Nasty malware

[claudio579]

Hi there, hope you can help me
My friend gave me a program on a disc the other day and I went to install it but it has seriously messed up my pc. it wont allow me to get onto firefox or internet explorer without crashing, or let me run any antispyware programs. i've run avg anti virus and it cant find anything.

i also think that its messed with google as everytime i click on a search result adverts come up and i have to press the back button to get to my search result.

I have tried system restoring earlier a few times but each time fails (something about the disc errors i think, can't remember now!!)

Anyway thanks for your help in advance

Here's my DDS.txt file and the rest is attached:


DDS (Ver_09-05-14.01) - NTFSx86
Run by Woody at 20:18:29.43 on 20/06/2009
Internet Explorer: 7.0.6001.18000 BrowserJavaVersion: 1.6.0_13
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2814.1594 [GMT 1:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\O2Micro Flash Memory Card Driver\o2flash.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Toshiba TEMPRO\TempoSVC.exe
C:\Program Files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe
C:\Program Files\TOSHIBA\SMARTLogService\TosIPCSrv.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Toshiba\ConfigFree\NDSTray.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Camera Assistant Software for Toshiba\traybar.exe
C:\Program Files\Toshiba\Power Saver\TPwrMain.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Toshiba\SmoothView\SmoothView.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Toshiba\FlashCards\TCrdMain.exe
C:\Program Files\Toshiba\HDMICtrlMan\HDMICtrlMan.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe
C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Toshiba\TOSCDSPD\TOSCDSPD.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Windows\System32\regsvr32.exe
C:\Users\Woody\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Toshiba\TRDCReminder\TRDCReminder.exe
C:\Program Files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
C:\Program Files\Toshiba\ConfigFree\CFSwMgr.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe
C:\Program Files\Nokia\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\Nokia\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Woody\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Woody\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\System32\rstrui.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Users\Woody\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\Woody\Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.15642\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Google Gears Helper: {e0fefe40-fbf9-42ae-ba58-794ca7e3fb53} - c:\program files\google\google gears\internet explorer\0.5.23.0\gears.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [TOSCDSPD] TOSCDSPD.EXE
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [CTSyncU.exe] c:\program files\creative\sync manager unicode\CTSyncU.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [MPEGVideo] regsvr32 /s /u "c:\users\woody\appdata\local\mpeg\MPEGVideo.dll"
uRun: [Google Update] "c:\users\woody\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [Startup Manager] "c:\program files\advanced system optimizer\startUp manager.exe"
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [Toshiba TEMPO] c:\program files\toshiba tempro\Toshiba.Tempo.UI.TrayApplication.exe
mRun: [topi] c:\program files\toshiba\toshiba online product information\topi.exe -startup
mRun: [StartCCC] c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [Camera Assistant Software] "c:\program files\camera assistant software for toshiba\traybar.exe" /start
mRun: [TPwrMain] %ProgramFiles%\TOSHIBA\Power Saver\TPwrMain.EXE
mRun: [HSON] %ProgramFiles%\TOSHIBA\TBS\HSON.exe
mRun: [SmoothView] %ProgramFiles%\Toshiba\SmoothView\SmoothView.exe
mRun: [00TCrdMain] %ProgramFiles%\TOSHIBA\FlashCards\TCrdMain.exe
mRun: [HDMICtrlMan] c:\program files\toshiba\hdmictrlman\HDMICtrlMan.exe
mRun: [Toshiba Registration] c:\program files\toshiba\registration\ToshibaRegistration.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [Adobe Reader Speed Launcher] c:\program files\adobe\reader 8.0\reader\Reader_sl.exe
mRun: [CTCheck] c:\program files\creative\creative zen\zen media explorer\CTCheck.exe
mRun: [NokiaMServer] c:\program files\common files\nokia\mplatform\NokiaMServer /watchfiles
mRun: [Nokia FastStart] "c:\program files\nokia\nokia music\NokiaMusic.exe" /command:faststart
mRun: [SunJavaUpdateSched] c:\program files\java\jre6\bin\jusched.exe
mRun: [ISTray] "c:\program files\spyware doctor\pctsTray.exe"
mRun: [jswtrayutil] c:\program files\jumpstart\jswtrayutil.exe
mRun: [NDSTray.exe] NDSTray.exe
StartupFolder: c:\users\woody\appdata\roaming\micros~1\windows\startm~1\programs\startup\bbcipl~1.lnk - c:\program files\bbc iplayer desktop\BBC iPlayer Desktop.exe
StartupFolder: c:\users\woody\appdata\roaming\micros~1\windows\startm~1\programs\startup\trdcre~1.lnk - c:\program files\toshiba\trdcreminder\TRDCReminder.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
IE: {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - {0B4350D1-055F-47A3-B112-5F2F2B0D6F08} - c:\program files\google\google gears\internet explorer\0.5.23.0\gears.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} - hxxp://u3.sandisk.com/download/apps/LPInstaller.CAB
DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 85.255.112.231,85.255.112.98
TCP: {2BDE14C2-B501-44FE-82B9-23078F91CB06} = 85.255.112.231,85.255.112.98
TCP: {DCF86B7E-EE4A-4A68-9D86-572E4F2C86B5} = 85.255.112.231,85.255.112.98
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: c:\progra~1\google\google~3\GOEC62~1.DLL,avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\woody\appdata\roaming\mozilla\firefox\profiles\krupknjf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GB:official
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\google\google gears\firefox\components\gears.dll
FF - component: c:\users\woody\appdata\roaming\mozilla\firefox\profiles\krupknjf.default\extensions\{62760fd6-b943-48c9-ab09-f99c6fe96088}\platform\winnt\components\EbayAccessService.dll
FF - component: c:\users\woody\appdata\roaming\mozilla\firefox\profiles\krupknjf.default\extensions\{62760fd6-b943-48c9-ab09-f99c6fe96088}\platform\winnt\components\EbayFormSubmitObserver.dll
FF - component: c:\users\woody\appdata\roaming\mozilla\firefox\profiles\krupknjf.default\extensions\geode@labs.mozilla.com\platform\winnt_x86-msvc\components\loki.dll
FF - plugin: c:\progra~1\meadco~1\npmeadax.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\google\update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\skyhook wireless\loki browser plugin\nploki.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: c:\users\woody\appdata\local\google\update\1.2.145.5\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.00.13
============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2009-6-20 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-31 327688]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-1-27 108552]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\system32\drivers\jswpslwf.sys [2008-12-31 20352]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-12-31 906520]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-12-31 298776]
R2 ConfigFree Service;ConfigFree Service;c:\program files\toshiba\configfree\CFSvcs.exe [2008-4-17 40960]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\microsoft sql server\mssql.1\mssql\binn\sqlservr.exe [2008-11-24 29263712]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-6-20 348752]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\toshiba tempro\TempoSVC.exe [2008-11-6 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\toshiba\smartlogservice\TosIPCSrv.exe [2007-12-3 126976]
R3 O2MDRDR;O2MDRDR;c:\windows\system32\drivers\o2media.sys [2008-4-15 51160]
R3 QIOMem;Generic IO & Memory Access;c:\windows\system32\drivers\QIOMem.sys [2007-4-9 8192]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\toshiba\smartfacev\SmartFaceVWatchSrv.exe [2008-8-25 77824]
S2 gupdate1c96ccaa65802b1;Google Update Service (gupdate1c96ccaa65802b1);c:\program files\google\update\GoogleUpdate.exe [2009-1-2 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\system32\drivers\ASPI32.SYS [2009-1-28 84832]
S3 idrmkl;idrmkl;c:\users\woody\appdata\local\temp\idrmkl.sys [2008-5-26 31744]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\jumpstart\jswpsapi.exe [2008-12-31 937984]

=============== Created Last 30 ================

2009-06-20 20:14 11 a------- C:\AuResult.ini
2009-06-20 20:09 <DIR> --d----- c:\program files\Trend Micro
2009-06-20 19:16 <DIR> --d----- c:\users\woody\.housecall6.6
2009-06-20 19:15 <DIR> --d----- c:\program files\MeadCo Neptune
2009-06-20 18:34 159,600 a------- c:\windows\system32\drivers\pctgntdi.sys
2009-06-20 18:34 130,936 a------- c:\windows\system32\drivers\PCTCore.sys
2009-06-20 18:34 73,840 a------- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-20 18:34 <DIR> a-d----- c:\programdata\TEMP
2009-06-20 18:33 64,392 a------- c:\windows\system32\drivers\pctplsg.sys
2009-06-20 18:33 <DIR> --d----- c:\program files\common files\PC Tools
2009-06-20 18:33 <DIR> --d----- c:\users\woody\appdata\roaming\PC Tools
2009-06-20 18:33 <DIR> --d----- c:\programdata\PC Tools
2009-06-20 18:33 <DIR> --d----- c:\program files\Spyware Doctor
2009-06-20 18:33 <DIR> --d----- c:\progra~2\PC Tools
2009-06-20 18:21 <DIR> --d----- c:\windows\Repair
2009-06-20 18:20 <DIR> --d----- c:\users\woody\appdata\roaming\Systweak
2009-06-20 18:19 <DIR> --d----- c:\program files\Advanced System Optimizer
2009-06-20 16:37 <DIR> --d----- c:\programdata\Telestream
2009-06-20 16:37 <DIR> --d----- c:\progra~2\Telestream
2009-06-20 16:37 <DIR> --d----- c:\users\woody\appdata\roaming\Vara Software
2009-06-19 19:11 <DIR> --d----- c:\program files\TweetDeck
2009-06-16 15:39 <DIR> --d----- c:\programdata\GARMIN
2009-06-16 15:39 <DIR> --d----- c:\progra~2\GARMIN
2009-06-16 08:09 <DIR> --d----- C:\Garmin
2009-06-14 15:49 428,544 a------- c:\windows\system32\EncDec.dll
2009-06-14 15:49 293,376 a------- c:\windows\system32\psisdecd.dll
2009-06-14 15:49 217,088 a------- c:\windows\system32\psisrndr.ax
2009-06-14 15:49 177,664 a------- c:\windows\system32\mpg2splt.ax
2009-06-14 15:49 80,896 a------- c:\windows\system32\MSNP.ax
2009-06-12 13:51 <DIR> --d----- c:\users\woody\appdata\roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2009-06-11 07:34 2,033,152 a------- c:\windows\system32\win32k.sys
2009-06-01 15:23 <DIR> --d----- c:\program files\Infogrames
2009-05-31 13:03 <DIR> --d----- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-31 13:03 <DIR> --d----- c:\progra~2\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-31 13:02 <DIR> --d----- c:\program files\Bonjour
2009-05-31 13:01 <DIR> --d----- c:\programdata\Apple Computer
2009-05-31 12:59 <DIR> --d----- c:\programdata\Apple

==================== Find3M ====================

2009-06-20 18:13 143,360 a------- c:\windows\inf\infstrng.dat
2009-06-20 18:13 51,200 a------- c:\windows\inf\infpub.dat
2009-06-12 11:52 327,688 a------- c:\windows\system32\drivers\avgldx86.sys
2009-06-09 21:14 86,016 a------- c:\windows\inf\infstor.dat
2009-05-08 15:17 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-08 15:17 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-05-01 19:30 3,366,912 a------- c:\windows\system32\GPhotos.scr
2009-04-24 17:05 827,904 a------- c:\windows\system32\wininet.dll
2009-04-24 17:02 78,336 a------- c:\windows\system32\ieencode.dll
2009-04-24 14:44 26,624 a------- c:\windows\system32\ieUnatt.exe
2009-04-23 13:43 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-04-23 13:42 636,928 a------- c:\windows\system32\localspl.dll
2008-12-31 22:42 0 a------- c:\users\woody\appdata\roaming\wklnhst.dat
2008-12-31 20:01 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-21 03:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 13:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 13:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 10:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 10:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 20:19:15.10 ===============

[claudio579]

72 hour bump :)

[TheBruce1]

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.

=========

If you are unable to download the tools from the infected computer, get to a clean computer and download them to Flash drive, USB stick or any other removable media device, then upload to infect computer.

==========

Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3





--------------------------------------------------------------------

Double click on Combo-Fix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:ComboFix.txt in your reply so we can continue cleaning the system.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

[claudio579]

Hi there :) I have followed your instructions and here is the report:

ComboFix 09-06-24.05 - Woody 25/06/2009 16:30.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.44.1033.18.2814.1718 [GMT 1:00]
Running from: c:\users\Woody\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: AVG Anti-Virus Free *enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\MSIVXnwiruhtnthrmbnwipiarqtpcwvenxqrg.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXdwxmlxpsmnschoicqbvelcnupofjaafr.dll
c:\windows\system32\MSIVXirpepxfuqphyqacuqvewbkdxpeceuime.dll
c:\windows\Tasks\{5B57CF47-0BFA-43c6-ACF9-3B3653DCADBA}.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.

2009-06-20 19:09 . 2009-06-20 19:09 -------- d-----w- c:\program files\Trend Micro
2009-06-20 18:16 . 2009-06-20 19:14 -------- d-----w- c:\users\Woody\.housecall6.6
2009-06-20 18:15 . 2009-06-20 18:15 -------- d-----w- c:\program files\MeadCo Neptune
2009-06-20 17:34 . 2008-12-11 07:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-20 17:34 . 2009-04-03 10:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-20 17:34 . 2008-12-18 11:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-20 17:33 . 2009-06-20 17:34 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-20 17:33 . 2008-12-10 10:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-20 17:33 . 2009-06-20 17:35 -------- d-----w- c:\program files\Spyware Doctor
2009-06-20 17:33 . 2009-06-20 17:33 -------- d-----w- c:\users\Woody\AppData\Roaming\PC Tools
2009-06-20 17:33 . 2009-06-20 17:33 -------- d-----w- c:\programdata\PC Tools
2009-06-20 17:21 . 2009-06-20 17:23 -------- d-----w- c:\windows\Repair
2009-06-20 17:20 . 2009-06-20 17:20 -------- d-----w- c:\users\Woody\AppData\Roaming\Systweak
2009-06-20 17:19 . 2009-06-20 17:19 -------- d-----w- c:\program files\Advanced System Optimizer
2009-06-20 15:37 . 2009-06-20 15:37 -------- d-----w- c:\programdata\Telestream
2009-06-20 15:37 . 2009-06-20 15:37 -------- d-----w- c:\users\Woody\AppData\Roaming\Vara Software
2009-06-20 15:21 . 2009-06-20 15:21 -------- d-----w- c:\users\Woody\AppData\Local\MPEG
2009-06-19 21:40 . 2009-06-20 15:37 -------- d-----w- c:\users\Woody\AppData\Local\procaster
2009-06-19 18:11 . 2009-06-19 18:11 -------- d-----w- c:\program files\TweetDeck
2009-06-17 09:43 . 2009-06-12 10:52 1261344 ----a-w- c:\programdata\avg8\update\backup\avgwd.dll
2009-06-17 09:43 . 2009-06-12 10:52 829208 ----a-w- c:\programdata\avg8\update\backup\avgcfgx.dll
2009-06-16 14:39 . 2009-06-16 14:39 -------- d-----w- c:\programdata\GARMIN
2009-06-16 07:09 . 2009-06-16 20:45 -------- d-----w- C:\Garmin
2009-06-15 07:02 . 2008-12-04 00:25 120832 ----a-w- c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}\plugins\npietab.dll
2009-06-14 14:49 . 2009-04-30 12:37 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-06-14 14:49 . 2009-04-30 12:37 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-06-12 12:51 . 2009-06-12 12:51 -------- d-----w- c:\users\Woody\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2009-06-12 10:53 . 2009-06-12 10:52 3298072 ----a-w- c:\programdata\avg8\update\backup\setup.exe
2009-06-12 10:52 . 2009-06-12 10:49 1452312 ----a-w- c:\programdata\avg8\update\backup\avgupd.dll
2009-06-11 06:34 . 2009-04-21 11:55 2033152 ----a-w- c:\windows\system32\win32k.sys
2009-06-01 14:23 . 2009-06-01 14:23 -------- d-----w- c:\program files\Infogrames
2009-05-31 12:04 . 2009-05-31 12:04 -------- d-----w- c:\users\Woody\AppData\Local\Apple Computer
2009-05-31 12:04 . 2009-05-31 12:04 -------- d-----w- c:\users\Woody\AppData\Roaming\Apple Computer
2009-05-31 12:03 . 2009-05-31 12:03 -------- d-----w- c:\programdata\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-05-31 12:02 . 2009-05-31 12:02 -------- d-----w- c:\program files\Bonjour
2009-05-31 12:01 . 2009-06-20 16:34 -------- d-----w- c:\programdata\Apple Computer
2009-05-31 12:01 . 2009-05-31 12:01 -------- d-----w- c:\users\Woody\AppData\Local\Apple
2009-05-31 12:01 . 2009-05-31 12:01 -------- d-----w- c:\program files\Apple Software Update
2009-05-31 11:59 . 2009-06-20 16:17 -------- d-----w- c:\program files\Common Files\Apple
2009-05-31 11:59 . 2009-05-31 11:59 -------- d-----w- c:\programdata\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 11:37 . 2008-12-31 18:53 -------- d-----w- c:\programdata\avg8
2009-06-24 22:25 . 2009-04-07 20:28 -------- d-----w- c:\users\Woody\AppData\Roaming\Spotify
2009-06-20 15:10 . 2009-01-01 22:50 -------- d-----w- c:\users\Woody\AppData\Roaming\uTorrent
2009-06-19 22:14 . 2008-06-12 09:57 -------- d-----w- c:\program files\Google
2009-06-17 09:42 . 2008-12-31 18:53 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-06-16 07:09 . 2009-04-17 18:29 -------- d-----w- c:\users\Woody\AppData\Roaming\GARMIN
2009-06-15 22:46 . 2009-01-28 22:45 -------- d-----w- c:\users\Woody\AppData\Roaming\Download Manager
2009-06-12 10:52 . 2008-12-31 18:53 327688 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2009-06-11 21:52 . 2008-06-12 10:00 -------- d-----w- c:\program files\Microsoft Works
2009-06-05 15:28 . 2008-12-31 17:55 104848 ----a-w- c:\users\Woody\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-01 14:23 . 2008-06-12 09:12 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-05-26 23:18 . 2009-01-08 21:04 -------- d-----w- c:\users\Woody\AppData\Roaming\FileZilla
2009-05-23 21:52 . 2009-04-12 15:16 -------- d-----w- c:\program files\EA GAMES
2009-05-23 21:44 . 2009-05-05 16:36 -------- d-----w- c:\program files\Opera
2009-05-23 21:41 . 2009-01-27 22:11 -------- d-----w- c:\program files\Audible
2009-05-19 12:05 . 2009-02-26 21:07 -------- d-----w- c:\programdata\TrackMania
2009-05-15 20:53 . 2009-05-14 19:41 -------- d-----w- c:\program files\Microsoft SQL Server
2009-05-14 19:50 . 2009-05-14 19:48 -------- d-----w- c:\program files\Microsoft Small Business
2009-05-14 19:43 . 2008-12-31 23:37 -------- d-----w- c:\program files\Microsoft.NET
2009-05-14 02:01 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-05-08 14:17 . 2008-12-31 18:53 11952 ----a-w- c:\windows\system32\avgrsstx.dll
2009-05-08 14:17 . 2009-01-27 17:00 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2009-05-02 18:28 . 2009-05-02 18:28 -------- d-----w- c:\users\Woody\AppData\Roaming\TSO
2009-05-02 18:12 . 2009-05-02 18:11 -------- d-----w- c:\program files\DSA Theory Test
2009-05-01 18:30 . 2009-05-01 18:30 3366912 ----a-w- c:\windows\system32\GPhotos.scr
2009-04-27 17:51 . 2009-04-27 17:44 -------- d-----w- c:\users\Woody\AppData\Roaming\Audacity
2009-04-27 17:50 . 2009-04-27 17:50 -------- d-----w- c:\program files\Lame for Audacity
2009-04-27 17:44 . 2009-04-27 17:44 -------- d-----w- c:\program files\Audacity 1.3 Beta (Unicode)
2009-04-24 16:05 . 2009-06-11 06:33 827904 ----a-w- c:\windows\system32\wininet.dll
2009-04-24 16:02 . 2009-06-11 06:33 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-24 13:44 . 2009-06-11 06:33 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-04-23 12:43 . 2009-06-11 06:33 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:33 636928 ----a-w- c:\windows\system32\localspl.dll
2009-04-22 18:13 . 2009-04-27 14:37 98304 ----a-w- c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
2009-04-22 18:13 . 2009-04-27 14:37 77824 ----a-w- c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
2009-04-18 12:32 . 2009-04-18 12:34 38208 ----a-w- c:\users\Woody\AppData\Roaming\Macromedia\Flash Player\http://www.macromedia.com\bin\airapp...pinstaller.exe
2009-04-12 20:38 . 2009-04-12 20:38 717296 ----a-w- c:\windows\system32\drivers\sptd.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2009-02-06 3885408]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-03-02 39408]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560]
"MPEGVideo"="c:\users\Woody\AppData\Local\MPEG\MPEGVideo.dll" [2009-06-20 110592]
"Google Update"="c:\users\Woody\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-06-20 133104]
"Startup Manager"="c:\program files\Advanced System Optimizer\startUp manager.exe" [2007-06-22 919280]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NokiaMServer"="c:\program files\Common Files\Nokia\MPlatform\NokiaMServer" [X]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-06-12 1836544]
"Toshiba TEMPO"="c:\program files\Toshiba TEMPRO\Toshiba.Tempo.UI.TrayApplication.exe" [2008-11-06 103824]
"topi"="c:\program files\TOSHIBA\Toshiba Online Product Information\topi.exe" [2007-07-10 581632]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-12-15 184320]
"Camera Assistant Software"="c:\program files\Camera Assistant Software for Toshiba\traybar.exe" [2008-03-25 417792]
"TPwrMain"="c:\program files\TOSHIBA\Power Saver\TPwrMain.EXE" [2008-01-17 431456]
"HSON"="c:\program files\TOSHIBA\TBS\HSON.exe" [2007-10-31 54608]
"SmoothView"="c:\program files\Toshiba\SmoothView\SmoothView.exe" [2008-01-25 509816]
"00TCrdMain"="c:\program files\TOSHIBA\FlashCards\TCrdMain.exe" [2008-03-19 716800]
"HDMICtrlMan"="c:\program files\TOSHIBA\HDMICtrlMan\HDMICtrlMan.exe" [2008-04-02 716800]
"Toshiba Registration"="c:\program files\Toshiba\Registration\ToshibaRegistration.exe" [2008-01-11 574864]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-06-12 1948440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"CTCheck"="c:\program files\Creative\Creative ZEN\ZEN Media Explorer\CTCheck.exe" [2007-11-06 397312]
"Nokia FastStart"="c:\program files\Nokia\Nokia Music\NokiaMusic.exe" [2009-02-26 2376992]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"NDSTray.exe"="NDSTray.exe" [BU]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2009-3-8 113664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~3\GoogleDesktopNetwork3.dll c:\windows\System32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{D8A0FBA4-6634-4EF4-AD1A-EDAF1E479EF8}"= c:\program files\AVG\AVG8\avgemc.exe:avgemc.exe
"{CD12D63D-0CA4-4CC0-9580-7790FD75CE70}"= c:\program files\AVG\AVG8\avgupd.exe:avgupd.exe
"{222C1ABA-FA8D-433E-85A0-9222D8516F10}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{E7F25D3D-F435-41BE-8EAE-414AA092ACEB}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{3CA6D47D-B826-44B2-BAA0-0412358CAFD3}"= UDP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"{A9F6857F-C7DB-4299-87FE-E2ABA7B6562F}"= TCP:c:\program files\Sports Interactive\Football Manager 2008\fm.exe:Football Manager 2008
"TCP Query User{01AC52A1-D089-45A1-9008-11C31BC39D54}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{D5499B53-EAEC-4443-BC2E-A65C76CC2CEC}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"TCP Query User{9E42E09C-C751-4DA9-9C07-BBA9D5478792}c:\\program files\\java\\jre6\\bin\\java.exe"= UDP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"UDP Query User{70E02054-C4D8-41C4-A5CC-AB98B0876F5D}c:\\program files\\java\\jre6\\bin\\java.exe"= TCP:c:\program files\java\jre6\bin\java.exe:Java(TM) Platform SE binary
"TCP Query User{D27D7672-2177-481B-87C8-613C296620C2}c:\\program files\\sopcast\\adv\\sopadver.exe"= UDP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"UDP Query User{7BDB398B-0CC3-4516-A825-57C74B400F4C}c:\\program files\\sopcast\\adv\\sopadver.exe"= TCP:c:\program files\sopcast\adv\sopadver.exe:SopCast Adver
"TCP Query User{25FA1F52-590A-443F-9CDE-02D30C18389C}c:\\program files\\sopcast\\sopcast.exe"= UDP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"UDP Query User{F83C13E7-693A-4AEC-BA9E-0CCE23EADDC2}c:\\program files\\sopcast\\sopcast.exe"= TCP:c:\program files\sopcast\sopcast.exe:SopCast Main Application
"{36064164-A778-4518-9AD6-26D184669B04}"= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"TCP Query User{75CB9EA3-C0E8-445A-82C3-95C4A992FC2D}c:\\program files\\tmnationsforever\\tmforever.exe"= UDP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"UDP Query User{6F1FF3EA-D378-49EA-A0D2-E4D4FF1DFB96}c:\\program files\\tmnationsforever\\tmforever.exe"= TCP:c:\program files\tmnationsforever\tmforever.exe:TmForever
"TCP Query User{2D4C7940-8377-4EDA-985A-291A7892A480}c:\\xampp\\apache\\bin\\apache.exe"= UDP:c:\xampp\apache\bin\apache.exe:Apache HTTP Server
"UDP Query User{556F403E-3879-472D-B20A-AF521F6B52AA}c:\\xampp\\apache\\bin\\apache.exe"= TCP:c:\xampp\apache\bin\apache.exe:Apache HTTP Server
"TCP Query User{55061F6F-EE6A-4675-B9E7-2691C07C23A1}c:\\xampp\\mysql\\bin\\mysqld.exe"= UDP:c:\xampp\mysql\bin\mysqld.exe:mysqld
"UDP Query User{8EBADCF6-B61D-4B69-8808-F69144FFE413}c:\\xampp\\mysql\\bin\\mysqld.exe"= TCP:c:\xampp\mysql\bin\mysqld.exe:mysqld
"TCP Query User{AEF287A9-61FC-4862-B8A5-2F4CD092EDCB}c:\\program files\\spotify\\spotify.exe"= UDP:c:\program files\spotify\spotify.exe:Spotify
"UDP Query User{8EBFDE14-F64C-4F9A-8006-A336E9402BDC}c:\\program files\\spotify\\spotify.exe"= TCP:c:\program files\spotify\spotify.exe:Spotify
"{5C08C395-4B6F-4B26-BABB-8E95B7629E16}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{B20B8783-3077-40FF-A3E4-0C573EE35131}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour

R0 PCTCore;PCTools KDS;c:\windows\System32\drivers\PCTCore.sys [20/06/2009 18:34 130936]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [31/12/2008 19:53 327688]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\drivers\avgtdix.sys [27/01/2009 18:00 108552]
R1 jswpslwf;JumpStart Wireless Filter Driver;c:\windows\System32\drivers\jswpslwf.sys [31/12/2008 18:59 20352]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [31/12/2008 19:53 906520]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [31/12/2008 19:53 298776]
R2 ConfigFree Service;ConfigFree Service;c:\program files\Toshiba\ConfigFree\CFSvcs.exe [17/04/2008 00:19 40960]
R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [24/11/2008 22:31 29263712]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [20/06/2009 18:33 348752]
R2 TempoMonitoringService;Notebook Performance Tuning Service ;c:\program files\Toshiba TEMPRO\TempoSVC.exe [06/11/2008 02:57 99720]
R2 TOSHIBA SMART Log Service;TOSHIBA SMART Log Service;c:\program files\Toshiba\SMARTLogService\TosIPCSrv.exe [03/12/2007 18:03 126976]
R3 O2MDRDR;O2MDRDR;c:\windows\System32\drivers\o2media.sys [15/04/2008 09:13 51160]
R3 QIOMem;Generic IO & Memory Access;c:\windows\System32\drivers\QIOMem.sys [09/04/2007 16:13 8192]
R3 SmartFaceVWatchSrv;SmartFaceVWatchSrv;c:\program files\Toshiba\SmartFaceV\SmartFaceVWatchSrv.exe [25/08/2008 10:58 77824]
S2 gupdate1c96ccaa65802b1;Google Update Service (gupdate1c96ccaa65802b1);c:\program files\Google\Update\GoogleUpdate.exe [02/01/2009 12:09 133104]
S3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\drivers\ASPI32.SYS [28/01/2009 23:17 84832]
S3 jswpsapi;Jumpstart Wifi Protected Setup;c:\program files\Jumpstart\jswpsapi.exe [31/12/2008 18:59 937984]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\GoogleUpdateTaskMachine.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-01-02 11:09]

2009-06-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2436731861-3120910842-1155494356-1000.job
- c:\users\Woody\AppData\Local\Google\Update\GoogleUpdate.exe [2009-06-20 17:14]

2009-06-24 c:\windows\Tasks\User_Feed_Synchronization-{4F68153C-0B91-40E1-9D61-7CFC2924C8D1}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-TOSCDSPD - TOSCDSPD.EXE
HKLM-Run-jswtrayutil - c:\program files\Jumpstart\jswtrayutil.exe


.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
FF - ProfilePath - c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://en-GB.start2.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-GB:official
FF - prefs.js: keyword.URL - about:neterror?e=query&u=
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\Google\Google Gears\Firefox\components\gears.dll
FF - component: c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayAccessService.dll
FF - component: c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088}\platform\WINNT\components\EbayFormSubmitObserver.dll
FF - component: c:\users\Woody\AppData\Roaming\Mozilla\Firefox\Profiles\krupknjf.default\extensions\geode@labs.mozilla.com\platform\WINNT_x86-msvc\components\loki.dll
FF - plugin: c:\progra~1\MEADCO~1\npmeadax.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.145.5\npGoogleOneClick8.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Skyhook Wireless\Loki Browser Plugin\nploki.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\Woody\AppData\Local\Google\Update\1.2.145.5\npGoogleOneClick8.dll

---- FIREFOX POLICIES ----
FF - user.js: general.useragent.extra.zencast - Creative ZENcast v2.00.13.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 16:46
Windows 6.0.6001 Service Pack 1 NTFS

detected NTDLL code modification:
ZwClose

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3612)
c:\program files\Spyware Doctor\pctgmhk.dll
c:\users\Woody\AppData\Local\MPEG\MPEGVideo.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\Ati2evxx.exe
c:\windows\System32\wlanext.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\O2Micro Flash Memory Card Driver\o2flash.exe
c:\program files\Spyware Doctor\pctsSvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\program files\Toshiba\TOSHIBA DVD PLAYER\TNaviSrv.exe
c:\windows\System32\TODDSrv.exe
c:\program files\Toshiba\Power Saver\TosCoSrv.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\windows\System32\drivers\XAudio.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\AVG\AVG8\avgtray.exe
c:\program files\Common Files\Nokia\MPlatform\NokiaMServer.exe
c:\program files\Toshiba\ConfigFree\NDSTray.exe
c:\program files\Toshiba\TOSCDSPD\TOSCDSPD.exe
c:\program files\Camera Assistant Software for Toshiba\CEC_MAIN.exe
c:\windows\System32\regsvr32.exe
c:\program files\Toshiba\HDMICtrlMan\HCMSoundChanger.exe
c:\program files\Toshiba\ConfigFree\CFSwMgr.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Apoint2K\ApMsgFwd.exe
c:\program files\Apoint2K\hidfind.exe
c:\program files\Apoint2K\ApntEx.exe
c:\program files\Nokia\PC Connectivity Solution\ServiceLayer.exe
c:\program files\Nokia\PC Connectivity Solution\Transports\NclUSBSrv.exe
c:\program files\Nokia\PC Connectivity Solution\Transports\NclRSSrv.exe
.
**************************************************************************
.
Completion time: 2009-06-25 16:54 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-25 15:53

Pre-Run: 63,059,927,040 bytes free
Post-Run: 65,981,464,576 bytes free

308 --- E O F --- 2009-06-18 15:51

[TheBruce1]

Hello again

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

========

P2P

P2P - I see you have P2P software (µTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

========

Did you set this policy?

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 1 (0x1)

If so, continue on to the next part of the fix(Java Outdated). However, if you did not set it, follow instructions below.

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"=-

Save the file as "Fix.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

========

JAVA OUTDATED


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

• Download the latest version of Java Runtime Environment (JRE) 6 and save it to your desktop.
• Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 14. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
• Click the "Download" button to the right.
• Select the Windows platform from the dropdown menu.
• Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
• Click on the link to download Windows Offline Installation and save the file to your desktop.
• Close any programs you may have running - especially your web browser.
• Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
• Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java versions.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version.

• After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
  • On the General tab, under Temporary Internet Files, click the Settings button.
  • Next, click on the Delete Files button
  • There are two options in the window to clear the cache - Leave BOTH Checked
    • Applications and Applets
      Trace and Log Files
  • Click OK on Delete Temporary Files Window
    Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
  • Click OK to leave the Temporary Files Window
  • Click OK to leave the Java Control Panel.

========

Download ATF-Cleaner by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

=========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:




To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

=======
Logs Required
Kaspersky Scan Report

An update on how your system is running

[claudio579]

sorry this is a bit late:

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, June 26, 2009
Operating System: Microsoft Windows Vista Home Premium Edition, 32-bit Service Pack 1 (build 6001)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, June 25, 2009 20:19:53
Records in database: 2389318
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\

Scan statistics:
Files scanned: 128397
Threat name: 2
Infected objects: 2
Suspicious objects: 0
Duration of the scan: 03:15:44


File name / Threat name / Threats count
C:\Qoobox\Quarantine\C\Windows\System32\MSIVXdwxmlxpsmnschoicqbvelcnupofjaafr.dll.vir Infected: Trojan-Downloader.Win32.Small.aljf 1
C:\Qoobox\Quarantine\C\Windows\System32\MSIVXirpepxfuqphyqacuqvewbkdxpeceuime.dll.vir Infected: Trojan.Win32.Agent2.cfxs 1

The selected area was scanned.


And thanks to your advice I've also uninstalled uTorrent :)

[TheBruce1]

Hello again

Open notepad and copy/paste the text in the quotebox below:
(don't forget to copy and paste REGEDIT4)

REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]

Save the file as "Fix.reg". Make sure to save it with the quotes. Choose to "Save type as - All Files"
It should look like this:

Double click on the Fix.reg file and choose Yes to merge/add it to the registry. You may delete the file afterwards.

======

If there are no further issues, continue below.

======

Delete DDS from your desktop, you mat keep ATF-Cleaner if you wish...otherwise delete from desktop.

=======

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

========

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.


For Internet Explorer users:
WOT for IE

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

[TheBruce1]

As this topic is resolved, this thread is closed.