 01:44 AM   #6 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
That shouldn't be a problem. Did you right click combofix.exe and choose "run as Administrator"?
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2008, 07:26 PM   #7 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
yes i did. i didn't try to keep running it when it said i have the wrong OS. i'll try it again.
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2008, 07:28 PM   #8 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
i just tried to run it and it closes after it tells me that it will only work on Winows 2000 and XP.
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-07-2008, 10:22 PM   #9 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Is the operating system 64 bit?
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-09-2008, 04:06 AM   #10 (permalink)
Asst Manager Security, Expert Analyst, Moderator, Security Team; Rangemaster, Moderator, TSF Academy
 
sUBs's Avatar
 
Join Date: May 2005
Posts: 24,353
OS: N/A


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Kindly download a fresh copy of ComboFix > http://download.bleepingcomputer.com/sUBs/ComboFix.exe
__________________

Question - what have you done for the community today?
sUBs is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-13-2008, 09:43 PM   #11 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
My operating system is 32-bit. I'm adding a log file from the new combofix i downloaded. also, the issue with the pop-up is gone.
Attached Files
File Type: txt log.txt (18.3 KB, 3 views)
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-14-2008, 02:55 AM   #12 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,

Thank you for the log. While I am reviewing it, I'll copy it here for convenience. Please remember to copy/paste the logs in the thread next time.

ComboFix 08-08-13.02 - Dan 2008-08-13 19:25:43.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2382 [GMT -7:00]
Running from: C:\Users\Dan\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\#SharedObjects\DGD663TC\interclick.com
C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\#SharedObjects\DGD663TC\interclick.com\ud.sol
C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Users\Dan\AppData\Roaming\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Windows\System32\bJPWxGgh.ini
C:\Windows\System32\bJPWxGgh.ini2
C:\Windows\system32\brqcdgio.ini
C:\Windows\system32\eyykqlhl.dll
C:\Windows\system32\fxeqfuve.ini
C:\Windows\System32\iPrCKRqr.ini
C:\Windows\System32\iPrCKRqr.ini2
C:\Windows\system32\ldayvk.dll
C:\Windows\System32\llTtDcdd.ini
C:\Windows\System32\llTtDcdd.ini2
C:\Windows\System32\mlRqqtwa.ini
C:\Windows\System32\mlRqqtwa.ini2
C:\Windows\System32\NnTtwyay.ini
C:\Windows\System32\NnTtwyay.ini2
C:\Windows\system32\rilualtn.ini
C:\Windows\system32\siqwlrlk.ini
C:\Windows\system32\sjupkd.dll
C:\Windows\system32\svnrnwvt.dll
C:\Windows\System32\vEddJkkj.ini
C:\Windows\System32\vEddJkkj.ini2
C:\Windows\system32\xwhqahre.ini

----- BITS: Possible infected sites -----

http://images.metaservices.microsoft.com:80
.
((((((((((((((((((((((((( Files Created from 2008-07-14 to 2008-08-14 )))))))))))))))))))))))))))))))
.

2008-08-07 18:48 . 2008-08-08 16:48 <DIR> d-------- C:\Users\Dan\AppData\Roaming\BitTorrent
2008-08-07 18:47 . 2008-08-07 18:47 <DIR> d-------- C:\Program Files\BitTorrent
2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Users\Dan\AppData\Roaming\Malwarebytes
2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Users\All Users\Malwarebytes
2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\ProgramData\Malwarebytes
2008-08-05 17:40 . 2008-08-05 17:40 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-05 17:40 . 2008-07-30 20:07 38,472 --a------ C:\Windows\System32\drivers\mbamswissarmy.sys
2008-08-05 17:40 . 2008-07-30 20:07 17,144 --a------ C:\Windows\System32\drivers\mbam.sys
2008-08-05 17:31 . 2008-08-05 17:31 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-05 16:49 . 2008-08-05 16:49 <DIR> d-------- C:\Program Files\Apple Software Update
2008-08-05 16:48 . 2008-08-05 16:49 <DIR> d-------- C:\Program Files\iTunes
2008-08-05 16:48 . 2008-08-05 16:48 <DIR> d-------- C:\Program Files\iPod
2008-07-31 23:54 . 2008-07-31 23:54 <DIR> d-------- C:\Users\All Users\ATI
2008-07-31 23:54 . 2008-07-31 23:54 <DIR> d-------- C:\ProgramData\ATI
2008-07-31 07:18 . 2008-07-31 07:18 <DIR> d-------- C:\Deckard
2008-07-30 21:26 . 2008-07-30 21:26 <DIR> d-------- C:\Program Files\Panda Security
2008-07-30 21:26 . 2008-06-19 17:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys
2008-07-30 18:26 . 2008-07-30 18:26 <DIR> d-------- C:\Users\All Users\PC Drivers HeadQuarters
2008-07-30 18:26 . 2008-07-30 18:26 <DIR> d-------- C:\ProgramData\PC Drivers HeadQuarters
2008-07-25 01:36 . 2008-07-25 01:36 524,288 --a------ C:\Windows\System32\DivXsm.exe
2008-07-25 01:36 . 2008-07-25 01:36 4,816 --a------ C:\Windows\System32\divxsm.tlb
2008-07-23 09:50 . 2008-07-23 09:50 3,596,288 --a------ C:\Windows\System32\qt-dx331.dll
2008-07-23 09:48 . 2008-07-23 09:48 1,044,480 --a------ C:\Windows\System32\libdivx.dll
2008-07-23 09:48 . 2008-07-23 09:48 200,704 --a------ C:\Windows\System32\ssldivx.dll
2008-07-23 09:47 . 2008-07-23 09:47 416 --a------ C:\Windows\System32\dtu100.dll.manifest
2008-07-23 09:47 . 2008-07-23 09:47 416 --a------ C:\Windows\System32\dpl100.dll.manifest
2008-07-23 09:46 . 2008-07-23 09:46 12,288 --a------ C:\Windows\System32\DivXWMPExtType.dll
2008-07-21 16:46 . 2008-07-21 17:38 26 --a------ C:\Windows\dvdSanta.INI
2008-07-21 16:44 . 2008-07-21 16:44 <DIR> d-------- C:\TempDVD
2008-07-21 16:44 . 2008-07-31 07:04 <DIR> d-------- C:\Program Files\dvdSanta
2008-07-21 16:44 . 2008-07-21 17:41 <DIR> d-------- C:\dvdsanta
2008-07-19 11:42 . 2008-07-19 11:42 <DIR> d-------- C:\Program Files\QuickTime
2008-07-16 20:07 . 2008-07-16 20:07 <DIR> d-------- C:\Users\All Users\Ubisoft
2008-07-16 20:07 . 2008-07-16 20:07 <DIR> d-------- C:\ProgramData\Ubisoft
2008-07-16 07:04 . 2008-07-16 07:06 <DIR> d-------- C:\Windows\RegCure
2008-07-16 06:48 . 2008-07-16 07:06 <DIR> d-------- C:\Program Files\RegCure
2008-07-14 20:49 . 2008-07-14 20:49 <DIR> d-------- C:\Users\Dan\AppData\Roaming\Ubisoft
2008-07-14 20:31 . 2008-07-14 20:31 <DIR> d-------- C:\Program Files\Ubisoft
2008-07-14 17:55 . 2008-07-10 21:23 322,304 --a------ C:\Windows\System32\trzEE7F.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-14 02:28 19,822 ----a-w C:\Windows\system32\drivers\stwrte.log
2008-08-14 02:27 --------- d-----w C:\Users\Dan\AppData\Roaming\DNA
2008-08-14 02:21 --------- d---a-w C:\ProgramData\TEMP
2008-08-13 12:50 --------- d-----w C:\Program Files\Spyware Doctor
2008-08-12 03:40 --------- d-----w C:\Program Files\World of Warcraft
2008-08-12 03:11 --------- d-----w C:\Program Files\Warcraft III
2008-08-12 01:34 --------- d-----w C:\Users\Dan\AppData\Roaming\Apple Computer
2008-08-12 01:05 20 ---h--w C:\Users\All Users\PKP_DLdu.DAT
2008-08-12 01:05 20 ---h--w C:\ProgramData\PKP_DLdu.DAT
2008-08-08 05:34 --------- d-----w C:\Program Files\DivX
2008-08-01 16:44 --------- d-----w C:\Program Files\ATI
2008-08-01 06:42 --------- d-----w C:\Program Files\ATI Technologies
2008-07-31 01:36 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-19 14:36 51,280 ----a-w C:\Windows\system32\drivers\aswMonFlt.sys
2008-07-10 06:11 --------- d-----w C:\Program Files\DAEMON Tools Toolbar
2008-07-10 02:56 --------- d-----w C:\Users\Dan\AppData\Roaming\DAEMON Tools
2008-07-09 15:05 --------- d-----w C:\ProgramData\Microsoft Help
2008-07-09 00:28 --------- d-----w C:\Program Files\Windows Mail
2008-07-07 13:44 --------- d-----w C:\Program Files\E.M. DVD Copy
2008-07-07 05:02 717,296 ----a-w C:\Windows\system32\drivers\sptd.sys
2008-07-04 01:17 --------- d-----w C:\Users\Dan\AppData\Roaming\Download Manager
2008-07-02 01:05 --------- d-----w C:\ProgramData\WindowsSearch
2008-07-02 00:19 --------- d-----w C:\Users\Dan\AppData\Roaming\Ahead
2008-07-01 22:41 --------- d-----w C:\Program Files\BitLord2
2008-07-01 18:07 --------- d-----w C:\ProgramData\FLEXnet
2008-07-01 18:04 --------- d-----w C:\Program Files\Common Files\Adobe
2008-07-01 17:57 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-07-01 04:54 --------- d-----w C:\Program Files\DNA
2008-06-27 14:10 --------- d-----w C:\Users\Dan\AppData\Roaming\Nikon
2008-06-27 14:09 --------- d-----w C:\Program Files\Common Files\Nikon
2008-06-19 06:17 --------- d-----w C:\Users\Dan\AppData\Roaming\ArcSoft
2008-06-13 05:39 20 ---h--w C:\Users\All Users\PKP_DLec.DAT
2008-06-13 05:39 20 ---h--w C:\ProgramData\PKP_DLec.DAT
2008-05-04 02:43 22,328 ----a-w C:\Users\Dan\AppData\Roaming\PnkBstrK.sys
2008-04-15 19:31 859,282 ----a-w C:\Users\Dan\1280_StarCraft2GameplayVideo_EnglishUS2-avi-downloader.exe
2008-03-24 04:09 174 --sha-w C:\Program Files\desktop.ini
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-01-19 00:33 1233920]
"ehTray.exe"="C:\Windows\ehome\ehTray.exe" [2008-01-19 00:33 125952]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 00:33 202240]
"BitTorrent DNA"="C:\Program Files\DNA\btdna.exe" [2008-08-07 18:47 341824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57 153136]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 07:00 33648]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 12:17 61440]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 10:47 289064]
"RtHDVCpl"="RtHDVCpl.exe" [2007-09-18 23:50 4702208 C:\Windows\RtHDVCpl.exe]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-03-22 65588]
NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2008-04-01 15:17:27 118784]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKLM\~\startupfolder\C:^Users^Dan^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitTorrent DNA]
--a------ 2008-08-07 18:47 341824 C:\Program Files\DNA\btdna.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray.exe]
--a------ 2008-01-19 00:33 125952 C:\Windows\ehome\ehtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1883384528-1375300349-1264342087-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7C162ADF-1C1B-47FA-B131-0BBF78CB11F6}"= UDP:C:\Windows\System32\dlbccoms.exe:Photo Printer 720 Server
"{338801CC-B447-4EEA-8270-8EB42E00C69B}"= TCP:C:\Windows\System32\dlbccoms.exe:Photo Printer 720 Server
"{F9981515-F3E2-48FF-BB9D-9293DD5D4B06}"= C:\Program Files\Windows Live\Messenger\livecall.exe:Windows Live Messenger (Phone)
"{C9CA26EA-6F0B-4A59-8671-AC7D8B71D82D}"= UDP:C:\Program Files\World of Warcraft\WoW-2.4.0-enUS-downloader.exe:Blizzard Downloader
"{8476BFA0-F1F6-412D-85E9-1EEECA75B9EE}"= TCP:C:\Program Files\World of Warcraft\WoW-2.4.0-enUS-downloader.exe:Blizzard Downloader
"{45664F0A-71F1-4EDF-A422-0C99D21238A2}"= UDP:3724:Blizzard Downloader: 3724
"{73340249-416A-4FB4-9CE0-C103F1B4C4D6}"= UDP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"{5D148400-DFDB-462C-8679-4ED926130D1A}"= TCP:C:\Program Files\Microsoft Games\Age of Empires III\age3.exe:Age of Empires 3
"TCP Query User{8D14627C-FC3D-484F-B7D4-72FEF5FD7FC9}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= UDP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"UDP Query User{B6EFEA90-12E4-4775-8431-16C20C99886C}C:\\program files\\common files\\ahead\\nero web\\setupx.exe"= TCP:C:\program files\common files\ahead\nero web\setupx.exe:MSI starter
"TCP Query User{FF86588F-60B9-4EE3-ADA2-810640E1ED51}C:\\users\\dan\\appdata\\local\\temp\\nero web\\setupxu.exe"= UDP:C:\users\dan\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"UDP Query User{84058707-87DD-455E-9602-1A063834B8BE}C:\\users\\dan\\appdata\\local\\temp\\nero web\\setupxu.exe"= TCP:C:\users\dan\appdata\local\temp\nero web\setupxu.exe:setupxu.exe
"TCP Query User{50255DEF-93D9-4DC8-9831-7F8C6BD15E5D}C:\\program files\\bitlord2\\bitlord.exe"= UDP:C:\program files\bitlord2\bitlord.exe:
"UDP Query User{B110ECCF-8AD1-4E43-8E9F-E41EADB10998}C:\\program files\\bitlord2\\bitlord.exe"= TCP:C:\program files\bitlord2\bitlord.exe:
"{EB631120-5462-4E54-B7A1-E7297A7F6962}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{E09D8E5D-D931-46B7-8786-53E06B8C1B2F}"= UDP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{DCFD25CE-CA98-40D3-BB73-EA56A0EEB889}"= TCP:C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{C8723816-016E-4715-ABB7-FA9966314478}"= UDP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{BF6B159F-D78E-488F-9B9B-80EDE1E7A7D2}"= TCP:C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{2A0EFE6E-3F50-4CE9-974C-D1A81415916C}"= UDP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{FCF4D7AD-EC54-485E-B0CC-27E03A31C213}"= TCP:C:\Program Files\Bonjour\mDNSResponder.exe:Bonjour
"{279FFD02-8668-4CEA-9849-B8776C9A21DC}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{65435975-6C9B-4C77-A66E-807739A1F7B8}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{9EC658D9-DED3-4DF1-A320-A50EB7C92A84}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{1E160DAF-3BE2-4CE8-B7C3-FE9C37124245}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{C5DEF5D6-AD8C-44FB-869F-8AB4D1C47AA3}"= UDP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{A133A347-EBA9-4FC9-AF17-D644B9291248}"= TCP:C:\Program Files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{DCFC2324-3814-4FA8-ADAB-06259361CE43}"= UDP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{CC3981C6-DD33-4924-B4D7-E64CFEE9BFFC}"= TCP:C:\Windows\System32\PnkBstrA.exe:PnkBstrA
"{E6E75669-1A4A-4B02-B911-05C6E13A3144}"= UDP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"{90CAEE53-668A-41D7-89B4-EF786C9791D0}"= TCP:C:\Windows\System32\PnkBstrB.exe:PnkBstrB
"TCP Query User{A8B1125B-1726-46D6-AF58-B7073E740CA0}C:\\program files\\bitlord2\\bitlord.exe"= UDP:C:\program files\bitlord2\bitlord.exe:
"UDP Query User{AAD0C4B9-8DD5-4A4E-98BF-8547F8709410}C:\\program files\\bitlord2\\bitlord.exe"= TCP:C:\program files\bitlord2\bitlord.exe:
"{8CA0057B-6A67-41C5-A84A-75676A11FEDC}"= UDP:C:\Program Files\DNA\btdna.exe:DNA
"{13F61980-5E80-4233-91CC-AF061707BC83}"= TCP:C:\Program Files\DNA\btdna.exe:DNA
"{347AC052-3409-4977-B971-BF326D64263D}"= UDP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{92E1911D-CBC4-4D61-845D-2A2FD6FB1525}"= TCP:C:\Program Files\BitTorrent\bittorrent.exe:BitTorrent
"{9BAB9E59-9A30-40B0-83AE-5019E25B9845}"= UDP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{46331AB7-01B5-450D-AAE7-CE52A0C4F779}"= TCP:C:\Program Files\iTunes\iTunes.exe:iTunes
"{587DF2A9-0006-4F93-A4D1-4D7C26B81A65}"= UDP:C:\Program Files\DNA\btdna.exe:DNA (TCP-In)
"{314183C2-7CD3-4C2F-B0C0-005AA2F67B7A}"= TCP:C:\Program Files\DNA\btdna.exe:DNA (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"= C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent

R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 aswSP;avast! Self Protection;C:\Windows\system32\drivers\aswSP.sys [2008-07-19 07:35]
R2 aswFsBlk;aswFsBlk;C:\Windows\system32\DRIVERS\aswFsBlk.sys [2008-07-19 07:37]
R2 aswMonFlt;aswMonFlt;C:\Windows\system32\DRIVERS\aswMonFlt.sys [2008-07-19 07:36]
R2 dlbc_device;dlbc_device;C:\Windows\system32\dlbccoms.exe [2007-03-01 15:52]
R3 atikmdag;atikmdag;C:\Windows\system32\DRIVERS\atikmdag.sys [2008-06-02 23:22]
S3 netr73;Linksys Compact Wireless-G USB Adapter Driver for Vista;C:\Windows\system32\DRIVERS\WUSB54GCx86.sys [2007-03-12 03:12]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{750834f0-0458-11dd-ac14-001d7dab238e}]
\shell\AutoRun\command - wd_windows_tools\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-14 C:\Windows\Tasks\RegCure Program Check.job
- C:\Program Files\RegCure\RegCure.exe [2007-08-02 01:20]

2008-07-31 C:\Windows\Tasks\RegCure.job
- C:\Program Files\RegCure\RegCure.exe [2007-08-02 01:20]

2008-08-13 C:\Windows\Tasks\User_Feed_Synchronization-{4755E1F3-CE53-494D-867D-0CB2680B2C16}.job
- C:\Windows\system32\msfeedssync.exe [2008-01-19 00:33]
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://sympatico.msn.ca/
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 -: eBay Search - C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-13 19:29:08
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\Users\Dan\AppData\Local\Temp\WPDNSE

scan completed successfully
hidden files: 1

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\Ati2evxx.exe
C:\Windows\System32\audiodg.exe
C:\Windows\System32\Ati2evxx.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\System32\PnkBstrA.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Windows\System32\wbem\unsecapp.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\System32\wbem\WMIADAP.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Completion time: 2008-08-13 19:33:14 - machine was rebooted [Dan]
ComboFix-quarantined-files.txt 2008-08-14 02:33:05

Pre-Run: 103,231,737,856 bytes free
Post-Run: 103,407,611,904 bytes free

260 --- E O F --- 2008-07-31 01:33:06
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-14-2008, 03:16 AM   #13 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,

If you've removed BitTorrent, please remove its associated folders too:

C:\Users\Dan\AppData\Roaming\BitTorrent
C:\Program Files\BitTorrent

Delete the following file:
C:\Windows\System32\trzEE7F.tmp


==============================

Using Internet Explorer, visit http://www.kaspersky.nl/scanforvirus-en/kavwebscan.html

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Answer Yes, when prompted to install an ActiveX component.
  • The program will then begin downloading the latest definition files.
  • Once the files have been downloaded click on NEXT
  • Locate the Scan Settings button & configure to:
    • Scan using the following Anti-Virus database:
      • Extended
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK & have it scan My Computer
  • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
  • Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Click View scan report at the bottom.



  • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply along with a fresh HijackThis log and an update on how things are now.

**Note**

To optimize scanning time and produce a more sensible report for review:
  • Close any open programs
  • Turn off the real time scanner of any existing antivirus program while performing the online scan
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-18-2008, 08:22 PM   #14 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,
here are the results from running the kaspersky scan as well as a fresh hijackthis log. things are good with my computer, the pop-up does not show up on start up anymore.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, August 18, 2008
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Tuesday, August 19, 2008 01:54:14
Records in database: 1107997
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\

Scan statistics:
Files scanned: 175559
Threat name: 9
Infected objects: 14
Suspicious objects: 0
Duration of the scan: 01:23:44


File name / Threat name / Threats count
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.WinAntiVirus.ay 1
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.Agent.u 2
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: Trojan.Win32.Agent.tws 1
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:Porn-Downloader.Win32.Agent.v 1
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.h 1
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\lwpower.exe Infected: not-a-virus:FraudTool.Win32.UltimateAntivirus.k 1
C:\Deckard\System Scanner\20080805173127\backup\Users\Dan\AppData\Local\Temp\software.php Infected: Trojan.Win32.Vapsup.ioc 1
C:\QooBox\Quarantine\C\Windows\System32\eyykqlhl.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\Windows\System32\ldayvk.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\Windows\System32\sjupkd.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\Windows\System32\svnrnwvt.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full\DVDSanta.v4.5.retail-FOSI\fo-dvs45.exe Infected: Trojan.Win32.Pakes.jwo 1
C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full.rar Infected: Trojan.Win32.Pakes.jwo 1

The selected area was scanned.




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:18:43 PM, on 8/18/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\csrss.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\dlbccoms.exe
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Users\Dan\AppData\Local\Temp\jkos-Dan\binaries\ScanningProcess.exe
C:\Users\Dan\AppData\Local\Temp\jkos-Dan\binaries\ScanningProcess.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Windows\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.nl/scanforvirus...an_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD44/JS...ws-i586-jc.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlbc_device - - C:\Windows\system32\dlbccoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe

--
End of file - 9231 bytes
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-19-2008, 01:38 AM   #15 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Hi,

Quote:
things are good with my computer, the pop-up does not show up on start up anymore.
Good to hear that.

=========================================

I can still see a p2p file sharing program, i.e. BitTorrent DNA, running. With reference to my post #2, I would strongly recommend that you remove BitTorrent DNA as well.

========================================

The following are reported by Kaspersky as infected. Perhaps downloaded via BitTorrent? Please delete them.

C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full\DVDSanta.v4.5.retail-FOSI\fo-dvs45.exe
C:\Users\Dan\Documents\Downloads\DVDSanta v4.5 full.rar

Also delete the DSS from your desktop.

The other items will be addressed when you uninstall Combofix. Your log is clean and you're good to go.
  • Click Start then Run
  • Now type Combofix /u in the runbox and click OK. Notice the space between the x and the /u


    This will uninstall ComboFix. It will also implement some cleanup procedures and reset System Restore points to prevent reinfection from old restore points.
========================================

A colleague of ours has excellent information and tips on the prevention of malware here for your future reference.

Please respond to this thread one more time so we can mark this thread as resolved.

Happy Surfing!
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-19-2008, 06:29 PM   #16 (permalink)
DRR
Registered User
 
Join Date: Jul 2008
Posts: 8
OS: Vista, SP1, 32-bit


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
Everything looks good. I cleaned everything up that you told me to. Thank you very much for your help.
DRR is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
Old 08-20-2008, 12:38 AM   #17 (permalink)
Moderator, Analyst, Security Team ; Rangemaster, TSF Academy
 
amateur's Avatar
 
Join Date: Jun 2006
Location: USA
Posts: 7,307
OS: XP SP3


Re: Constant Pop up- Error loading C:\Windows\System32\byXPIbxY.dll
You're welcome. Glad we could help.

Stay safe!
__________________
My services are free. However, you can donate to TSF to help keep it running.




Member of ASAP since 2005
Member of UNITE since 2006
amateur is offline  
Digg this Post!Add Post to del.icio.usBookmark Post in TechnoratiFurl this Post!Reddit!
 

« Previous Thread | Next Thread »

Thread Tools

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are Off
Pingbacks are Off
Refbacks are Off



All times are GMT -7. The time now is 11:23 AM.

Contact Us - Tech Support Forum - Archive - Privacy Statement - Top


Copyright 2001 - 2009, Tech Support Forum
Home Tips Plus | Outdoor Basecamp | Automotive Support Forum

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85