Computer Has Pop Ups.

XZanE · 08-21-2008, 01:57 AM

I downloaded something and then I got lots of pop ups!saying i am unprotected also changed my desktop bg and now i can't change it back. and now i checked my email and it has lots of delivery failures so i think i have a worm or something. here is the hijackthis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:53:15, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcttsj0ep99.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Boooo...
F3 - REG:win.ini: run="C:\Documents and Settings\Chris\Application Data\Adobe\Manager.exe"
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [lphcttsj0ep99] C:\WINDOWS\system32\lphcttsj0ep99.exe
O4 - HKLM\..\Run: [\SUE12B.exe] C:\Windows\SUE12B.exe
O4 - HKLM\..\Run: [\SUE12C.exe] C:\Windows\SUE12C.exe
O4 - HKLM\..\Run: [\SUE12D.exe] C:\Windows\SUE12D.exe
O4 - HKLM\..\Run: [\SUE12E.exe] C:\Windows\SUE12E.exe
O4 - HKLM\..\Run: [\SUE12F.exe] C:\Windows\SUE12F.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [\SUE12B.exe] C:\Windows\SUE12B.exe
O4 - HKCU\..\Run: [\SUE12C.exe] C:\Windows\SUE12C.exe
O4 - HKCU\..\Run: [\SUE12D.exe] C:\Windows\SUE12D.exe
O4 - HKCU\..\Run: [\SUE12E.exe] C:\Windows\SUE12E.exe
O4 - HKCU\..\Run: [\SUE12F.exe] C:\Windows\SUE12F.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Windows Live Messenger.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7699 bytes

XZanE · 08-27-2008, 11:50 PM

some one want to check this for me please

XZanE · 09-06-2008, 08:35 AM

someone please help me!

**chemist** · 09-06-2008, 09:55 AM

Hello and Welcome to TSF.

Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription.

Download RSIT by random/random and Save it to your Desktop.
Double-click RSIT.exe to run the tool.
Click Continue at the disclaimer screen.
When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized.
Please copy/paste the contents of log.txt in your next reply.
Please attach info.txt to your reply.

To attach a file to a reply, simply

Click the Manage Attachments button under Additional Options > Attach Files on the post composition page, and
Copy and Paste the following into the Upload File from your Computer box:
C:\rsit\info.txt
Click Upload

------------------------------------------------------

Please explain why this computer has no antivirus program installed and running. This is an open invitation for infection.

It can take as little as eight seconds to infect an unprotected computer.

Please keep this computer offline except when downloading tools and posting in the forum until we get one installed.

XZanE · 09-06-2008, 05:13 PM

Logfile of random's system information tool (written by random/random)
Run by Chris at 2008-09-07 09:11:41
Microsoft Windows XP Professional Service Pack 2
System drive C: has 2 GB (3%) free of 76 GB
Total RAM: 767 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:11:48, on 9/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\lphcttsj0ep99.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\My Documents\Downloads\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Chris.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.com.au
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = http://google.com.au
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Boooo...
F3 - REG:win.ini: run="C:\Documents and Settings\Chris\Application Data\Adobe\Manager.exe"
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [lphcttsj0ep99] C:\WINDOWS\system32\lphcttsj0ep99.exe
O4 - HKLM\..\Run: [\SUE12B.exe] C:\Windows\SUE12B.exe
O4 - HKLM\..\Run: [\SUE12C.exe] C:\Windows\SUE12C.exe
O4 - HKLM\..\Run: [\SUE12D.exe] C:\Windows\SUE12D.exe
O4 - HKLM\..\Run: [\SUE12E.exe] C:\Windows\SUE12E.exe
O4 - HKLM\..\Run: [\SUE12F.exe] C:\Windows\SUE12F.exe
O4 - HKLM\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKLM\..\Run: [sysrest32.exe] C:\WINDOWS\system32\sysrest32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [\SUE12B.exe] C:\Windows\SUE12B.exe
O4 - HKCU\..\Run: [\SUE12C.exe] C:\Windows\SUE12C.exe
O4 - HKCU\..\Run: [\SUE12D.exe] C:\Windows\SUE12D.exe
O4 - HKCU\..\Run: [\SUE12E.exe] C:\Windows\SUE12E.exe
O4 - HKCU\..\Run: [\SUE12F.exe] C:\Windows\SUE12F.exe
O4 - HKCU\..\Run: [Antivirus] C:\Program Files\VAV\vav.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Windows Live Messenger.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O21 - SSODL: YJeWtOXWOa - {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 8686 bytes

Scheduled tasks folder

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Check Updates for Windows Live Toolbar.job
C:\WINDOWS\tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1220236639.job
C:\WINDOWS\tasks\GoogleUpdateTaskUser.job

Registry dump

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497bb-d6f0-462c-b6eb-d4daf1d92d43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2007-09-20 328752]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0}]
Windows Live Toolbar Helper - C:\Program Files\Windows Live Toolbar\msntb.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - Windows Live Toolbar - C:\Program Files\Windows Live Toolbar\msntb.dll []

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"IntelliPoint"=C:\Program Files\Microsoft IntelliPoint\ipoint.exe [2007-02-06 849280]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-07-10 116040]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-05-27 413696]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-07-30 289064]
"NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2008-02-28 570664]
"NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [2008-02-18 2221352]
"lphcttsj0ep99"=C:\WINDOWS\system32\lphcttsj0ep99.exe [2008-08-19 195072]
"\SUE12B.exe"=C:\Windows\SUE12B.exe []
"\SUE12C.exe"=C:\Windows\SUE12C.exe []
"\SUE12D.exe"=C:\Windows\SUE12D.exe []
"\SUE12E.exe"=C:\Windows\SUE12E.exe []
"\SUE12F.exe"=C:\Windows\SUE12F.exe []
"Antivirus"=C:\Program Files\VAV\vav.exe []
"sysrest32.exe"=C:\WINDOWS\system32\sysrest32.exe []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"=C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe [2007-10-18 5724184]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2007-09-19 171464]
"CurseClient"=C:\Program Files\Curse\CurseClient.exe [2008-05-20 1400832]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe [2008-02-28 1828136]
"\SUE12B.exe"=C:\Windows\SUE12B.exe []
"\SUE12C.exe"=C:\Windows\SUE12C.exe []
"\SUE12D.exe"=C:\Windows\SUE12D.exe []
"\SUE12E.exe"=C:\Windows\SUE12E.exe []
"\SUE12F.exe"=C:\Windows\SUE12F.exe []
"Antivirus"=C:\Program Files\VAV\vav.exe []
"Google Update"=C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-04 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [2006-11-28 222720]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
hpoddt01.exe.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
officejet 6100.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
Windows Live Messenger.lnk - C:\WINDOWS\Installer\{D900E12F-DC9F-437B-8E63-5E8D781A06B5}\MsblIco.Exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]
YJeWtOXWOa - {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll [2007-04-17 32768]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"NoDispBackgroundPage"=1
"NoDispScrSavPage"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus"
"C:\Program Files\NEXON\MapleStory\Patcher.exe"="C:\Program Files\NEXON\MapleStory\Patcher.exe:*:Enabled:Patcher MFC ?? ????"
"C:\Program Files\NEXON\MapleStory\NewPatcher.exe"="C:\Program Files\NEXON\MapleStory\NewPatcher.exe:*:Enabled:Patcher MFC ?? ????"
"C:\Program Files\NEXON\MapleStory\MapleStory.exe"="C:\Program Files\NEXON\MapleStory\MapleStory.exe:*:Enabled:MapleStory"
"C:\Program Files\C&C TS\GAME.EXE"="C:\Program Files\C&C TS\GAME.EXE:*:Enabled:Main executable for Tiberian Sun"
"C:\Program Files\LimeWire\LimeWire.exe"="C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire"
"C:\Program Files\Soldat\Soldat.exe"="C:\Program Files\Soldat\Soldat.exe:*:Enabled:Soldat"
"C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.0-enUS-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"="C:\Program Files\World of Warcraft\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\World of Warcraft\BackgroundDownloader.exe"="C:\Program Files\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Documents and Settings\Chris\Local Settings\Temp\.ttB.tmp"="C:\Documents and Settings\Chris\Local Settings\Temp\.ttB.tmp:*:Enabled:enable"
"C:\WINDOWS\system32\sysrest32.exe"="C:\WINDOWS\system32\sysrest32.exe:*:Enabled:enable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Windows Live\Messenger\livecall.exe"="C:\Program Files\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

List of files/folders created in the last three months

2008-09-07 09:11:41 ----D---- C:\rsit
2008-09-04 18:36:23 ----A---- C:\WINDOWS\system32\javaws.exe
2008-09-04 18:36:23 ----A---- C:\WINDOWS\system32\javaw.exe
2008-09-04 18:36:23 ----A---- C:\WINDOWS\system32\java.exe
2008-09-01 12:38:41 ----D---- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZisn12.dll
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZipt12.dll
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZipr12.dll
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZipm12.exe
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZinw12.exe
2008-09-01 12:37:12 ----RA---- C:\WINDOWS\system32\HPZidr12.dll
2008-09-01 12:30:58 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2008-09-01 12:29:12 ----D---- C:\Program Files\Hewlett-Packard
2008-08-19 13:48:54 ----D---- C:\Program Files\SpywareBlaster
2008-08-19 13:46:36 ----D---- C:\Program Files\Trend Micro
2008-08-19 13:43:14 ----D---- C:\ie-spyad_zo
2008-08-19 13:39:39 ----D---- C:\Program Files\Panda Security
2008-08-19 12:02:17 ----D---- C:\WINDOWS\privacy_danger
2008-08-19 12:02:11 ----D---- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons
2008-08-19 12:01:59 ----A---- C:\WINDOWS\vtqnxfko.dll
2008-08-19 12:01:59 ----A---- C:\WINDOWS\twmxbsqrpeg.dll
2008-08-19 12:01:59 ----A---- C:\WINDOWS\tsxngabr.dll
2008-08-19 12:01:59 ----A---- C:\WINDOWS\tqwolser.exe
2008-08-19 12:01:59 ----A---- C:\WINDOWS\rafbsvnx.dll
2008-08-19 12:01:59 ----A---- C:\WINDOWS\etwb.exe
2008-08-19 12:01:47 ----D---- C:\Program Files\PCHealthCenter
2008-08-19 11:07:35 ----A---- C:\WINDOWS\system32\bassmod.dll
2008-08-19 11:07:10 ----A---- C:\WINDOWS\system32\lphcttsj0ep99.exe
2008-08-17 00:50:41 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-08-17 00:50:34 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-08-17 00:50:27 ----HDC---- C:\WINDOWS\$NtUninstallKB953839$
2008-08-17 00:50:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-08-17 00:48:08 ----HDC---- C:\WINDOWS\$NtUninstallKB951072-v2$
2008-08-17 00:47:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-08-17 00:47:51 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-08-17 00:46:29 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$
2008-08-17 00:43:55 ----D---- C:\Program Files\MSXML 4.0
2008-08-13 08:34:04 ----A---- C:\WINDOWS\NeroDigital.ini
2008-08-12 23:44:07 ----D---- C:\Program Files\NeroInstall.bak
2008-08-12 23:40:21 ----D---- C:\Documents and Settings\Chris\Application Data\Nero
2008-08-12 23:38:08 ----A---- C:\WINDOWS\system32\MsiExec.exe.log
2008-08-12 23:32:59 ----D---- C:\Program Files\Nero
2008-08-12 23:32:59 ----D---- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-12 23:32:58 ----D---- C:\Program Files\Common Files\Nero
2008-08-12 23:19:58 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2008-08-12 23:19:53 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2008-08-08 23:53:47 ----D---- C:\etax2008
2008-08-05 19:59:02 ----D---- C:\Program Files\Apple Software Update
2008-08-05 19:57:52 ----D---- C:\Program Files\iPod
2008-08-05 19:57:47 ----D---- C:\Program Files\iTunes
2008-07-11 09:34:26 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-07-04 13:23:39 ----A---- C:\WINDOWS\cdplayer.ini
2008-07-02 22:29:05 ----D---- C:\WINDOWS\system32\Adobe
2008-06-29 21:10:40 ----D---- C:\Program Files\Lavasoft
2008-06-29 21:10:38 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-22 23:28:14 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-06-16 23:56:37 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-06-16 23:56:29 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-06-16 23:56:12 ----HDC---- C:\WINDOWS\$NtUninstallKB950759$
2008-06-16 23:56:02 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2008-06-16 23:55:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$

List of drivers

R1 afs2k;AFS2k; C:\WINDOWS\system32\drivers\afs2k.sys [2004-10-08 35840]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2004-08-03 14848]
R2 AegisP;AEGIS Protocol (IEEE 802.1x) v3.4.5.0; C:\WINDOWS\system32\DRIVERS\AegisP.sys [2007-06-14 21035]
R2 npkcrypt;npkcrypt; \??\C:\Program Files\NEXON\MapleStory\npkcrypt.sys []
R3 ac97intc;Intel(r) 82801 Audio Driver Install Service (WDM); C:\WINDOWS\system32\drivers\ac97intc.sys [2001-08-17 96256]
R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2008-01-29 16168]
R3 HidUsb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2001-08-17 9600]
R3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
R3 Mtlmnt5;Mtlmnt5; C:\WINDOWS\System32\DRIVERS\Mtlmnt5.sys [2004-08-03 126686]
R3 npkcusb;npkcusb; \??\C:\Program Files\NEXON\MapleStory\npkcusb.sys []
R3 nv;nv; C:\WINDOWS\System32\DRIVERS\nv4_mini.sys [2004-08-03 1897408]
R3 Point32;Microsoft IntelliPoint Filter Driver; C:\WINDOWS\system32\DRIVERS\point32.sys [2006-11-08 21760]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-03 20992]
R3 Slntamr;Smart Link 56K Modem Driver; C:\WINDOWS\System32\DRIVERS\slntamr.sys [2004-08-03 404990]
R3 SlWdmSup;SlWdmSup; C:\WINDOWS\System32\DRIVERS\SlWdmSup.sys [2004-08-03 13240]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\System32\DRIVERS\usbccgp.sys [2004-08-03 31616]
R3 usbhub;Microsoft USB Standard Hub Driver; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480]
S3 a1oirsbn;a1oirsbn; C:\WINDOWS\system32\drivers\a1oirsbn.sys []
S3 CCDECODE;Closed Caption Decoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2004-08-03 17024]
S3 DADriv1;DADriv1; \??\C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys []
S3 geebers12;geebers12; \??\C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys []
S3 hpzid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2003-04-12 51024]
S3 hpzipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2003-04-12 16080]
S3 hpzius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2003-04-12 21456]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\WINDOWS\system32\drivers\MSTEE.sys [2004-08-03 5504]
S3 Mtlstrm;Mtlstrm; C:\WINDOWS\System32\DRIVERS\Mtlstrm.sys [2004-08-03 1309184]
S3 NABTSFEC;NABTS/FEC VBI Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2004-08-03 85376]
S3 NdisIP;Microsoft TV/Video Connection; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2004-08-03 10880]
S3 Nokia USB Generic;Nokia USB Generic; C:\WINDOWS\system32\drivers\nmwcdc.sys [2006-10-10 9216]
S3 Nokia USB Modem;Nokia USB Modem; C:\WINDOWS\system32\drivers\nmwcdcm.sys [2006-10-10 12800]
S3 Nokia USB Phone Parent;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\nmwcd.sys [2006-10-10 138240]
S3 Nokia USB Port;Nokia USB Port; C:\WINDOWS\system32\drivers\nmwcdcj.sys [2006-10-10 12800]
S3 NtMtlFax;NtMtlFax; C:\WINDOWS\System32\DRIVERS\NtMtlFax.sys [2004-08-03 180360]
S3 ovt519;EyeToy; C:\WINDOWS\System32\Drivers\ov519vid.sys [2003-10-15 174530]
S3 PCANDIS5;PCANDIS5 Protocol Driver; \??\C:\WINDOWS\system32\PCANDIS5.SYS []
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2004-08-03 11136]
S3 SlNtHal;SlNtHal; C:\WINDOWS\System32\DRIVERS\Slnthal.sys [2004-08-03 95424]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2004-08-03 15360]
S3 sysrest.sys;sysrest.sys; \??\C:\WINDOWS\system32\sysrest.sys []
S3 USBAAPL;Apple Mobile USB Driver; C:\WINDOWS\System32\Drivers\usbaapl.sys [2008-07-10 32000]
S3 usbaudio;USB Audio Driver (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\System32\DRIVERS\USBSTOR.SYS [2004-08-03 26496]
S3 WSTCODEC;World Standard Teletext Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2004-08-03 19328]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]

List of services

R2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-06-02 611664]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-07-22 116040]
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3; C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe [2008-02-18 877864]
R2 PLFlash DeviceIoControl Service;PLFlash DeviceIoControl Service; C:\WINDOWS\system32\IoctlSvc.exe [2006-12-19 81920]
R2 SLService;SmartLinkService; C:\WINDOWS\system32\slserv.exe [2004-08-04 73796]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-08-04 17408]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-07-30 532264]
R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2008-02-28 529704]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 pml driver hpz12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2003-04-12 65795]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 98328]
S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-08-04 17408]
S3 WLSetupSvc;Windows Live Setup Service; C:\Program Files\Windows Live\installer\WLSetupSvc.exe [2007-10-25 266240]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

-----------------EOF-----------------

This is computer bearley goes online and will do thank you for helpping me out!! which one do you reconmend??

**chemist** · 09-06-2008, 05:31 PM

Hello XZanE.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Please note that these fixes are not instantaneous. Most infections require more than one round to properly eradicate.

Please stay with me until given the 'all clear' even if symptoms seemingly abate.

Kindly follow my instructions and please do no fixing on your own or running of scanners unless requested by a helper.

------------------------------------------------------

I will suggest a good, free antivirus program once you are clean.

------------------------------------------------------

Your hard drive is almost full.

Quote:

System drive C: has 2 GB (3%) free of 76 GB

Having too little free space on your hard drive can compromise system performance. I suggest you move pictures, music, etc. to an external drive or USB stick if you have one and uninstall any programs that are never or hardly ever used.

------------------------------------------------------

I see you have P2P software ( Azureus Vuze and Limewire ) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares.

References for the risk of these programs are here, here, and here.

I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

If you decide to uninstall Azureus Vuze and Limewire, also delete these Folders if they still exist:

C:\Program Files\Azureus
C:\Program Files\LimeWire

------------------------------------------------------

Please download Malwarebytes' Anti-Malware and Save it to your Desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to the following:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad and you may be prompted to Restart your computer.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy/Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

------------------------------------------------------

Please download ComboFix and Save it to your Desktop.

**Note: It is important that it is saved directly to your desktop**

First, we need to install the Windows Recovery Console.

The Windows Recovery Console will allow you to boot up into a special recovery(repair) mode, if needed. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Download the file from this Microsoft page:

For XP Home >> http://www.microsoft.com/downloads/d...displaylang=en

For XP Pro >> http://www.microsoft.com/downloads/d...displaylang=en

Save it as it is originally named to your Desktop.

Now close all open windows and programs, including all antivirus and antispyware programs. Get help here

Then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Recovery Console.

As part of installing the Recovery Console, ComboFix will begin to run. Your desktop may disappear. This is normal. It will return.

ComboFix will now automatically install the Windows Recovery Console onto your computer, which will show up as a new option when booting up your computer. Do not select the Windows Recovery Console option when you start your computer unless requested to by a helper.

Once the Recovery Console is installed, this blue window will appear:

Please continue as follows:

Close/disable all antivirus and antispyware programs so they do not interfere with the running of ComboFix. Get help here
Please click Yes to continue scanning for malware.

When the tool is finished, it will produce a log for you.

Please post that log, ComboFix.txt along with a new HijackThis log so we may continue cleansing the system.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

While still in HijackThis,

Click Config...
Click Open Uninstall Manager...
Click Save list...
Click Save

A Notepad file will open. Please post uninstall_list.txt in your next reply.

------------------------------------------------------

Please post the following in your next reply:

MBAM log
C:\ComboFix.txt
new HijackThis log
uninstall_list.txt

If you have any questions along the way...STOP and ask them before proceeding.

XZanE · 09-06-2008, 07:04 PM

MBAM log-
Malwarebytes' Anti-Malware 1.26
Database version: 1120
Windows 5.1.2600 Service Pack 2

9/7/2008 10:28:33 AM
mbam-log-2008-09-07 (10-28-33).txt

Scan type: Quick Scan
Objects scanned: 65303
Time elapsed: 14 minute(s), 36 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 19
Registry Data Items Infected: 5
Folders Infected: 3
Files Infected: 56

Memory Processes Infected:
C:\WINDOWS\system32\lphcttsj0ep99.exe (Trojan.FakeAlert) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\blphcttsj0ep99.scr (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12c.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12d.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12e.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12f.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12b.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12c.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12d.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12e.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12f.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcttsj0ep99 (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run (Trojan.Agent) -> Data: c:\documents and settings\chris\application data\adobe\manager.exe -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\blphcttsj0ep99.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\etwb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\246fc85f.sys (Rootkit.Agent) -> Delete on reboot.
C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\sfsrv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\tem338.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\tem33C.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\tem7E.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\tem80.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\tem84.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully.
C:\WINDOWS\vtqnxfko.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\tsxngabr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\tqwolser.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\rafbsvnx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\twmxbsqrpeg.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\lphcttsj0ep99.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\phcttsj0ep99.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Application Data\Adobe\Manager.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Guest\Local Settings\Temp\us0105.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Chris\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully.
---------------------
ComboFix.txt-

ComboFix 08-09-05.02 - Chris 2008-09-07 10:42:24.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT 10:00]
Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Chris\Application Data\Adobe\crc.dat
C:\Documents and Settings\Chris\Cookies\chris@cts.metricsdirect[1].txt

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_SYSREST.SYS
-------\Service_sysrest.sys

((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))
.

2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit
2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard
2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml
2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData
2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm
2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm
2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero
2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat
2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-19 13:43 . 2008-08-19 13:43 <DIR> d-------- C:\ie-spyad_zo
2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons
2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 08:34 . 2008-09-07 10:40 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero
2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero
2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-08 23:53 . 2008-08-09 00:19 <DIR> d-------- C:\etax2008
2008-08-08 09:40 . 2008-08-08 09:40 268 --ah----- C:\sqmdata18.sqm
2008-08-08 09:40 . 2008-08-08 09:40 244 --ah----- C:\sqmnoopt18.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-07 00:02 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus
2008-09-06 04:07 --------- d-----w C:\Program Files\World of Warcraft
2008-09-06 01:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-04 08:36 --------- d-----w C:\Program Files\Java
2008-09-01 11:41 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss
2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-28 10:54 --------- d-----w C:\Program Files\Mozilla Sunbird
2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live
2008-08-19 05:30 --------- d-----w C:\Program Files\Real
2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real
2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update
2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes
2008-08-05 09:57 --------- d-----w C:\Program Files\iPod
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime
2008-07-09 23:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2001-08-23 22:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
md5deep: C:\WINDOWS\system32\svchost.exe: error at offset 0: Permission denied

2001-08-23 22:00 430080 2b0e480e975ee51f2d5ce5f068fed6e2 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied

md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied
2007-06-13 21:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2001-08-23 22:00 1000960 5a26fc6010886d25b3e412493dd95ed8 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2001-08-23 22:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied

2001-08-23 22:00 11776 8a590ea109b5e0c7629e022f8a6b17c5 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied

2005-06-11 10:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2001-08-23 22:00 51200 9b4155ba58192d4073082b8fc5d42612 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
md5deep: C:\WINDOWS\system32\spoolsv.exe: error at offset 0: Permission denied
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-19 171464]
"CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"YJeWtOXWOa"= {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll [2007-04-17 32768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ]
S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ]
S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Antivirus - C:\Program Files\VAV\vav.exe

.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\g6urykpl.default\
FF -: plugin - C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll
FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 10:47:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
.
**************************************************************************
.
Completion time: 2008-09-07 10:52:34 - machine was rebooted [Chris]
ComboFix-quarantined-files.txt 2008-09-07 00:52:25

Pre-Run: 3,620,417,536 bytes free
Post-Run: 5,187,477,504 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

211 --- E O F --- 2008-09-02 11:46:06

new HijackThis log-

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:22, on 9/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O21 - SSODL: YJeWtOXWOa - {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6844 bytes

uninstall_list.txt

Ad-Aware
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Flash Player Plugin
Adobe Photoshop 7.0
Adobe Reader 8.1.2
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
Azureus Vuze
Compatibility Pack for the 2007 Office system
Curse Client
DivX Codec
DivX Converter
DivX Player
DivX Web Player
e-tax 2008
Google Gears
GPL MPEG-1/2 DirectShow Decoder Filter
Highlight Viewer (Windows Live Toolbar)
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
iTunes
Java(TM) 6 Update 2
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6 Update 1
Malwarebytes' Anti-Malware
Messenger Plus! Live
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office Professional Edition 2003
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft User-Mode Driver Framework Feature Pack 1.5
Mozilla Firefox (3.0.1)
Mozilla Sunbird (0.3.1)
Mozilla Thunderbird (2.0.0.16)
MSXML 4.0 SP2 (KB936181)
Nero 8
neroxml
Nokia Connectivity Cable Driver
Nokia PC Suite
Panda ActiveScan 2.0
QuickTime
Ragnarok Sakray
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB929969)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931768)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933566)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB937894)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB939653)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB942615)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944533)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Smart Menus (Windows Live Toolbar)
SpywareBlaster 4.1
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB942840)
Update for Windows XP (KB951072-v2)
VCRedistSetup
Ventrilo Client
VideoLAN VLC media player 0.8.6f
Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live installer
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
Windows XP Service Pack 2
WinRAR archiver
World of Warcraft
Zune Desktop Theme

**chemist** · 09-06-2008, 07:49 PM

Hello again, XZanE.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

vfind -ltf "%systemdrive%\explorer.exe" "%systemdrive%\lsass.exe" "%systemdrive%\services.exe" "%systemdrive%\spoolsv.exe"  "%systemdrive%\svchost.exe" >log.txt
notepad log.txt
del peek.bat

Save this as peek.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on peek.bat & allow it to run. A Notepad file will open. Post the contents of that file in your next reply.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

File::
C:\WINDOWS\system32\uufiz.dll

Driver::
246fc85f

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"YJeWtOXWOa"=-

SkipFix::

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

log.txt
C:\ComboFix.txt
new HijackThis log

XZanE · 09-06-2008, 08:06 PM

Log.txt
----a-w 1,035,776 2007-06-13 10:23:07 C:\WINDOWS\explorer.exe
----a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c----w 1,000,960 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
-c----w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
------w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

Entries: 5 (5)
Directories: 0 Files: 5
Bytes: 5,134,336 Blocks: 10,028

-c----w 11,776 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
------w 13,312 2004-08-03 14:56:52 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
----a-w 14,848 2004-08-03 14:56:52 C:\WINDOWS\system32\lsass.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 39,936 Blocks: 78

-c----w 101,376 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\services.exe
------w 108,032 2004-08-03 14:56:56 C:\WINDOWS\ServicePackFiles\i386\services.exe
----a-w 110,592 2004-08-03 14:56:56 C:\WINDOWS\system32\services.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 320,000 Blocks: 625

----a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
-c----w 51,200 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
-c----w 57,856 2004-08-03 14:56:58 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
------w 57,856 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
----a-w 58,880 2005-06-10 23:53:32 C:\WINDOWS\system32\spoolsv.exe

Entries: 5 (5)
Directories: 0 Files: 5
Bytes: 283,648 Blocks: 554

-c----w 12,800 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
------w 14,336 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
----a-w 17,408 2004-08-03 14:56:58 C:\WINDOWS\system32\svchost.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 44,544 Blocks: 87

Total Entries: 19 (19)
Total Directories: 0 Files: 19
Total Bytes: 5,822,464 Blocks: 11,372

Combo fix
ComboFix 08-09-05.02 - Chris 2008-09-07 11:56:58.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.308 [GMT 10:00]
Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\CFScript.txt
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\uufiz.dll

.
((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))
.

2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit
2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard
2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml
2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData
2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm
2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm
2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero
2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat
2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-19 13:43 . 2008-08-19 13:43 <DIR> d-------- C:\ie-spyad_zo
2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons
2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 08:34 . 2008-09-07 12:00 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero
2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero
2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-08 23:53 . 2008-08-09 00:19 <DIR> d-------- C:\etax2008
2008-08-08 09:40 . 2008-08-08 09:40 268 --ah----- C:\sqmdata18.sqm
2008-08-08 09:40 . 2008-08-08 09:40 244 --ah----- C:\sqmnoopt18.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-07 00:02 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus
2008-09-06 04:07 --------- d-----w C:\Program Files\World of Warcraft
2008-09-06 01:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-04 08:36 --------- d-----w C:\Program Files\Java
2008-09-01 11:41 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss
2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-28 10:54 --------- d-----w C:\Program Files\Mozilla Sunbird
2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live
2008-08-19 05:30 --------- d-----w C:\Program Files\Real
2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real
2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update
2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes
2008-08-05 09:57 --------- d-----w C:\Program Files\iPod
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime
2008-07-09 23:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2001-08-23 22:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
2004-08-04 00:56 17408 c121b5b09046a8e5dcaa8fba406b323f C:\WINDOWS\system32\svchost.exe

2001-08-23 22:00 430080 2b0e480e975ee51f2d5ce5f068fed6e2 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 00:56 506368 3a97fd93adb366d0632fcecfe10b5e7a C:\WINDOWS\system32\winlogon.exe

2007-06-13 20:23 1035776 0a69bc882c56403ad715b7fe3d0c3966 C:\WINDOWS\explorer.exe
2007-06-13 21:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
2001-08-23 22:00 1000960 5a26fc6010886d25b3e412493dd95ed8 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe

2001-08-23 22:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe
2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe
2004-08-04 00:56 110592 7de5d4fa0f54f9a2f9d3df268c93d051 C:\WINDOWS\system32\services.exe

2001-08-23 22:00 11776 8a590ea109b5e0c7629e022f8a6b17c5 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
2004-08-04 00:56 14848 2f5a9289985f40f291a2182082990110 C:\WINDOWS\system32\lsass.exe

2005-06-11 10:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2001-08-23 22:00 51200 9b4155ba58192d4073082b8fc5d42612 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
2005-06-11 09:53 58880 f51b7f55ec50e00cb1755f09cb14faa7 C:\WINDOWS\system32\spoolsv.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-19 171464]
"CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ]
S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ]
S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 11:58:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Messenger\night_mare_9@hotmail.com\SharingMetadata\Working\database_D610_8CCF_108C_B7CF\$db_dirty$ 0 bytes
C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Messenger\night_mare_9@hotmail.com\SharingMetadata\Working\database_D610_8CCF_108C_B7CF\tmp.edb 131072 bytes

scan completed successfully
hidden files: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Completion time: 2008-09-07 12:03:50 - machine was rebooted
ComboFix-quarantined-files.txt 2008-09-07 02:03:42
ComboFix2.txt 2008-09-07 00:52:37

Pre-Run: 5,216,468,992 bytes free
Post-Run: 5,204,144,128 bytes free

197 --- E O F --- 2008-09-02 11:46:06

Hijack This
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:05:49, on 9/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [java_sun] Java (Sun)
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6933 bytes

**chemist** · 09-06-2008, 08:55 PM

Hello again, XZanE.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

FCopy::
C:\WINDOWS\ServicePackFiles\i386\svchost.exe | C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ServicePackFiles\i386\explorer.exe | C:\WINDOWS\explorer.exe
C:\WINDOWS\ServicePackFiles\i386\services.exe | C:\WINDOWS\system32\services.exe
C:\WINDOWS\ServicePackFiles\i386\lsass.exe | C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe | C:\WINDOWS\system32\spoolsv.exe

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

vfind -ltf "%systemdrive%\explorer.exe" "%systemdrive%\lsass.exe" "%systemdrive%\services.exe" "%systemdrive%\spoolsv.exe"  "%systemdrive%\svchost.exe" >log.txt
notepad log.txt
del peek.bat

Save this as peek.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on peek.bat & allow it to run. A Notepad file will open. Post the contents of that file in your next reply.

------------------------------------------------------

You have old versions of Java still installed. Older versions have vulnerabilities that malware can use to infect your system.
Please follow these steps to remove older version Java components.

Close any programs you may have running - especially your web browser.
Go to Start(or My Computer) > Control Panel and click on Add or Remove Programs
Click (highlight) the following items:
- Java(TM) 6 Update 2
- Java(TM) 6 Update 3
- Java(TM) 6 Update 5
- Java(TM) SE Runtime Environment 6 Update 1
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.
Reboot your computer once all Java components are removed.

------------------------------------------------------

Please download ATF-Cleaner by Atribune and Save it to your Desktop.
This program is for XP and Windows 2000 only

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

------------------------------------------------------

Please run this online scan to help look for remnants. If you use dial-up for the internet, skip this step and let me know.

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

Click Run at any Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.
Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.
Click the Save Report As... button.
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

log.txt
C:\ComboFix.txt
Kaspersky report
new HijackThis log

XZanE · 09-06-2008, 09:21 PM

ComboFix 08-09-05.02 - Chris 2008-09-07 13

35.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.315 [GMT 10:00]
Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

C:\WINDOWS\ServicePackFiles\i386\svchost.exe --> C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ServicePackFiles\i386\explorer.exe --> C:\WINDOWS\explorer.exe
C:\WINDOWS\ServicePackFiles\i386\services.exe --> C:\WINDOWS\system32\services.exe
C:\WINDOWS\ServicePackFiles\i386\lsass.exe --> C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe --> C:\WINDOWS\system32\spoolsv.exe
.
((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 )))))))))))))))))))))))))))))))
.

2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit
2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard
2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml
2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData
2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm
2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm
2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero
2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat
2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-19 13:43 . 2008-08-19 13:43 <DIR> d-------- C:\ie-spyad_zo
2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons
2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 08:34 . 2008-09-07 13:03 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero
2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero
2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-08-08 23:53 . 2008-08-09 00:19 <DIR> d-------- C:\etax2008
2008-08-08 09:40 . 2008-08-08 09:40 268 --ah----- C:\sqmdata18.sqm
2008-08-08 09:40 . 2008-08-08 09:40 244 --ah----- C:\sqmnoopt18.sqm

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-07 03:02 --------- d-----w C:\Program Files\Java
2008-09-07 00:02 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus
2008-09-06 04:07 --------- d-----w C:\Program Files\World of Warcraft
2008-09-06 01:17 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-01 11:41 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss
2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-28 10:54 --------- d-----w C:\Program Files\Mozilla Sunbird
2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live
2008-08-19 05:30 --------- d-----w C:\Program Files\Real
2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real
2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update
2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes
2008-08-05 09:57 --------- d-----w C:\Program Files\iPod
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime
2008-07-09 23:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

------- Sigcheck -------

2001-08-23 22:00 430080 2b0e480e975ee51f2d5ce5f068fed6e2 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
2004-08-04 00:56 506368 3a97fd93adb366d0632fcecfe10b5e7a C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((((((( snapshot@2008-09-07_10.51.52.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2004-08-03 14:56:50 1,032,192 -c--a-w C:\WINDOWS\system32\dllcache\explorer.exe
+ 2004-08-03 14:56:52 13,312 -c--a-w C:\WINDOWS\system32\dllcache\lsass.exe
+ 2004-08-03 14:56:56 108,032 -c--a-w C:\WINDOWS\system32\dllcache\services.exe
+ 2004-08-03 14:56:58 57,856 -c--a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2004-08-03 14:56:58 14,336 -c--a-w C:\WINDOWS\system32\dllcache\svchost.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-19 171464]
"CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ]
S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ]
S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-07 13:08:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-09-07 13:10:35
ComboFix-quarantined-files.txt 2008-09-07 03:10:02
ComboFix2.txt 2008-09-07 02:03:53
ComboFix3.txt 2008-09-07 00:52:37

Pre-Run: 5,327,319,040 bytes free
Post-Run: 5,311,565,824 bytes free

173 --- E O F --- 2008-09-02 11:46:06

----a-w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\explorer.exe
----a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
-c----w 1,000,960 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
-c----w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
------w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
-c--a-w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\system32\dllcache\explorer.exe

Entries: 6 (6)
Directories: 0 Files: 6
Bytes: 6,162,944 Blocks: 12,037

-c----w 11,776 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe
------w 13,312 2004-08-03 14:56:52 C:\WINDOWS\ServicePackFiles\i386\lsass.exe
----a-w 13,312 2004-08-03 14:56:52 C:\WINDOWS\system32\lsass.exe
-c--a-w 13,312 2004-08-03 14:56:52 C:\WINDOWS\system32\dllcache\lsass.exe

Entries: 4 (4)
Directories: 0 Files: 4
Bytes: 51,712 Blocks: 101

-c----w 101,376 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\services.exe
------w 108,032 2004-08-03 14:56:56 C:\WINDOWS\ServicePackFiles\i386\services.exe
----a-w 108,032 2004-08-03 14:56:56 C:\WINDOWS\system32\services.exe
-c--a-w 108,032 2004-08-03 14:56:56 C:\WINDOWS\system32\dllcache\services.exe

Entries: 4 (4)
Directories: 0 Files: 4
Bytes: 425,472 Blocks: 831

----a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
-c----w 51,200 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
-c----w 57,856 2004-08-03 14:56:58 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe
------w 57,856 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
----a-w 57,856 2004-08-03 14:56:58 C:\WINDOWS\system32\spoolsv.exe
-c--a-w 57,856 2004-08-03 14:56:58 C:\WINDOWS\system32\dllcache\spoolsv.exe

Entries: 6 (6)
Directories: 0 Files: 6
Bytes: 340,480 Blocks: 665

-c----w 12,800 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
------w 14,336 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\svchost.exe
----a-w 14,336 2004-08-03 14:56:58 C:\WINDOWS\system32\svchost.exe
-c--a-w 14,336 2004-08-03 14:56:58 C:\WINDOWS\system32\dllcache\svchost.exe

Entries: 4 (4)
Directories: 0 Files: 4
Bytes: 55,808 Blocks: 109

Total Entries: 24 (24)
Total Directories: 0 Files: 24
Total Bytes: 7,036,416 Blocks: 13,743

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:22:12, on 9/7/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6950 bytes

waiting for the scan to complete once it is i will edit my post

Quick Question.. Where can I download a free firewall and Antivirus program?

**chemist** · 09-06-2008, 09:49 PM

I will suggest some free AV/FW programs when we are done.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the quotebox below into Notepad:

Quote:

@echo off
copy "C:\WINDOWS\ServicePackFiles\i386\winlogon.exe" "C:\WINDOWS\system32"
quit

Save this Notepad file as replace.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on replace.bat to run it. A DOS window will open and close again, this is normal. You may delete the file afterwards.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

vfind -ltf "%systemdrive%\winlogon.exe"  >log.txt
notepad log.txt
del peek.bat

Save this as peek.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on peek.bat & allow it to run. A Notepad file will open. Post the contents of that file in your next reply.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

XZanE · 09-07-2008, 11:20 PM

-c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 1,438,720 Blocks: 2,810

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:10:25, on 9/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6804 bytes

question why are there so many svchost running? and is there a need for them all??? the size of memory and cpu that the use vary's aswell... as the username that started them....

also how do i remove daemon tools from start up aswell as cursegaming...??

XZanE · 09-08-2008, 12:37 AM

this is the kaspersky scan log...

KASPERSKY ONLINE SCANNER 7 REPORT
Monday, September 8, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, September 08, 2008 04:31:15
Records in database: 1201452
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area Critical Areas
C:\Documents and Settings\All Users\Start Menu\Programs\Startup
C:\Documents and Settings\Chris\Start Menu\Programs\Accessories\Startup
C:\Program Files
C:\WINDOWS
Scan statistics
Files scanned 37411
Threat name 1
Infected objects 2
Suspicious objects 0
Duration of the scan 01:27:13

File name Threat name Threats count
C:\WINDOWS\system32\winlogon.exe/C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1
C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1
The selected area was scanned.

**chemist** · 09-08-2008, 09:02 AM

Quote:

question why are there so many svchost running? and is there a need for them all??? the size of memory and cpu that the use vary's aswell... as the username that started them....

http://www.howtogeek.com/howto/windo...is-it-running/

Quote:

also how do i remove daemon tools from start up aswell as cursegaming...??

http://www.daemon-tools.cc/dtcc/f19/...-remove-21813/

Can't help you with the gaming issue. You will have to ask for help on their website.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the quotebox below into Notepad:

Quote:

@echo off
attrib -s -r -h "C:\WINDOWS\system32\winlogon.exe"
del /q "C:\WINDOWS\system32\winlogon.exe"
copy "C:\WINDOWS\ServicePackFiles\i386\winlogon.exe" "C:\Windows\System32"
quit

Save this Notepad file as replace.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on replace.bat to run it. A DOS window will open and close again, this is normal. You may delete the file afterwards.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

vfind -ltf "%systemdrive%\winlogon.exe"  >log.txt
notepad log.txt
del peek.bat

Save this as peek.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on peek.bat & allow it to run. A Notepad file will open. Post the contents of that file in your next reply.

------------------------------------------------------

When you performed the Kaspersky scan, you only scanned Critical Areas instead of My Computer. Please repeat the scan making sure to scan My Computer. Post the Kaspersky report in your next reply.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

log.txt
Kaspersky report
new HijackThis log

XZanE · 09-08-2008, 10:13 PM

log.txt
-c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 1,438,720 Blocks: 2,810

Kaspersky log
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, September 9, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, September 08, 2008 21:53:37
Records in database: 1202183
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
E:\
Scan statistics
Files scanned 61955
Threat name 11
Infected objects 32
Suspicious objects 0
Duration of the scan 04:12:28

File name Threat name Threats count
C:\WINDOWS\system32\winlogon.exe/C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Magic ISO 5.5 + Full Crack\setup.exe Infected: Trojan.Win32.Agent.zfy 1
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Windows XP Pro Corp SP3 Bootable Incl Key\Crack\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 2
C:\Documents and Settings\Chris\Shared\gabriella cilimi sweet about m.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Chris\Shared\gi joe movie.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\gijoe season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\gijoe season 3.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\Iron man dvd movie 2008.wma Infected: Trojan-Downloader.WMA.GetCodec.b 1
C:\Documents and Settings\Chris\Shared\iron man movie 2008.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Chris\Shared\iron man movie 2008.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\robotech season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\robotech season 2.zip Infected: not-a-virus:AdWare.Win32.Sahat.cd 1
C:\Documents and Settings\Chris\Shared\star wars clone wars season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\star wars clone wars season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\thundercats season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\thundercats season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\thundercats season 3.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Chris\Shared\thundercats season 3.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\tranzor z season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1
C:\Documents and Settings\Chris\Shared\voltron season 1.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968 Infected: Trojan-Downloader.Java.OpenConnection.ao 2
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968 Infected: Trojan.Java.ClassLoader.au 1
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\56\564e2978-70d5b559 Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\QooBox\Quarantine\C\WINDOWS\explorer.exe.vir Infected: Trojan.Win32.Patched.cx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\lsass.exe.vir Infected: Trojan.Win32.Patched.cx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\services.exe.vir Infected: Trojan.Win32.Patched.cx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\spoolsv.exe.vir Infected: Trojan.Win32.Patched.cx 1
C:\QooBox\Quarantine\C\WINDOWS\system32\svchost.exe.vir Infected: Trojan.Win32.Patched.cx 1
C:\QooBox\Quarantine\catchme2008-09-07_115713.35.zip Infected: Trojan-Downloader.Win32.Agent.vsh 1
C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1
The selected area was scanned.

Thats a lot of diffrence :S...

and Hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:11:20, on 9/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 7075 bytes

**chemist** · 09-09-2008, 05:49 AM

Hello again, XZanE.

Please copy this page to Notepad and Save it to your Desktop in order to assist you when carrying out the following instructions.

Before beginning the fix, read this post completely. If there's anything that you do not understand, kindly ask your questions before proceeding.
Ensure that there aren't any opened browsers when you are carrying out the procedures below.

It is IMPORTANT that you don't miss a step & perform everything in the correct order/sequence.

------------------------------------------------------

Are you running a legal copy of Windows?

------------------------------------------------------

Quote:

C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Magic ISO 5.5 + Full Crack\setup.exe
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Windows XP Pro Corp SP3 Bootable Incl Key\Crack\keyfinder.exe

This is the main reason your computer is infected. Visiting cracksites/warezsites - and other questionable/illegal sites is always a risk.

Even a single click on the site can drop multiple forms of very serious malware, many of which disable your onboard protection, and System Restore.

If you install the cracked software, you are running executable files from these dubious, unknown sources. You are in effect giving these sources access to information on your hard disk, and potential control over the operation of your computer.

Additionally, cracked programs are illegal. Before posting for help, uninstall any such applications.

Referring to the Forum Rules which you should have read at the time of Registering at this forum, TSF does not support illegal activity. As such, be advised that any request for assistance in removing malware may go unanswered, or may be discontinued, if the cracked (illegal) software is still present on the machine.

In 2006, a study revealed that 59% of keygens and crack tools downloaded from peer-to-peer networks contained malicious or "unwanted" software.

-------------------------------------------------

Close any open browsers.

Disable your antivirus and antispyware applications, usually via a right-click on the System Tray icon. They may otherwise interfere with ComboFix.

Open Notepad and copy/paste all the text in the quotebox below into Notepad:

Quote:

FCopy::
C:\WINDOWS\ServicePackFiles\i386\winlogon.exe | C:\WINDOWS\system32\winlogon.exe

File::
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Magic ISO 5.5 + Full Crack\setup.exe
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Windows XP Pro Corp SP3 Bootable Incl Key\Crack\keyfinder.exe
C:\Documents and Settings\Chris\Shared\gabriella cilimi sweet about m.mp3
C:\Documents and Settings\Chris\Shared\gi joe movie.zip
C:\Documents and Settings\Chris\Shared\gijoe season 2.zip
C:\Documents and Settings\Chris\Shared\gijoe season 3.zip
C:\Documents and Settings\Chris\Shared\Iron man dvd movie 2008.wma
C:\Documents and Settings\Chris\Shared\iron man movie 2008.mp3
C:\Documents and Settings\Chris\Shared\iron man movie 2008.zip
C:\Documents and Settings\Chris\Shared\robotech season 1.zip
C:\Documents and Settings\Chris\Shared\robotech season 2.zip
C:\Documents and Settings\Chris\Shared\star wars clone wars season 1.zip
C:\Documents and Settings\Chris\Shared\star wars clone wars season 2.zip
C:\Documents and Settings\Chris\Shared\thundercats season 1.zip
C:\Documents and Settings\Chris\Shared\thundercats season 2.zip
C:\Documents and Settings\Chris\Shared\thundercats season 3.mp3
C:\Documents and Settings\Chris\Shared\thundercats season 3.zip
C:\Documents and Settings\Chris\Shared\tranzor z season 1.zip
C:\Documents and Settings\Chris\Shared\voltron season 1.mp3
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\56\564e2978-70d5b559

Save this Notepad file as CFScript.txt to your Desktop and then close the file.

Referring to the picture above, drag CFScript onto ComboFix

If you are prompted to update ComboFix, please click Yes

Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.

When finished, it shall produce a log for you. Please post that log, ComboFix.txt in your next reply.

Note:
Do not mouseclick ComboFix's window whilst it's running. That may cause it to stall.

------------------------------------------------------

Open Notepad and copy/paste the entire contents of the codebox below into Notepad:

Code:

vfind -ltf "%systemdrive%\winlogon.exe"  >log.txt
notepad log.txt
del peek.bat

Save this as peek.bat and choose to Save as type: - All Files then close the Notepad file.
It should look like this:

Double-click on peek.bat & allow it to run. A Notepad file will open. Post the contents of that file in your next reply.

------------------------------------------------------

Open HijackThis and click on 'Do a System Scan and Save a Logfile'. Save the logfile and post it here.

------------------------------------------------------

Please post the following in your next reply:

log.txt
C:\ComboFix.txt
new HijackThis log

XZanE · 09-11-2008, 08:05 AM

ComboFix 08-09-10.04 - Chris 2008-09-11 23:56:47.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.439 [GMT 10:00]
Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe
Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Magic ISO 5.5 + Full Crack\setup.exe
C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Windows XP Pro Corp SP3 Bootable Incl Key\Crack\keyfinder.exe
C:\Documents and Settings\Chris\Shared\gabriella cilimi sweet about m.mp3
C:\Documents and Settings\Chris\Shared\gi joe movie.zip
C:\Documents and Settings\Chris\Shared\gijoe season 2.zip
C:\Documents and Settings\Chris\Shared\gijoe season 3.zip
C:\Documents and Settings\Chris\Shared\Iron man dvd movie 2008.wma
C:\Documents and Settings\Chris\Shared\iron man movie 2008.mp3
C:\Documents and Settings\Chris\Shared\iron man movie 2008.zip
C:\Documents and Settings\Chris\Shared\robotech season 1.zip
C:\Documents and Settings\Chris\Shared\robotech season 2.zip
C:\Documents and Settings\Chris\Shared\star wars clone wars season 1.zip
C:\Documents and Settings\Chris\Shared\star wars clone wars season 2.zip
C:\Documents and Settings\Chris\Shared\thundercats season 1.zip
C:\Documents and Settings\Chris\Shared\thundercats season 2.zip
C:\Documents and Settings\Chris\Shared\thundercats season 3.mp3
C:\Documents and Settings\Chris\Shared\thundercats season 3.zip
C:\Documents and Settings\Chris\Shared\tranzor z season 1.zip
C:\Documents and Settings\Chris\Shared\voltron season 1.mp3
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968
C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\56\564e2978-70d5b559

.
--------------- FCopy ---------------

C:\WINDOWS\ServicePackFiles\i386\winlogon.exe --> C:\WINDOWS\system32\winlogon.exe
.
((((((((((((((((((((((((( Files Created from 2008-08-11 to 2008-09-11 )))))))))))))))))))))))))))))))
.

2008-09-07 13:17 . 2008-09-07 13:17 <DIR> d---s---- C:\Documents and Settings\Chris\UserData
2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit
2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard
2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll
2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll
2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe
2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe
2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll
2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys
2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml
2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard
2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData
2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm
2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm
2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero
2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat
2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security
2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons
2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-13 08:34 . 2008-09-11 23:51 69 --a------ C:\WINDOWS\NeroDigital.ini
2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak
2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero
2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero
2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero
2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-11 10:23 --------- d-----w C:\Program Files\Mozilla Thunderbird
2008-09-11 10:12 --------- d-----w C:\Program Files\Mozilla Sunbird
2008-09-11 04:45 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss
2008-09-10 21:59 --------- d-----w C:\Program Files\World of Warcraft
2008-09-08 07:10 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus
2008-09-07 03:02 --------- d-----w C:\Program Files\Java
2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live
2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live
2008-08-19 05:30 --------- d-----w C:\Program Files\Real
2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real
2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update
2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes
2008-08-05 09:57 --------- d-----w C:\Program Files\iPod
2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll
2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll
2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 08:12 295,936 ----a-w C:\WINDOWS\system32\wmpeffects.dll
2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
.

((((((((((((((((((((((((((((( snapshot@2008-09-07_10.51.52.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-06-13 10:23:07 1,035,776 ----a-w C:\WINDOWS\explorer.exe
+ 2004-08-03 14:56:50 1,032,192 ----a-w C:\WINDOWS\explorer.exe
+ 2007-09-14 11:45:58 16,901,168 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6215\MSO.DLL
+ 2007-08-28 14:19:24 1,654,648 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\00002109020090400000000000F01FEC\12.0.6215\OGL.DLL
- 2008-08-16 14:48:23 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
+ 2008-09-10 14:11:58 38,240 ----a-r C:\WINDOWS\Installer\{90120000-0020-0409-0000-0000000FF1CE}\O12ConvIcon.exe
- 2008-08-16 14:50:13 593,920 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-09-10 14:11:42 593,920 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-08-16 14:50:13 12,288 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-09-10 14:11:42 12,288 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-08-16 14:50:13 135,168 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-09-10 14:11:42 135,168 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-08-16 14:50:13 11,264 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-09-10 14:11:42 11,264 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-08-16 14:50:13 27,136 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-09-10 14:11:42 27,136 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-08-16 14:50:13 4,096 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-09-10 14:11:42 4,096 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-08-16 14:50:13 794,624 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-09-10 14:11:42 794,624 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-08-16 14:50:13 249,856 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-09-10 14:11:42 249,856 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-08-16 14:50:13 61,440 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-09-10 14:11:42 61,440 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-08-16 14:50:13 23,040 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-09-10 14:11:42 23,040 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-08-16 14:50:13 286,720 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-09-10 14:11:42 286,720 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-08-16 14:50:13 409,600 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-09-10 14:11:42 409,600 ----a-r C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2004-08-03 14:56:50 1,032,192 -c--a-w C:\WINDOWS\system32\dllcache\explorer.exe
+ 2004-08-03 14:56:52 13,312 -c--a-w C:\WINDOWS\system32\dllcache\lsass.exe
+ 2004-08-03 14:56:56 108,032 -c--a-w C:\WINDOWS\system32\dllcache\services.exe
+ 2004-08-03 14:56:58 57,856 -c--a-w C:\WINDOWS\system32\dllcache\spoolsv.exe
+ 2004-08-03 14:56:58 14,336 -c--a-w C:\WINDOWS\system32\dllcache\svchost.exe
+ 2004-08-03 14:56:58 502,272 -c--a-w C:\WINDOWS\system32\dllcache\winlogon.exe
- 2004-08-03 14:56:52 14,848 ----a-w C:\WINDOWS\system32\lsass.exe
+ 2004-08-03 14:56:52 13,312 ----a-w C:\WINDOWS\system32\lsass.exe
- 2008-08-05 18:11:01 15,888,504 ----a-w C:\WINDOWS\system32\MRT.exe
+ 2008-08-26 20:28:12 16,208,504 ----a-w C:\WINDOWS\system32\MRT.exe
- 2004-08-03 14:56:56 110,592 ----a-w C:\WINDOWS\system32\services.exe
+ 2004-08-03 14:56:56 108,032 ----a-w C:\WINDOWS\system32\services.exe
- 2005-06-10 23:53:32 58,880 ----a-w C:\WINDOWS\system32\spoolsv.exe
+ 2004-08-03 14:56:58 57,856 ----a-w C:\WINDOWS\system32\spoolsv.exe
- 2004-08-03 14:56:58 17,408 ----a-w C:\WINDOWS\system32\svchost.exe
+ 2004-08-03 14:56:58 14,336 ----a-w C:\WINDOWS\system32\svchost.exe
+ 2008-04-15 17:54:19 1,724,416 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.3352_x-ww_81af8e88\GdiPlus.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136]
"Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064]
"NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664]
"NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
--a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"=
"C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544]
S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ]
S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ]
S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ]
.
Contents of the 'Scheduled Tasks' folder
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-11 23:59:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

C:\DOCUME~1\Chris\LOCALS~1\Temp\RGI14A.tmp 7075 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-09-12 0:00:49
ComboFix-quarantined-files.txt 2008-09-11 14:00:42
ComboFix2.txt 2008-09-07 03:10:36
ComboFix3.txt 2008-09-07 02:03:53
ComboFix4.txt 2008-09-07 00:52:37

Pre-Run: 4,909,121,536 bytes free
Post-Run: 4,943,298,560 bytes free

227 --- E O F --- 2008-09-10 14:13:21

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:02:03, on 9/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\WINDOWS\system32\IoctlSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Curse\CurseClient.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Nero\Shared\NL3\NeroPatentActivation.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing)
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: Windows Live Messenger.lnk = ?
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe
O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe

--
End of file - 6810 bytes

i deleted all them programs. and the cracks. and yes my windows is legit.

**chemist** · 09-11-2008, 08:25 AM

I need to see log.txt please.

XZanE · 09-11-2008, 08:35 AM

-c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe

Entries: 3 (3)
Directories: 0 Files: 3
Bytes: 1,438,720 Blocks: 2,810

is that the right one?

08-27-2008, 11:50 PM	#2 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. some one want to check this for me please

09-06-2008, 08:35 AM	#3 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. someone please help me!

09-06-2008, 09:55 AM	#4 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,610 OS: XP SP3	Re: Computer Has Pop Ups. Hello and Welcome to TSF. Please Subscribe to this Thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant notification by email, then click Add Subscription. Download RSIT by random/random and Save it to your Desktop. Double-click RSIT.exe to run the tool. Click Continue at the disclaimer screen. When the scan completes it will open a log named log.txt maximized, and a log named info.txt minimized. Please copy/paste the contents of log.txt in your next reply. Please attach info.txt to your reply. To attach a file to a reply, simply Click the Manage Attachments button under Additional Options > Attach Files on the post composition page, and Copy and Paste the following into the Upload File from your Computer box: C:\rsit\info.txt Click Upload ------------------------------------------------------ Please explain why this computer has no antivirus program installed and running. This is an open invitation for infection. It can take as little as eight seconds to infect an unprotected computer. Please keep this computer offline except when downloading tools and posting in the forum until we get one installed. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

09-06-2008, 07:04 PM	#7 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. MBAM log- Malwarebytes' Anti-Malware 1.26 Database version: 1120 Windows 5.1.2600 Service Pack 2 9/7/2008 10:28:33 AM mbam-log-2008-09-07 (10-28-33).txt Scan type: Quick Scan Objects scanned: 65303 Time elapsed: 14 minute(s), 36 second(s) Memory Processes Infected: 1 Memory Modules Infected: 1 Registry Keys Infected: 6 Registry Values Infected: 19 Registry Data Items Infected: 5 Folders Infected: 3 Files Infected: 56 Memory Processes Infected: C:\WINDOWS\system32\lphcttsj0ep99.exe (Trojan.FakeAlert) -> Unloaded process successfully. Memory Modules Infected: C:\WINDOWS\system32\blphcttsj0ep99.scr (Trojan.FakeAlert) -> Delete on reboot. Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\VAV (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Mirar (Adware.Mirar) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Software Notifier (Rogue.Multiple) -> Quarantined and deleted successfully. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\run (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12b.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12c.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12d.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12e.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12f.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12b.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12c.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12d.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12e.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\sue12f.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysrest32.exe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lphcttsj0ep99 (Trojan.FakeAlert) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\originalwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\convertedwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\Control Panel\Desktop\scrnsave.exe (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\backupwallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\General\wallpaper (Hijack.Wallpaper) -> Quarantined and deleted successfully. Registry Data Items Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Run (Trojan.Agent) -> Data: c:\documents and settings\chris\application data\adobe\manager.exe -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\Homepage (Hijack.Homepage) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page (Hijack.Homepage) -> Bad: (http://softwarereferral.com/jump.php...MjI6Ojg5&lid=2) Good: (http://www.google.com/) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispBackgroundPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\NoDispScrSavPage (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully. Folders Infected: C:\WINDOWS\privacy_danger (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully. Files Infected: C:\WINDOWS\system32\blphcttsj0ep99.scr (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\etwb.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\drivers\246fc85f.sys (Rootkit.Agent) -> Delete on reboot. C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\sfsrv.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\rsyncini.exe (Trojan.Shutdowner) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\tem338.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\tem33C.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\tem7E.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\tem80.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\tem84.tmp.exe (Adware.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\index.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\capt.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\danger.jpg (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\down.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\privacy_danger\images\spacer.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\1.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\2.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\3.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\4.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\Program Files\PCHealthCenter\sex2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sex1.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\sex2.ico (Malware.Trace) -> Quarantined and deleted successfully. C:\WINDOWS\system32\vav.cpl (Rogue.VistaAntivirus2008) -> Quarantined and deleted successfully. C:\WINDOWS\vtqnxfko.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\tsxngabr.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\tqwolser.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\rafbsvnx.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\twmxbsqrpeg.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\lphcttsj0ep99.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\WINDOWS\system32\phcttsj0ep99.bmp (Trojan.FakeAlert) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Application Data\Adobe\Manager.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Guest\Local Settings\Temp\us0105.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt15.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt2.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt3.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt4.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt5.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt7.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt8.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.tt9.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttA.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttB.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttC.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttD.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttE.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Local Settings\Temp\.ttF.tmp (Trojan.Downloader) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Favorites\Error Cleaner.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Favorites\Privacy Protector.url (Rogue.Link) -> Quarantined and deleted successfully. C:\Documents and Settings\Chris\Favorites\Spyware&Malware Protection.url (Rogue.Link) -> Quarantined and deleted successfully. --------------------- ComboFix.txt- ComboFix 08-09-05.02 - Chris 2008-09-07 10:42:24.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT 10:00] Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Chris\Application Data\Adobe\crc.dat C:\Documents and Settings\Chris\Cookies\chris@cts.metricsdirect[1].txt . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SYSREST.SYS -------\Service_sysrest.sys ((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))) . 2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes 2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit 2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard 2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll 2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll 2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll 2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe 2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe 2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll 2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys 2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml 2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData 2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm 2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm 2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero 2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat 2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-19 13:43 . 2008-08-19 13:43 <DIR> d-------- C:\ie-spyad_zo 2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security 2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons 2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-13 08:34 . 2008-09-07 10:40 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak 2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero 2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero 2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-08-08 23:53 . 2008-08-09 00:19 <DIR> d-------- C:\etax2008 2008-08-08 09:40 . 2008-08-08 09:40 268 --ah----- C:\sqmdata18.sqm 2008-08-08 09:40 . 2008-08-08 09:40 244 --ah----- C:\sqmnoopt18.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-07 00:02 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus 2008-09-06 04:07 --------- d-----w C:\Program Files\World of Warcraft 2008-09-06 01:17 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-04 08:36 --------- d-----w C:\Program Files\Java 2008-09-01 11:41 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss 2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-08-28 10:54 --------- d-----w C:\Program Files\Mozilla Sunbird 2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live 2008-08-19 05:30 --------- d-----w C:\Program Files\Real 2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real 2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update 2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes 2008-08-05 09:57 --------- d-----w C:\Program Files\iPod 2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime 2008-07-09 23:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2001-08-23 22:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe 2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe md5deep: C:\WINDOWS\system32\svchost.exe: error at offset 0: Permission denied 2001-08-23 22:00 430080 2b0e480e975ee51f2d5ce5f068fed6e2 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe 2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe md5deep: C:\WINDOWS\system32\winlogon.exe: error at offset 0: Permission denied md5deep: C:\WINDOWS\explorer.exe: error at offset 0: Permission denied 2007-06-13 21:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2001-08-23 22:00 1000960 5a26fc6010886d25b3e412493dd95ed8 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2001-08-23 22:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe 2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe md5deep: C:\WINDOWS\system32\services.exe: error at offset 0: Permission denied 2001-08-23 22:00 11776 8a590ea109b5e0c7629e022f8a6b17c5 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe 2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe md5deep: C:\WINDOWS\system32\lsass.exe: error at offset 0: Permission denied 2005-06-11 10:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2001-08-23 22:00 51200 9b4155ba58192d4073082b8fc5d42612 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe md5deep: C:\WINDOWS\system32\spoolsv.exe: error at offset 0: Permission denied . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-19 171464] "CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136] "Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] "YJeWtOXWOa"= {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll [2007-04-17 32768] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"= "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ] S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ] S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ] . Contents of the 'Scheduled Tasks' folder . - - - - ORPHANS REMOVED - - - - HKLM-Run-Antivirus - C:\Program Files\VAV\vav.exe . ------- Supplementary Scan ------- . FireFox -: Profile - C:\Documents and Settings\Chris\Application Data\Mozilla\Firefox\Profiles\g6urykpl.default\ FF -: plugin - C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\1.2.131.11\npGoogleOneClick5.dll FF -: plugin - C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 10:47:52 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\WgaTray.exe . ********************************************************************** . Completion time: 2008-09-07 10:52:34 - machine was rebooted [Chris] ComboFix-quarantined-files.txt 2008-09-07 00:52:25 Pre-Run: 3,620,417,536 bytes free Post-Run: 5,187,477,504 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 211 --- E O F --- 2008-09-02 11:46:06 new HijackThis log- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:55:22, on 9/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\WgaTray.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Windows Live Messenger.lnk = ? O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [java_sun] Java (Sun) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O21 - SSODL: YJeWtOXWOa - {108CB7D0-BA26-1D7A-B0BE-68A051DC5EBA} - C:\WINDOWS\system32\uufiz.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe -- End of file - 6844 bytes uninstall_list.txt** Ad-Aware Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742) Adobe Flash Player 9 ActiveX Adobe Flash Player ActiveX Adobe Flash Player Plugin Adobe Photoshop 7.0 Adobe Reader 8.1.2 Adobe Shockwave Player Apple Mobile Device Support Apple Software Update Azureus Vuze Compatibility Pack for the 2007 Office system Curse Client DivX Codec DivX Converter DivX Player DivX Web Player e-tax 2008 Google Gears GPL MPEG-1/2 DirectShow Decoder Filter Highlight Viewer (Windows Live Toolbar) HijackThis 2.0.2 Hotfix for Windows Media Format 11 SDK (KB929399) Hotfix for Windows Media Player 11 (KB939683) Hotfix for Windows XP (KB926239) Hotfix for Windows XP (KB952287) iTunes Java(TM) 6 Update 2 Java(TM) 6 Update 3 Java(TM) 6 Update 5 Java(TM) 6 Update 7 Java(TM) SE Runtime Environment 6 Update 1 Malwarebytes' Anti-Malware Messenger Plus! Live Microsoft .NET Framework 2.0 Service Pack 1 Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Office Professional Edition 2003 Microsoft SQL Server 2005 Compact Edition [ENU] Microsoft User-Mode Driver Framework Feature Pack 1.5 Mozilla Firefox (3.0.1) Mozilla Sunbird (0.3.1) Mozilla Thunderbird (2.0.0.16) MSXML 4.0 SP2 (KB936181) Nero 8 neroxml Nokia Connectivity Cable Driver Nokia PC Suite Panda ActiveScan 2.0 QuickTime Ragnarok Sakray Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 11 (KB936782) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917344) Security Update for Windows XP (KB917422) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923694) Security Update for Windows XP (KB923789) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924191) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924496) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB929969) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931768) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB933566) Security Update for Windows XP (KB933729) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB937143) Security Update for Windows XP (KB937894) Security Update for Windows XP (KB938127) Security Update for Windows XP (KB938829) Security Update for Windows XP (KB939653) Security Update for Windows XP (KB941202) Security Update for Windows XP (KB941568) Security Update for Windows XP (KB941569) Security Update for Windows XP (KB941644) Security Update for Windows XP (KB941693) Security Update for Windows XP (KB942615) Security Update for Windows XP (KB943055) Security Update for Windows XP (KB943460) Security Update for Windows XP (KB943485) Security Update for Windows XP (KB944338) Security Update for Windows XP (KB944533) Security Update for Windows XP (KB944653) Security Update for Windows XP (KB945553) Security Update for Windows XP (KB946026) Security Update for Windows XP (KB946648) Security Update for Windows XP (KB947864) Security Update for Windows XP (KB948590) Security Update for Windows XP (KB948881) Security Update for Windows XP (KB950749) Security Update for Windows XP (KB950759) Security Update for Windows XP (KB950760) Security Update for Windows XP (KB950762) Security Update for Windows XP (KB950974) Security Update for Windows XP (KB951066) Security Update for Windows XP (KB951376) Security Update for Windows XP (KB951376-v2) Security Update for Windows XP (KB951698) Security Update for Windows XP (KB951748) Security Update for Windows XP (KB952954) Security Update for Windows XP (KB953838) Security Update for Windows XP (KB953839) Smart Menus (Windows Live Toolbar) SpywareBlaster 4.1 Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB933360) Update for Windows XP (KB936357) Update for Windows XP (KB938828) Update for Windows XP (KB942763) Update for Windows XP (KB942840) Update for Windows XP (KB951072-v2) VCRedistSetup Ventrilo Client VideoLAN VLC media player 0.8.6f Windows Driver Package - Nokia Modem (11/03/2006 6.82.0.1) Windows Imaging Component Windows Installer 3.1 (KB893803) Windows Live installer Windows Live Mail Windows Live Messenger Windows Live Photo Gallery Windows Live Sign-in Assistant Windows Live Toolbar Windows Live Toolbar Extension (Windows Live Toolbar) Windows Media Format 11 runtime Windows Media Format 11 runtime Windows Media Player 11 Windows Media Player 11 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781 Windows XP Service Pack 2 WinRAR archiver World of Warcraft Zune Desktop Theme

09-06-2008, 08:06 PM	#9 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. Log.txt ----a-w 1,035,776 2007-06-13 10:23:07 C:\WINDOWS\explorer.exe ----a-w 1,033,216 2007-06-13 11:26:03 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe -c----w 1,000,960 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe -c----w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe ------w 1,032,192 2004-08-03 14:56:50 C:\WINDOWS\ServicePackFiles\i386\explorer.exe Entries: 5 (5) Directories: 0 Files: 5 Bytes: 5,134,336 Blocks: 10,028 -c----w 11,776 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe ------w 13,312 2004-08-03 14:56:52 C:\WINDOWS\ServicePackFiles\i386\lsass.exe ----a-w 14,848 2004-08-03 14:56:52 C:\WINDOWS\system32\lsass.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 39,936 Blocks: 78 -c----w 101,376 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\services.exe ------w 108,032 2004-08-03 14:56:56 C:\WINDOWS\ServicePackFiles\i386\services.exe ----a-w 110,592 2004-08-03 14:56:56 C:\WINDOWS\system32\services.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 320,000 Blocks: 625 ----a-w 57,856 2005-06-11 00:17:13 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe -c----w 51,200 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe -c----w 57,856 2004-08-03 14:56:58 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe ------w 57,856 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe ----a-w 58,880 2005-06-10 23:53:32 C:\WINDOWS\system32\spoolsv.exe Entries: 5 (5) Directories: 0 Files: 5 Bytes: 283,648 Blocks: 554 -c----w 12,800 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe ------w 14,336 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\svchost.exe ----a-w 17,408 2004-08-03 14:56:58 C:\WINDOWS\system32\svchost.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 44,544 Blocks: 87 Total Entries: 19 (19) Total Directories: 0 Files: 19 Total Bytes: 5,822,464 Blocks: 11,372 Combo fix ComboFix 08-09-05.02 - Chris 2008-09-07 11:56:58.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.308 [GMT 10:00] Running from: C:\Documents and Settings\Chris\My Documents\Downloads\ComboFix.exe Command switches used :: C:\Documents and Settings\Chris\My Documents\Downloads\CFScript.txt * Created a new restore point . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\uufiz.dll . ((((((((((((((((((((((((( Files Created from 2008-08-07 to 2008-09-07 ))))))))))))))))))))))))))))))) . 2008-09-07 09:52 . 2008-09-07 09:52 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Malwarebytes 2008-09-07 09:51 . 2008-09-07 09:52 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-09-07 09:51 . 2008-09-07 09:51 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-09-07 09:51 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-09-07 09:51 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-09-07 09:11 . 2008-09-07 09:11 <DIR> d-------- C:\rsit 2008-09-01 12:38 . 2008-09-01 12:38 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Hewlett-Packard 2008-09-01 12:37 . 2003-04-12 05:18 233,528 -ra------ C:\WINDOWS\system32\HPZidr12.dll 2008-09-01 12:37 . 2003-04-12 05:18 167,936 -ra------ C:\WINDOWS\system32\HPZipr12.dll 2008-09-01 12:37 . 2003-04-12 05:18 94,208 -ra------ C:\WINDOWS\system32\HPZipt12.dll 2008-09-01 12:37 . 2003-04-12 05:18 65,795 -ra------ C:\WINDOWS\system32\HPZipm12.exe 2008-09-01 12:37 . 2003-04-12 05:18 61,699 -ra------ C:\WINDOWS\system32\HPZinw12.exe 2008-09-01 12:37 . 2003-04-12 05:18 57,344 -ra------ C:\WINDOWS\system32\HPZisn12.dll 2008-09-01 12:37 . 2003-04-12 05:18 51,024 -ra------ C:\WINDOWS\system32\drivers\hpzid412.sys 2008-09-01 12:37 . 2003-04-12 05:18 16,080 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys 2008-09-01 12:37 . 2008-09-01 12:40 494 --a------ C:\hpfr5550.xml 2008-09-01 12:30 . 2008-09-01 12:30 <DIR> d-------- C:\Program Files\Common Files\Hewlett-Packard 2008-09-01 12:29 . 2008-09-07 10:11 <DIR> d-------- C:\Program Files\Hewlett-Packard 2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys 2008-09-01 12:18 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys 2008-08-31 18:02 . 2008-08-31 18:02 <DIR> d---s---- C:\Documents and Settings\Guest\UserData 2008-08-23 09:06 . 2008-08-23 09:06 268 --ah----- C:\sqmdata19.sqm 2008-08-23 09:06 . 2008-08-23 09:06 244 --ah----- C:\sqmnoopt19.sqm 2008-08-23 09:02 . 2008-08-23 09:02 <DIR> d-------- C:\Documents and Settings\Guest\Application Data\Nero 2008-08-21 17:12 . 2008-09-06 17:08 24 --a------ C:\Documents and Settings\Chris\jagex_runescape_preferences.dat 2008-08-19 13:48 . 2008-08-19 15:14 <DIR> d-------- C:\Program Files\SpywareBlaster 2008-08-19 13:46 . 2008-08-19 13:46 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-19 13:43 . 2008-08-19 13:43 <DIR> d-------- C:\ie-spyad_zo 2008-08-19 13:41 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-08-19 13:39 . 2008-08-19 13:39 <DIR> d-------- C:\Program Files\Panda Security 2008-08-19 12:02 . 2008-08-19 22:28 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\TmpRecentIcons 2008-08-17 00:43 . 2008-08-17 00:43 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-08-16 23:54 . 2008-05-02 00:30 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll 2008-08-13 08:34 . 2008-09-07 12:00 69 --a------ C:\WINDOWS\NeroDigital.ini 2008-08-12 23:44 . 2008-08-12 23:44 <DIR> d-------- C:\Program Files\NeroInstall.bak 2008-08-12 23:40 . 2008-08-12 23:40 <DIR> d-------- C:\Documents and Settings\Chris\Application Data\Nero 2008-08-12 23:32 . 2008-08-12 23:32 <DIR> d-------- C:\Program Files\Nero 2008-08-12 23:32 . 2008-08-12 23:36 <DIR> d-------- C:\Program Files\Common Files\Nero 2008-08-12 23:32 . 2008-08-12 23:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero 2008-08-08 23:53 . 2008-08-09 00:19 <DIR> d-------- C:\etax2008 2008-08-08 09:40 . 2008-08-08 09:40 268 --ah----- C:\sqmdata18.sqm 2008-08-08 09:40 . 2008-08-08 09:40 244 --ah----- C:\sqmnoopt18.sqm . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-09-07 00:02 --------- d-----w C:\Documents and Settings\Chris\Application Data\Azureus 2008-09-06 04:07 --------- d-----w C:\Program Files\World of Warcraft 2008-09-06 01:17 --------- d-----w C:\Program Files\Mozilla Thunderbird 2008-09-04 08:36 --------- d-----w C:\Program Files\Java 2008-09-01 11:41 --------- d-----w C:\Documents and Settings\Chris\Application Data\dvdcss 2008-08-30 08:49 --------- d-----w C:\Program Files\Messenger Plus! Live 2008-08-28 10:54 --------- d-----w C:\Program Files\Mozilla Sunbird 2008-08-19 05:34 --------- d-----w C:\Program Files\Windows Live 2008-08-19 05:30 --------- d-----w C:\Program Files\Real 2008-08-19 05:30 --------- d-----w C:\Program Files\Common Files\Real 2008-08-19 05:14 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP 2008-08-05 09:59 --------- d-----w C:\Program Files\Apple Software Update 2008-08-05 09:58 --------- d-----w C:\Program Files\iTunes 2008-08-05 09:57 --------- d-----w C:\Program Files\iPod 2008-07-18 12:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll 2008-07-18 12:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe 2008-07-18 12:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll 2008-07-18 12:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll 2008-07-18 12:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll 2008-07-18 12:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll 2008-07-18 12:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll 2008-07-18 12:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll 2008-07-18 12:07 270,880 ----a-w C:\WINDOWS\system32\mucltui.dll 2008-07-18 12:07 210,976 ----a-w C:\WINDOWS\system32\muweb.dll 2008-07-12 02:01 --------- d-----w C:\Program Files\QuickTime 2008-07-09 23:35 32,000 ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-23 15:38 659,456 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll . ------- Sigcheck ------- 2001-08-23 22:00 12800 0f7d9c87b0ce1fa520473119752c6f79 C:\WINDOWS\$NtServicePackUninstall$\svchost.exe 2004-08-04 00:56 14336 8f078ae4ed187aaabc0a305146de6716 C:\WINDOWS\ServicePackFiles\i386\svchost.exe 2004-08-04 00:56 17408 c121b5b09046a8e5dcaa8fba406b323f C:\WINDOWS\system32\svchost.exe 2001-08-23 22:00 430080 2b0e480e975ee51f2d5ce5f068fed6e2 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe 2004-08-04 00:56 502272 01c3346c241652f43aed8e2149881bfe C:\WINDOWS\ServicePackFiles\i386\winlogon.exe 2004-08-04 00:56 506368 3a97fd93adb366d0632fcecfe10b5e7a C:\WINDOWS\system32\winlogon.exe 2007-06-13 20:23 1035776 0a69bc882c56403ad715b7fe3d0c3966 C:\WINDOWS\explorer.exe 2007-06-13 21:26 1033216 7712df0cdde3a5ac89843e61cd5b3658 C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe 2001-08-23 22:00 1000960 5a26fc6010886d25b3e412493dd95ed8 C:\WINDOWS\$NtServicePackUninstall$\explorer.exe 2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\$NtUninstallKB938828$\explorer.exe 2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe 2001-08-23 22:00 101376 e3df4a0252d287c44606ee55355e1623 C:\WINDOWS\$NtServicePackUninstall$\services.exe 2004-08-04 00:56 108032 c6ce6eec82f187615d1002bb3bb50ed4 C:\WINDOWS\ServicePackFiles\i386\services.exe 2004-08-04 00:56 110592 7de5d4fa0f54f9a2f9d3df268c93d051 C:\WINDOWS\system32\services.exe 2001-08-23 22:00 11776 8a590ea109b5e0c7629e022f8a6b17c5 C:\WINDOWS\$NtServicePackUninstall$\lsass.exe 2004-08-04 00:56 13312 84885f9b82f4d55c6146ebf6065d75d2 C:\WINDOWS\ServicePackFiles\i386\lsass.exe 2004-08-04 00:56 14848 2f5a9289985f40f291a2182082990110 C:\WINDOWS\system32\lsass.exe 2005-06-11 10:17 57856 ad3d9d191aea7b5445fe1d82ffbb4788 C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe 2001-08-23 22:00 51200 9b4155ba58192d4073082b8fc5d42612 C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe 2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\$NtUninstallKB896423$\spoolsv.exe 2004-08-04 00:56 57856 7435b108b935e42ea92ca94f59c8e717 C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe 2005-06-11 09:53 58880 f51b7f55ec50e00cb1755f09cb14faa7 C:\WINDOWS\system32\spoolsv.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-09-19 171464] "CurseClient"="C:\Program Files\Curse\CurseClient.exe" [2008-05-20 1400832] "IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-02-28 1828136] "Google Update"="C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-04 133104] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-06 849280] "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 116040] "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 413696] "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "NeroFilterCheck"="C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe" [2008-02-28 570664] "NBKeyScan"="C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-02-18 2221352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "PcSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2006-11-09 1634304] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "RunNarrator"="Narrator.exe" [2004-08-04 C:\WINDOWS\system32\narrator.exe] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication] --a------ 2006-11-28 14:12 222720 C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\Azureus\\Azureus.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.0-enUS-downloader.exe"= "C:\\Program Files\\World of Warcraft\\WoW-1.12.x-to-2.0.1-enUS-patch-downloader.exe"= "C:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3724:TCP"= 3724:TCP:Blizzard Downloader: 3724 R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 28544] S1 246fc85f;246fc85f;C:\WINDOWS\system32\drivers\246fc85f.sys [ ] S3 DADriv1;DADriv1;C:\Documents and Settings\Chris\My Documents\My Hacks\hackpack_cursayer\DA Engine\DAK32.sys [ ] S3 geebers12;geebers12;C:\Documents and Settings\Chris\My Documents\My Hacks\Exterm\Xterminator Engine 2.0\Xterminator.sys [ ] . Contents of the 'Scheduled Tasks' folder . ************************************************************************ catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-09-07 11:58:57 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Messenger\night_mare_9@hotmail.com\SharingMetadata\Working\database_D610_8CCF_108C_B7CF\$db_dirty$ 0 bytes C:\Documents and Settings\Chris\Local Settings\Application Data\Microsoft\Messenger\night_mare_9@hotmail.com\SharingMetadata\Working\database_D610_8CCF_108C_B7CF\tmp.edb 131072 bytes scan completed successfully hidden files: 2 ********************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe . ********************************************************************** . Completion time: 2008-09-07 12:03:50 - machine was rebooted ComboFix-quarantined-files.txt 2008-09-07 02:03:42 ComboFix2.txt 2008-09-07 00:52:37 Pre-Run: 5,216,468,992 bytes free Post-Run: 5,204,144,128 bytes free 197 --- E O F --- 2008-09-02 11:46:06 Hijack This** Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:05:49, on 9/7/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Windows Live Messenger.lnk = ? O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08b0e5c0-4fcb-11cf-aaa5-00401c608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [java_sun] Java (Sun) O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe -- End of file - 6933 bytes

09-07-2008, 11:20 PM	#13 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. -c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe ------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe ----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 1,438,720 Blocks: 2,810 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:10:25, on 9/8/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Windows Live Messenger.lnk = ? O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe -- End of file - 6804 bytes question why are there so many svchost running? and is there a need for them all??? the size of memory and cpu that the use vary's aswell... as the username that started them.... also how do i remove daemon tools from start up aswell as cursegaming...?? Last edited by XZanE; 09-07-2008 at 11:22 PM.

09-08-2008, 12:37 AM	#14 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. this is the kaspersky scan log... KASPERSKY ONLINE SCANNER 7 REPORT Monday, September 8, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, September 08, 2008 04:31:15 Records in database: 1201452 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area Critical Areas C:\Documents and Settings\All Users\Start Menu\Programs\Startup C:\Documents and Settings\Chris\Start Menu\Programs\Accessories\Startup C:\Program Files C:\WINDOWS Scan statistics Files scanned 37411 Threat name 1 Infected objects 2 Suspicious objects 0 Duration of the scan 01:27:13 File name Threat name Threats count C:\WINDOWS\system32\winlogon.exe/C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1 C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1 The selected area was scanned.

09-08-2008, 10:13 PM	#16 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. log.txt -c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe ------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe ----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 1,438,720 Blocks: 2,810 Kaspersky log KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, September 9, 2008 Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Monday, September 08, 2008 21:53:37 Records in database: 1202183 Scan settings Scan using the following database extended Scan archives yes Scan mail databases yes Scan area My Computer A:\ C:\ D:\ E:\ Scan statistics Files scanned 61955 Threat name 11 Infected objects 32 Suspicious objects 0 Duration of the scan 04:12:28 File name Threat name Threats count C:\WINDOWS\system32\winlogon.exe/C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1 C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Magic ISO 5.5 + Full Crack\setup.exe Infected: Trojan.Win32.Agent.zfy 1 C:\Documents and Settings\Chris\My Documents\Azureus Downloads\Windows XP Pro Corp SP3 Bootable Incl Key\Crack\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 2 C:\Documents and Settings\Chris\Shared\gabriella cilimi sweet about m.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Chris\Shared\gi joe movie.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\gijoe season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\gijoe season 3.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\Iron man dvd movie 2008.wma Infected: Trojan-Downloader.WMA.GetCodec.b 1 C:\Documents and Settings\Chris\Shared\iron man movie 2008.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Chris\Shared\iron man movie 2008.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\robotech season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\robotech season 2.zip Infected: not-a-virus:AdWare.Win32.Sahat.cd 1 C:\Documents and Settings\Chris\Shared\star wars clone wars season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\star wars clone wars season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\thundercats season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\thundercats season 2.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\thundercats season 3.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Chris\Shared\thundercats season 3.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\tranzor z season 1.zip Infected: not-a-virus:AdWare.Win32.Agent.zk 1 C:\Documents and Settings\Chris\Shared\voltron season 1.mp3 Infected: Trojan-Downloader.WMA.Wimad.n 1 C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968 Infected: Trojan-Downloader.Java.OpenConnection.ao 2 C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\43\5b640a6b-16f5b968 Infected: Trojan.Java.ClassLoader.au 1 C:\Documents and Settings\Guest\Application Data\Sun\Java\Deployment\cache\6.0\56\564e2978-70d5b559 Infected: Trojan-Downloader.Java.OpenStream.ac 1 C:\QooBox\Quarantine\C\WINDOWS\explorer.exe.vir Infected: Trojan.Win32.Patched.cx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\lsass.exe.vir Infected: Trojan.Win32.Patched.cx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\services.exe.vir Infected: Trojan.Win32.Patched.cx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\spoolsv.exe.vir Infected: Trojan.Win32.Patched.cx 1 C:\QooBox\Quarantine\C\WINDOWS\system32\svchost.exe.vir Infected: Trojan.Win32.Patched.cx 1 C:\QooBox\Quarantine\catchme2008-09-07_115713.35.zip Infected: Trojan-Downloader.Win32.Agent.vsh 1 C:\WINDOWS\system32\winlogon.exe Infected: Trojan.Win32.Patched.cx 1 The selected area was scanned. Thats a lot of diffrence :S... and Hijackthis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:11:20, on 9/9/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\WINDOWS\system32\IoctlSvc.exe C:\WINDOWS\system32\slserv.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\WINDOWS\system32\notepad.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://login.live.com/ppsecure/sha1auth.srf?lc=1033 O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll (file missing) O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [CurseClient] C:\Program Files\Curse\CurseClient.exe O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-18\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [PcSync] C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user') O4 - Global Startup: Windows Live Messenger.lnk = ? O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/re...s/MSNPUpld.cab O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-AU/.../GAME_UNO1.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\WINDOWS\system32\IoctlSvc.exe O23 - Service: Pml Driver HPZ12 (pml driver hpz12) - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe -- End of file - 7075 bytes

09-11-2008, 08:25 AM	#19 (permalink)
chemist Moderator, Analyst, Security Team; Rangemaster, TSF Academy Join Date: Oct 2007 Location: Georgia Posts: 10,610 OS: XP SP3	Re: Computer Has Pop Ups. I need to see log.txt please. __________________ Our help is free but please donate Proud member of ASAP Proud member of UNITE

09-11-2008, 08:35 AM	#20 (permalink)
XZanE Registered User Join Date: Nov 2004 Location: Brisbane, Australia Posts: 182 OS: Windows Vista	Re: Computer Has Pop Ups. -c----w 430,080 2001-08-23 12:00:00 C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe ------w 502,272 2004-08-03 14:56:58 C:\WINDOWS\ServicePackFiles\i386\winlogon.exe ----a-w 506,368 2004-08-03 14:56:58 C:\WINDOWS\system32\winlogon.exe Entries: 3 (3) Directories: 0 Files: 3 Bytes: 1,438,720 Blocks: 2,810 is that the right one?