Tech Support banner

Status
Not open for further replies.
1 - 9 of 9 Posts

·
Registered
Joined
·
45 Posts
Discussion Starter #1
I have followed your instructions before posting my HJT log file. I have tried to run adaware several times (in safe and non-safe mode). Adaware runs for about thirty seconds, then i get an message regarding a memory issue at 0x011c3b7e and 0x011c537a and then my pc reboots then also.

Logfile of HijackThis v1.99.1
Scan saved at 1:37:19 PM, on 1/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\wuauclt.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\Temporary Directory 13 for hijackthis.zip\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nascar.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = www.msn.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - C:\WINNT\System32\hmgpgyl.dll (file missing)
R3 - URLSearchHook: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - C:\WINNT\system32\fmt.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {7DA39570-5FD2-4f18-94B4-20730CB3F727} - C:\WINNT\system32\tmp10BC.tmp.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - C:\WINNT\System32\hmgpgyl.dll (file missing)
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - C:\WINNT\system32\fmt.dll (file missing)
O2 - BHO: (no name) - {FF019959-D9E4-47FA-84A5-AFE6102984B8} - C:\WINNT\system32\drwh32.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway\Gateway Ink Monitor\GWInkMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lxcimon.exe] "C:\Program Files\Lexmark 7300 Series\lxcimon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7300 Series\ezprint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,[email protected]
O4 - HKLM\..\Run: [NI.UWA6P_0001_N91M1807] "c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe" -nag
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [SSC_UserPrompt] C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [red] C:\WINNT\red.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [Microsoft Virus Updater] guardu.exe
O4 - HKLM\..\Run: [Macfee Security] mpfguard.exe
O4 - HKLM\..\Run: [knfwaofgleybf] C:\WINNT\System32\eqwsndta.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [GaNCsFs] C:\WINNT\bxshveyb.exe
O4 - HKLM\..\Run: [Cxfgfw] C:\Program Files\Iiwup\Vcipdez.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitexmh32.exe
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [Ltho] "C:\WINNT\SEMBLY~1\nopdb.exe" -vt ndrv
O4 - HKCU\..\Run: [Kilautrh] C:\Program Files\Common Files\s?curity\??plorer.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [kzzq] C:\PROGRA~1\COMMON~1\kzzq\kzzqm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\System32\msjava.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139962763806
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161483723781
O16 - DPF: {737D14F8-4090-11D4-AE0E-0010830243BD} (SysVerChk Control) - file://F:\Program\SysVerChk.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://F:\Program\AcDcToday.ocx
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://F:\Program\InstBanr.ocx
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://F:\Program\InstFred.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/heavyweapon/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://F:\Program\AcPreview.ocx
O20 - AppInit_DLLs:
O20 - Winlogon Notify: drwh32 - C:\WINNT\SYSTEM32\drwh32.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxci_device - - C:\WINNT\System32\lxcicoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
 

·
Security Manager, Analyst , Rangemaster, TSF Acade
Joined
·
39,538 Posts
Hi and welcome to the Security Forum.

My name is Iain and I will be helping you clean your system.

You may wish to Subscribe to this thread (Thread Tools > Subscribe to this thread) so that you are notified when you receive a reply.

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.

Note that the fix may take several posts. Please continue to respond to my instructions until I confirm that your system is clean.

If there is anything you don't understand, please ask BEFORE proceeding with the fixes.

Please ensure that you follow the instructions in the order I have them listed.


HijackThis in Temp Folder
You are running HijackThis from a temporary directory. It needs to be in a permanent folder. Please go into Windows Explorer, click on C:\ then click on File > New > Folder and call it HJT , or another name of your choice and move the HJT files to this folder. The program creates backup files that we may need to use later. If the program is in a Temporary folder, files may be deleted by you or automatically if your system is set to empty temp files.



Show Hidden Files
Go to My Computer > Tools > Folder Options > View tab and make sure that Show hidden files and folders is enabled. Also make sure that the System files and Folders are showing / visible. Uncheck the Hide protected operating system files option.



Downloads
Please download Cleanup! or use this Alternate Link if the main link does not work and install it. You will use this later.
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!


Download AVG Anti Spyware

Use the link at the bottom of the page under "AVG Anti-Spyware Free for Windows"



  • Install AVG Anti Spyware
  • Double-click the icon on Desktop to launch AVG
  • On the top of the main screen click Shield
  • Click the word active to change it to inactive
  • On the top of the main screen click Update.
  • Then click on Start Update. The update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
  • Under "Reports"
    • Select "Automatically generate report after every scan"
    • Un-Select "Only if threats were found"
When you have finished updating, EXIT AVG Anti Spyware.


Please download the ISTBar removal tool from Symantec into it's own folder. Do not run it yet.



Download this file - combofix.exe to your desktop.

IMPORTANT - You must place combofix on your desktop!!


Run Combofix



Click the Windows 'Start' button > Select Run - then copy and paste the red line of text below into the run box & click OK

"%userprofile%\desktop\combofix.exe" /v tmp10BC.tmp drwh32

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Disable SpyBot Tea Timer
While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent HijackThis from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your HijackThis log is clean.
  • Open Spybot Search & Destroy.
  • In the Mode menu click "Advanced mode" if not already selected.
  • Choose "Yes" at the Warning prompt.
  • Expand the "Tools" menu.
  • Click "Resident".
  • Uncheck the "Resident "TeaTimer" (Protection of overall system settings) active." box.
  • In the File menu click "Exit" to exit Spybot Search & Destroy.



Reboot
Reboot your system in Safe Mode.
  • Restart the computer. The computer begins processing a set of instructions known as BIOS.
  • After hearing your computer beep once during startup, but before the Windows icon appears, press F8 (dependent on your system this may be F5 or another key)
  • Instead of Windows loading as normal, a menu should appear
  • Use the arrow key to highlight Safe Mode and press Enter.


Uninstall Programmes
Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs (if present):

winantiviruspro2006
Windows Control Ad or Windupdates
WildTangent
WebRebates
Internet Optimizer
Bullseye Network
Admilli Service
WeatherBug





HijackThis Entries
Open Hijack This and click on Scan. Check the following entries (if they still exist) (make sure you do not miss any)

R3 - URLSearchHook: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - C:\WINNT\System32\hmgpgyl.dll (file missing)
R3 - URLSearchHook: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - C:\WINNT\system32\fmt.dll (file missing)
O2 - BHO: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - C:\WINNT\System32\hmgpgyl.dll (file missing)
O2 - BHO: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - C:\WINNT\system32\fmt.dll (file missing)
O4 - HKLM\..\Run: [NI.UWA6P_0001_N91M1807] "c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe" -nag
O4 - HKLM\..\Run: [Windows ControlAd] C:\Program Files\Windows ControlAd\WinCtlAd.exe
O4 - HKLM\..\Run: [WildTangent CDA] RUNDLL32.exe "C:\Program Files\WildTangent\Apps\CDA\cdaEngine0400.dll",cdaEngineMain
O4 - HKLM\..\Run: [WebRebates0] "C:\Program Files\Web_Rebates\WebRebates0.exe"
O4 - HKLM\..\Run: [salm] c:\temp\salm.exe
O4 - HKLM\..\Run: [red] C:\WINNT\red.exe
O4 - HKLM\..\Run: [Microsoft Virus Updater] guardu.exe
O4 - HKLM\..\Run: [Macfee Security] mpfguard.exe
O4 - HKLM\..\Run: [knfwaofgleybf] C:\WINNT\System32\eqwsndta.exe
O4 - HKLM\..\Run: [IST Service] C:\Program Files\ISTsvc\istsvc.exe
O4 - HKLM\..\Run: [Internet Optimizer] "C:\Program Files\Internet Optimizer\optimize.exe"
O4 - HKLM\..\Run: [GaNCsFs] C:\WINNT\bxshveyb.exe
O4 - HKLM\..\Run: [Cxfgfw] C:\Program Files\Iiwup\Vcipdez.exe
O4 - HKLM\..\Run: [BullsEye Network] C:\Program Files\BullsEye Network\bin\bargains.exe
O4 - HKLM\..\Run: [antiware] C:\winnt\system32\elitexmh32.exe
O4 - HKLM\..\Run: [Admilli Service] C:\Program Files\Admilli Service\AdmilliServ.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Ltho] "C:\WINNT\SEMBLY~1\nopdb.exe" -vt ndrv
O4 - HKCU\..\Run: [Kilautrh] C:\Program Files\Common Files\s?curity\??plorer.exe
O4 - HKCU\..\Run: [kzzq] C:\PROGRA~1\COMMON~1\kzzq\kzzqm.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://F:\Program\InstBanr.ocx
O20 - AppInit_DLLs:
O20 - Winlogon Notify: drwh32 - C:\WINNT\SYSTEM32\drwh32.dll


Please remember to close all other windows, including browsers then click Fix checked.



File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe
C:\Program Files\Windows ControlAd
C:\Program Files\WildTangent\Apps
C:\Program Files\Web_Rebates
C:\WINNT\red.exe
guardu.exe <- - Go to Start > Search to find this file
mpfguard.exe <- - Go to Start > Search to find this file
C:\WINNT\System32\eqwsndta.exe
C:\Program Files\Internet Optimizer
C:\WINNT\bxshveyb.exe
C:\Program Files\Iiwup
C:\Program Files\BullsEye Network
C:\winnt\system32\elitexmh32.exe
C:\Program Files\Admilli Service
C:\PROGRAM FILES\AWS
C:\PROGRAM FILES\COMMON FILES\kzzq



ISTBar Tool
Run the ISTBar removal Tool.




Run CleanUp!
*NOTE* Cleanup deletes EVERYTHING out of temporary folders and does NOT make backups. If you have any files in any TEMP directory and you need to keep them, then please MOVE THEM NOW!

Open Cleanup! by double-clicking the icon on your desktop (or from Start > All Programs). Set the program up as follows:

Click Options
Move the slider button down to Custom CleanUp!
Check the following:
  • Empty Recycle Bins
  • Delete Cookies
  • Delete Prefetch files
  • Cleanup! All Users
  • Click on the “Temporary Files” tab and uncheck the box for “Scan drives for file matching” if it’s checked.
Click OK, Press the CleanUp! button to start the program and DO NOT REBOOT when prompted.
Note: CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these BEFORE running CleanUp! If you have a 64 bit Operating System do NOT run Cleanup and let me know as we will use another utility.




Run AVG Anti Spyware
Run AVG with it's updated definitions:(...it's important that all windows must be closed)
  • Click Scanner
  • Click on the Scan tab
  • Click Complete System Scan to begin scanning.
  • When the scan is complete click Recommended Action and change it to Quarantine
  • Then click Apply all actions
Once finished, click the Save report button, then click Save Report As and save it to your desktop.

NOTE: AVG scan may require an hour.



Reboot
Reboot your system in Normal Mode.



Online Scan
Perform an online scan with Internet Explorer with Panda ActiveScan
  1. Click on
    located at the bottom of the page.
  2. A "pop up" window will appear. * Please ensure that your pop up blocker doesn't block it *
  3. Enter your e-mail address, country, and state & click "Free Online Scan" *The download of the 8 MB Panda's ActiveX control will take place*
Begin the scan by selecting

  • If it finds any malware, it will offer you a report.
  • Please ignore any entry it finds and the offer to buy the program to remove the entry, as we will address this later.
  • Click on
    then click
* You needn't remain online while it's doing the scan but you have to re-connect after it has finished to see the report.
* Turn off the real time scanner of any existing antivirus program while performing the online scan




Logs required
c:\combofix.txt
AVG Log
Panda Log
HijackThis Log


Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.
 

·
Registered
Joined
·
45 Posts
Discussion Starter #3
Has not rebooted on its own, and pop ups have been reduced to almost none!

Here is the combofix log:

"Owner" - 07-01-07 19:31:48 Service Pack 2
ComboFix 07-01-06W-BetaE2 - Running from: "C:\Documents and Settings\Owner\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\DOCUME~1
C:\qoobox\purity\DOCUME~1\Owner
C:\qoobox\purity\DOCUME~1\Owner\My Documents
C:\qoobox\purity\DOCUME~1\Owner\My Documents\from.txt
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MANTEC~1
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MCROSO~1
C:\qoobox\purity\Program Files\MBOLS~1
C:\qoobox\purity\Program Files\RACLE~1
C:\qoobox\purity\Program Files\Common Files\FNTS~1
C:\qoobox\purity\Program Files\Common Files\SCURIT~1
C:\qoobox\purity\WINNT\SEMBLY~1
C:\qoobox\purity\WINNT\SEMBLY~1\bak
C:\qoobox\purity\WINNT\SEMBLY~1\SEMBLY~1
C:\qoobox\purity\WINNT\system32\STEM~1


((((((((((((((((((((((((((((((( Files Created from 2006-12-07 to 2007-01-07 ))))))))))))))))))))))))))))))))))


2007-01-05 19:39 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-01-05 19:39 <DIR> d-------- C:\Program Files\Grisoft
2007-01-05 19:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Avg7
2007-01-05 18:51 <DIR> d-------- C:\HiJackThis
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\MSN6
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\MSN6
2007-01-03 10:12 <DIR> d-------- C:\WINNT\system32\ActiveScan
2007-01-03 09:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NAS\Application Data\Lavasoft
2007-01-02 20:57 73,728 --------- C:\WINNT\system32\MMAviAx.dll
2007-01-02 20:57 41,472 --------- C:\WINNT\system32\CacheX.dll
2007-01-02 20:57 32,768 --------- C:\WINNT\system32\MLPagAx.dll
2007-01-02 20:57 204,881 --------- C:\WINNT\system32\DiskIO.dll
2007-01-02 20:57 171,008 --a------ C:\WINNT\system32\drivers\MarvinBus.sys
2007-01-02 20:57 155,721 --------- C:\WINNT\system32\RALMain.dll
2007-01-02 20:57 126,976 --------- C:\WINNT\system32\AVIPrAx.dll
2007-01-02 20:56 406,016 --------- C:\WINNT\system32\PSDrvCheck.exe
2007-01-02 20:56 19,456 --------- C:\WINNT\system32\asapi.dll
2007-01-02 20:56 11,264 --------- C:\WINNT\system32\drivers\asapiW2k.sys
2007-01-02 20:55 930,992 --------- C:\WINNT\system32\Ltr13n.dll
2007-01-02 20:55 884,736 --------- C:\WINNT\system32\LMUIRes.dll
2007-01-02 20:55 80,896 --------- C:\WINNT\system32\lfwmf13s.dll
2007-01-02 20:55 76,800 --------- C:\WINNT\system32\Lfwmf13n.dll
2007-01-02 20:55 73,728 --------- C:\WINNT\system32\lffax13n.dll
2007-01-02 20:55 70,144 --------- C:\WINNT\system32\lfbmp13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\lfpcx13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\Lfpct13n.dll
2007-01-02 20:55 64,512 --------- C:\WINNT\system32\lftga13s.dll
2007-01-02 20:55 59,904 --------- C:\WINNT\system32\lfpcd13s.dll
2007-01-02 20:55 57,856 --------- C:\WINNT\system32\MASD32.DLL
2007-01-02 20:55 453,120 --------- C:\WINNT\system32\ltkrn13n.dll
2007-01-02 20:55 409,600 --------- C:\WINNT\system32\LFCMP13s.DLL
2007-01-02 20:55 393,216 --------- C:\WINNT\system32\LFCMP13n.DLL
2007-01-02 20:55 306,352 --------- C:\WINNT\system32\Ltrio13n.dll
2007-01-02 20:55 30,208 --------- C:\WINNT\system32\lfbmp13n.dll
2007-01-02 20:55 283,648 --------- C:\WINNT\system32\LFJ2K13s.dll
2007-01-02 20:55 278,016 --------- C:\WINNT\system32\LFJ2K13n.dll
2007-01-02 20:55 27,648 --------- C:\WINNT\system32\MA32.DLL
2007-01-02 20:55 24,576 --------- C:\WINNT\system32\lftga13n.dll
2007-01-02 20:55 2,079,232 --------- C:\WINNT\system32\LTCLR13s.dll
2007-01-02 20:55 196,096 --------- C:\WINNT\system32\MACD32.DLL
2007-01-02 20:55 167,936 --------- C:\WINNT\system32\lftif13s.dll
2007-01-02 20:55 153,088 --------- C:\WINNT\system32\ltfil13n.DLL
2007-01-02 20:55 143,360 --------- C:\WINNT\system32\lftif13n.dll
2007-01-02 20:55 138,752 --------- C:\WINNT\system32\MASE32.DLL
2007-01-02 20:55 136,192 --------- C:\WINNT\system32\MAMC32.DLL
2007-01-02 20:55 12,288 --------- C:\WINNT\system32\LMLRes.dll
2007-01-02 20:55 116,224 --------- C:\WINNT\system32\lffax13s.dll
2007-01-02 20:55 110,080 --------- C:\WINNT\system32\lfpsd13s.dll
2007-01-02 20:55 105,984 --------- C:\WINNT\system32\lfpct13s.dll
2007-01-02 20:55 1,693,696 --------- C:\WINNT\system32\LTCLR13n.dll
2007-01-02 20:55 1,013,248 --------- C:\WINNT\system32\Ltwvc13n.dll
2007-01-02 20:39 <DIR> d-------- C:\Program Files\Pinnacle
2007-01-01 12:19 <DIR> d-------- C:\ATI
2006-12-31 23:25 <DIR> d-------- C:\Program Files\proDAD
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-SAL
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-GfxDatas
2006-12-31 23:00 <DIR> d-------- C:\Program Files\SmartSound Software(2)
2006-12-31 23:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\SmartSound Software Inc(2)
2006-12-31 22:51 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\InstallShield Installation Information
2006-12-31 20:17 <DIR> d-------- C:\Program Files\DivX
2006-12-31 18:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle Studio
2006-12-31 17:54 <DIR> d-------- C:\Program Files\Pinnacle(2)
2006-12-31 17:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle
2006-12-29 17:25 105,099 --a------ C:\WINNT\cbyvvs.dll
2006-12-26 10:37 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-26 10:35 <DIR> d-------- C:\WINNT\system32\drivers\UMDF
2006-12-25 12:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Google
2006-12-25 12:12 <DIR> d-------- C:\Program Files\Picasa2
2006-12-25 12:09 <DIR> d-------- C:\Program Files\Western Digital Technologies
2006-12-25 08:48 <DIR> d-------- C:\Program Files\GameSpy
2006-12-25 08:36 <DIR> d-------- C:\Program Files\Electronic Arts
2006-12-15 16:25 36,646 --a------ C:\WINNT\system32\tmpD8.tmp.dll


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-06 20:19 -------- d-------- C:\Program Files\norton internet security
2007-01-06 20:19 -------- d-------- C:\Program Files\msn messenger
2007-01-06 20:01 -------- d-------- C:\Program Files\messenger
2007-01-06 20:00 -------- d-------- C:\Program Files\lexmark 7300 series
2007-01-06 19:58 -------- d-------- C:\Program Files\google
2007-01-06 19:55 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-01-05 19:56 -------- d-------- C:\Program Files\lx_cats
2007-01-03 20:23 -------- d-------- C:\Program Files\rr-track v4
2007-01-03 09:17 -------- d-------- C:\Program Files\abbyy finereader 6.0 sprint
2007-01-02 19:51 -------- d-------- C:\DOCUME~1\Owner\Application Data\adobe
2007-01-02 19:50 -------- d-------- C:\Program Files\Common Files\adobe
2007-01-01 20:23 -------- d--h----- C:\Program Files\installshield installation information
2007-01-01 20:19 -------- d-------- C:\Program Files\ati technologies
2006-12-31 22:58 134 --a------ C:\AUTOEXEC.BAT
2006-12-28 21:36 -------- d-------- C:\DOCUME~1\Owner\Application Data\google
2006-12-23 15:50 -------- d-------- C:\DOCUME~1\Owner\Application Data\xfire
2006-12-16 21:26 11376 --a------ C:\WINNT\system32\drivers\secdrv.sys
2006-11-23 19:16 -------- d-------- C:\Program Files\lavasoft
2006-11-23 19:16 -------- d-------- C:\DOCUME~1\Owner\Application Data\lavasoft
2006-11-20 19:04 -------- d-------- C:\Program Files\olympus
2006-11-07 23:06 679424 --a------ C:\WINNT\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINNT\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINNT\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINNT\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINNT\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINNT\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINNT\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINNT\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINNT\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINNT\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINNT\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINNT\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINNT\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINNT\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINNT\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINNT\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINNT\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINNT\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINNT\system32\msxml4.dll
2006-10-19 07:56 713216 --a------ C:\WINNT\system32\sxs.dll
2006-10-18 21:58 8704 --------- C:\WINNT\system32\wdfmgr.exe
2006-10-18 21:58 8704 --------- C:\WINNT\system32\uwdf.exe
2006-10-18 21:47 99840 --a------ C:\WINNT\system32\wmpshell.dll
2006-10-18 21:47 991744 --a------ C:\WINNT\system32\drmv2clt.dll
2006-10-18 21:47 937984 --a------ C:\WINNT\system32\wmnetmgr.dll
2006-10-18 21:47 8231936 --a------ C:\WINNT\system32\wmploc.dll
2006-10-18 21:47 767488 --------- C:\WINNT\system32\wmvsencd.dll
2006-10-18 21:47 757248 --a------ C:\WINNT\system32\wmadmod.dll
2006-10-18 21:47 7168 --a------ C:\WINNT\system32\asferror.dll
2006-10-18 21:47 656896 --------- C:\WINNT\system32\wmvxencd.dll
2006-10-18 21:47 63488 --------- C:\WINNT\system32\wpdmtpus.dll
2006-10-18 21:47 629760 --------- C:\WINNT\system32\wpd_ci.dll
2006-10-18 21:47 613376 --------- C:\WINNT\system32\wmpmde.dll
2006-10-18 21:47 603648 --a------ C:\WINNT\system32\wmspdmod.dll
2006-10-18 21:47 542720 --a------ C:\WINNT\system32\blackbox.dll
2006-10-18 21:47 535040 --------- C:\WINNT\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 --------- C:\WINNT\system32\wmdrmdev.dll
2006-10-18 21:47 414208 --a------ C:\WINNT\system32\msscp.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mpg4dmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp4sdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp43dmod.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadve.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadvd.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wdfapi.dll
2006-10-18 21:47 38400 --------- C:\WINNT\system32\wpdshextres.dll
2006-10-18 21:47 37376 --a------ C:\WINNT\system32\wmdmps.dll
2006-10-18 21:47 35840 --------- C:\WINNT\system32\wpdconns.dll
2006-10-18 21:47 356352 --------- C:\WINNT\system32\wpdsp.dll
2006-10-18 21:47 348672 --------- C:\WINNT\system32\wmdrmnet.dll
2006-10-18 21:47 33792 --a------ C:\WINNT\system32\wmdmlog.dll
2006-10-18 21:47 321536 --a------ C:\WINNT\system32\mswmdm.dll
2006-10-18 21:47 317440 --------- C:\WINNT\system32\mp4sdecd.dll
2006-10-18 21:47 314880 --a------ C:\WINNT\system32\wmpdxm.dll
2006-10-18 21:47 295936 --------- C:\WINNT\system32\wmpeffects.dll
2006-10-18 21:47 284160 --------- C:\WINNT\system32\portabledeviceapi.dll
2006-10-18 21:47 276992 --------- C:\WINNT\system32\audiodev.dll
2006-10-18 21:47 27136 --a------ C:\WINNT\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 --------- C:\WINNT\system32\wpdshext.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mpg4decd.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mp43decd.dll
2006-10-18 21:47 2450944 --a------ C:\WINNT\system32\wmvcore.dll
2006-10-18 21:47 242688 --a------ C:\WINNT\system32\wmpasf.dll
2006-10-18 21:47 229376 --a------ C:\WINNT\system32\cewmdm.dll
2006-10-18 21:47 227328 --a------ C:\WINNT\system32\wmerror.dll
2006-10-18 21:47 222208 --a------ C:\WINNT\system32\wmasf.dll
2006-10-18 21:47 212992 --------- C:\WINNT\system32\mfplat.dll
2006-10-18 21:47 211456 --a------ C:\WINNT\system32\qasf.dll
2006-10-18 21:47 204288 --------- C:\WINNT\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 --------- C:\WINNT\system32\portabledevicewmdrm.dll
2006-10-18 21:47 179712 --a------ C:\WINNT\system32\msnetobj.dll
2006-10-18 21:47 175616 --a------ C:\WINNT\system32\mspmsp.dll
2006-10-18 21:47 166912 --------- C:\WINNT\system32\portabledevicetypes.dll
2006-10-18 21:47 1661440 --------- C:\WINNT\system32\wmpencen.dll
2006-10-18 21:47 1574912 --------- C:\WINNT\system32\wmvencod.dll
2006-10-18 21:47 157184 --a------ C:\WINNT\system32\wmidx.dll
2006-10-18 21:47 154624 --------- C:\WINNT\system32\wpdmtp.dll
2006-10-18 21:47 1543680 --------- C:\WINNT\system32\wmvdecod.dll
2006-10-18 21:47 1382912 --------- C:\WINNT\system32\wmvsdecd.dll
2006-10-18 21:47 133632 --------- C:\WINNT\system32\wpdshserviceobj.dll
2006-10-18 21:47 1329152 --a------ C:\WINNT\system32\wmspdmoe.dll
2006-10-18 21:47 132096 --------- C:\WINNT\system32\portabledevicewiacompat.dll
2006-10-18 21:47 130048 --------- C:\WINNT\system32\wmpps.dll
2006-10-18 21:47 11264 --a------ C:\WINNT\system32\laprxy.dll
2006-10-18 21:47 1117696 --a------ C:\WINNT\system32\wmadmoe.dll
2006-10-18 21:47 101888 --------- C:\WINNT\system32\portabledeviceclassextension.dll
2006-10-18 20:03 100864 --a------ C:\WINNT\system32\logagent.exe
2006-10-18 20:00 249856 --------- C:\WINNT\system32\drmupgds.exe
2006-10-18 20:00 17408 --------- C:\WINNT\system32\wpdshextautoplay.exe
2006-10-17 12:06 78336 --a------ C:\WINNT\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINNT\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINNT\system32\winfxdocobj.exe
2006-10-17 12:05 105984 --a------ C:\WINNT\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINNT\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINNT\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINNT\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINNT\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINNT\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINNT\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINNT\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINNT\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINNT\system32\ieapfltr.dll
2006-10-13 06:35 142336 --a------ C:\WINNT\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Weather"="C:\\PROGRA~1\\AWS\\WEATHE~1\\Weather.exe 1"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
@=""
"ATI Launchpad"=""
"ATI Remote Control"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe"
"Ltho"="\"C:\\WINNT\\SEMBLY~1\\nopdb.exe\" -vt ndrv"
"Kilautrh"="C:\\Program Files\\Common Files\\s?curity\\??plorer.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\mnyexpr.exe\""
"kzzq"="C:\\PROGRA~1\\COMMON~1\\kzzq\\kzzqm.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Gateway Ink Monitor"="\"C:\\Program Files\\Gateway\\Gateway Ink Monitor\\GWInkMonitor.exe\""
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"BJCFD"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
@=""
"ATI DeviceDetect"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"lxcimon.exe"="\"C:\\Program Files\\Lexmark 7300 Series\\lxcimon.exe\""
"EzPrint"="\"C:\\Program Files\\Lexmark 7300 Series\\ezprint.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"LXCICATS"="rundll32 C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCItime.dll,[email protected]"
"NI.UWA6P_0001_N91M1807"="\"c:\\documents and settings\\owner\\application data\\winantiviruspro2006freeinstall[1].exe\" -nag "
"PinnacleDriverCheck"="C:\\WINNT\\system32\\PSDrvCheck.exe -CheckReg"
"PCLEUSBTip"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\USBTip\\USBTip.exe"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"IS CfgWiz"="C:\\Program Files\\Norton Internet Security\\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE \"REBOOT\""
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Norton AntiVirus - Scan my computer - Owner.job

Completion time: 07-01-07 19:36:04
C:\ComboFix2.txt ... 07-01-05 19:53

HiJack This Log:
Logfile of HijackThis v1.99.1
Scan saved at 7:55:05 PM, on 1/7/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\Program Files\internet explorer\iexplore.exe
C:\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
R3 - URLSearchHook: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - (no file)
R3 - URLSearchHook: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway\Gateway Ink Monitor\GWInkMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lxcimon.exe] "C:\Program Files\Lexmark 7300 Series\lxcimon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7300 Series\ezprint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,[email protected]
O4 - HKLM\..\Run: [NI.UWA6P_0001_N91M1807] "c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe" -nag
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [Ltho] "C:\WINNT\SEMBLY~1\nopdb.exe" -vt ndrv
O4 - HKCU\..\Run: [Kilautrh] C:\Program Files\Common Files\s?curity\??plorer.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [kzzq] C:\PROGRA~1\COMMON~1\kzzq\kzzqm.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139962763806
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161483723781
O16 - DPF: {737D14F8-4090-11D4-AE0E-0010830243BD} (SysVerChk Control) - file://F:\Program\SysVerChk.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://F:\Program\AcDcToday.ocx
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://F:\Program\InstFred.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/heavyweapon/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://F:\Program\AcPreview.ocx
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxci_device - - C:\WINNT\System32\lxcicoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)

ActiveScan log:

Incident Status Location

Potentially unwanted tool:Application/Service9x Not disinfected C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCItime.dll
Adware:adware/ieplugin Not disinfected c:\winnt\kwv2.dat
Adware:adware/mediatickets Not disinfected c:\winnt\re12.reg
Potentially unwanted tool:application/regclean32 Not disinfected C:\Documents and Settings\Owner\Desktop\Click to Find and Fix Errors.url
Adware:adware/searchrelevancy Not disinfected c:\program files\SearchRelevant
Adware:adware/winad Not disinfected c:\program files\Winad Client
Adware:adware/exact.bargainbuddy Not disinfected Windows Registry
Adware:adware/elitebar Not disinfected Windows Registry
Adware:adware/ncase Not disinfected Windows Registry
Adware:adware/ist.istbar Not disinfected Windows Registry
Potentially unwanted tool:Application/Service9x Not disinfected C:\Program Files\Lexmark 7300 Series\Drivers\I386\lxcitime.dll[C:\Program Files\Lexmark 7300 Series\Drivers\I386\lxcitime.dll]
Adware:Adware/PurityScan Not disinfected C:\WINNT\cbyvvs.dll
Potentially unwanted tool:Application/Service9x Not disinfected C:\WINNT\system32\spool\drivers\w32x86\lexmark_7300_seriesce0d\lxcitime.dll
Adware:Adware/MediaTickets


AVG Log:

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 9:29:40 PM 1/7/2007

+ Scan result:



C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP232\A0018649.exe -> Adware.MediaTickets : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP232\A0018648.dll -> Adware.Relevance : Cleaned with backup (quarantined).
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.
C:\Documents and Settings\Owner\Cookies\[email protected][1].txt -> TrackingCookie.Questionmarket : Cleaned.
C:\System Volume Information\_restore{7DCA1BE4-D752-48D6-A25E-C722C8FD1BC4}\RP232\A0018647.bat -> Trojan.Zapchast : Cleaned with backup (quarantined).


::Report end
 

·
Security Manager, Analyst , Rangemaster, TSF Acade
Joined
·
39,538 Posts
Hi again

Please read these instructions carefully and then print out or copy this page to Notepad in order to assist you when carrying out the fix. You should not have any open browsers or live internet connections when you are following the procedures below.


Did you uninstall WeatherBug?


Open HijackThis and run a scan – check the following entries:

R3 - URLSearchHook: (no name) - {B66A1D06-AEEB-8C37-E41A-8B7A94960EE2} - (no file)
R3 - URLSearchHook: (no name) - {EF7A51CB-B025-C0FE-2A96-C39E8A175FB8} - (no file)
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O4 - HKCU\..\Run: [Ltho] "C:\WINNT\SEMBLY~1\nopdb.exe" -vt ndrv
O4 - HKCU\..\Run: [Kilautrh] C:\Program Files\Common Files\s?curity\??plorer.exe
O4 - HKCU\..\Run: [kzzq] C:\PROGRA~1\COMMON~1\kzzq\kzzqm.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)


Please remember to close all other windows, including browsers then click Fix checked.


File Deletions
Delete the following Files indicated in RED and Folders indicated in BLUE if they still exist.

c:\winnt\kwv2.dat
c:\winnt\re12.reg
c:\program files\SearchRelevant
c:\program files\Winad Client
C:\WINNT\cbyvvs.dll
C:\PROGRAM FILES\COMMON FILES\kzzq



Run Combofix



Click the Windows 'Start' button > Select Run - then copy and paste the red line of text below into the run box & click OK

"%userprofile%\desktop\combofix.exe" /v tmpD8.tmp

When finished, the tool will produce a log for you at c:\combofix.txt. Post that log in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Online Scan
Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky WebScanner

Next Click on Kaspersky Online Scanner


A Welcome screen will appear - click 'Accept' at the bottom. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
  • Extended
Scan Options:
  • Scan Archives
  • Scan Mail Bases
Click OK

Now under select a target to scan: Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post.
Take note of the name(s) and location(s) of any file(s) it detects but fails to clean.

* Turn off the real time scanner of any existing antivirus program while performing the online scan



Logs required
c:\combofix.txt
Kaspersky Log
HijackThis Log


Please also let me know how your system is performing now and if you have any specific problems. In order to provide you with the best possible help, please ensure that HijackThis logs are produced only while in Normal Mode.
 

·
Registered
Joined
·
45 Posts
Discussion Starter #5
Could not get Kaspersky WebScanner to run. I clicked to allow the active x to install and nothing happend.

Here are the combofix and hijack this log files:

"Owner" - 07-01-08 20:51:24 Service Pack 2
ComboFix 07-01-06W-BetaE2 - Running from: "C:\Documents and Settings\Owner\desktop"
Command switches used :: /v tmpD8.tmp

(((((((((((((((((((((((((((((((((((((((((((((((( Vundo Log )))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINNT\system32\tmpD8.tmp.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\DOCUME~1
C:\qoobox\purity\DOCUME~1\Owner
C:\qoobox\purity\DOCUME~1\Owner\My Documents
C:\qoobox\purity\DOCUME~1\Owner\My Documents\from.txt
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MANTEC~1
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MCROSO~1
C:\qoobox\purity\Program Files\MBOLS~1
C:\qoobox\purity\Program Files\RACLE~1
C:\qoobox\purity\Program Files\Common Files\FNTS~1
C:\qoobox\purity\Program Files\Common Files\SCURIT~1
C:\qoobox\purity\WINNT\SEMBLY~1
C:\qoobox\purity\WINNT\SEMBLY~1\bak
C:\qoobox\purity\WINNT\SEMBLY~1\SEMBLY~1
C:\qoobox\purity\WINNT\system32\STEM~1


((((((((((((((((((((((((((((((( Files Created from 2006-12-08 to 2007-01-08 ))))))))))))))))))))))))))))))))))


2007-01-05 19:39 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-01-05 19:39 <DIR> d-------- C:\Program Files\Grisoft
2007-01-05 19:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Avg7
2007-01-05 18:51 <DIR> d-------- C:\HiJackThis
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\MSN6
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\MSN6
2007-01-03 10:12 <DIR> d-------- C:\WINNT\system32\ActiveScan
2007-01-03 09:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NAS\Application Data\Lavasoft
2007-01-02 20:57 73,728 --------- C:\WINNT\system32\MMAviAx.dll
2007-01-02 20:57 41,472 --------- C:\WINNT\system32\CacheX.dll
2007-01-02 20:57 32,768 --------- C:\WINNT\system32\MLPagAx.dll
2007-01-02 20:57 204,881 --------- C:\WINNT\system32\DiskIO.dll
2007-01-02 20:57 171,008 --a------ C:\WINNT\system32\drivers\MarvinBus.sys
2007-01-02 20:57 155,721 --------- C:\WINNT\system32\RALMain.dll
2007-01-02 20:57 126,976 --------- C:\WINNT\system32\AVIPrAx.dll
2007-01-02 20:56 406,016 --------- C:\WINNT\system32\PSDrvCheck.exe
2007-01-02 20:56 19,456 --------- C:\WINNT\system32\asapi.dll
2007-01-02 20:56 11,264 --------- C:\WINNT\system32\drivers\asapiW2k.sys
2007-01-02 20:55 930,992 --------- C:\WINNT\system32\Ltr13n.dll
2007-01-02 20:55 884,736 --------- C:\WINNT\system32\LMUIRes.dll
2007-01-02 20:55 80,896 --------- C:\WINNT\system32\lfwmf13s.dll
2007-01-02 20:55 76,800 --------- C:\WINNT\system32\Lfwmf13n.dll
2007-01-02 20:55 73,728 --------- C:\WINNT\system32\lffax13n.dll
2007-01-02 20:55 70,144 --------- C:\WINNT\system32\lfbmp13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\lfpcx13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\Lfpct13n.dll
2007-01-02 20:55 64,512 --------- C:\WINNT\system32\lftga13s.dll
2007-01-02 20:55 59,904 --------- C:\WINNT\system32\lfpcd13s.dll
2007-01-02 20:55 57,856 --------- C:\WINNT\system32\MASD32.DLL
2007-01-02 20:55 453,120 --------- C:\WINNT\system32\ltkrn13n.dll
2007-01-02 20:55 409,600 --------- C:\WINNT\system32\LFCMP13s.DLL
2007-01-02 20:55 393,216 --------- C:\WINNT\system32\LFCMP13n.DLL
2007-01-02 20:55 306,352 --------- C:\WINNT\system32\Ltrio13n.dll
2007-01-02 20:55 30,208 --------- C:\WINNT\system32\lfbmp13n.dll
2007-01-02 20:55 283,648 --------- C:\WINNT\system32\LFJ2K13s.dll
2007-01-02 20:55 278,016 --------- C:\WINNT\system32\LFJ2K13n.dll
2007-01-02 20:55 27,648 --------- C:\WINNT\system32\MA32.DLL
2007-01-02 20:55 24,576 --------- C:\WINNT\system32\lftga13n.dll
2007-01-02 20:55 2,079,232 --------- C:\WINNT\system32\LTCLR13s.dll
2007-01-02 20:55 196,096 --------- C:\WINNT\system32\MACD32.DLL
2007-01-02 20:55 167,936 --------- C:\WINNT\system32\lftif13s.dll
2007-01-02 20:55 153,088 --------- C:\WINNT\system32\ltfil13n.DLL
2007-01-02 20:55 143,360 --------- C:\WINNT\system32\lftif13n.dll
2007-01-02 20:55 138,752 --------- C:\WINNT\system32\MASE32.DLL
2007-01-02 20:55 136,192 --------- C:\WINNT\system32\MAMC32.DLL
2007-01-02 20:55 12,288 --------- C:\WINNT\system32\LMLRes.dll
2007-01-02 20:55 116,224 --------- C:\WINNT\system32\lffax13s.dll
2007-01-02 20:55 110,080 --------- C:\WINNT\system32\lfpsd13s.dll
2007-01-02 20:55 105,984 --------- C:\WINNT\system32\lfpct13s.dll
2007-01-02 20:55 1,693,696 --------- C:\WINNT\system32\LTCLR13n.dll
2007-01-02 20:55 1,013,248 --------- C:\WINNT\system32\Ltwvc13n.dll
2007-01-02 20:39 <DIR> d-------- C:\Program Files\Pinnacle
2007-01-01 12:19 <DIR> d-------- C:\ATI
2006-12-31 23:25 <DIR> d-------- C:\Program Files\proDAD
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-SAL
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-GfxDatas
2006-12-31 23:00 <DIR> d-------- C:\Program Files\SmartSound Software(2)
2006-12-31 23:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\SmartSound Software Inc(2)
2006-12-31 22:51 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\InstallShield Installation Information
2006-12-31 20:17 <DIR> d-------- C:\Program Files\DivX
2006-12-31 18:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle Studio
2006-12-31 17:54 <DIR> d-------- C:\Program Files\Pinnacle(2)
2006-12-31 17:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle
2006-12-29 17:25 105,099 --a------ C:\WINNT\cbyvvs.dll
2006-12-26 10:37 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-26 10:35 <DIR> d-------- C:\WINNT\system32\drivers\UMDF
2006-12-25 12:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Google
2006-12-25 12:12 <DIR> d-------- C:\Program Files\Picasa2
2006-12-25 12:09 <DIR> d-------- C:\Program Files\Western Digital Technologies
2006-12-25 08:48 <DIR> d-------- C:\Program Files\GameSpy
2006-12-25 08:36 <DIR> d-------- C:\Program Files\Electronic Arts


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-08 20:01 -------- d-------- C:\Program Files\lx_cats
2007-01-06 20:19 -------- d-------- C:\Program Files\norton internet security
2007-01-06 20:19 -------- d-------- C:\Program Files\msn messenger
2007-01-06 20:01 -------- d-------- C:\Program Files\messenger
2007-01-06 20:00 -------- d-------- C:\Program Files\lexmark 7300 series
2007-01-06 19:58 -------- d-------- C:\Program Files\google
2007-01-06 19:55 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-01-04 23:59 -------- d-------- C:\Documents and Settings\Owner\Application Data\msn6
2007-01-03 20:23 -------- d-------- C:\Program Files\rr-track v4
2007-01-03 09:17 -------- d-------- C:\Program Files\abbyy finereader 6.0 sprint
2007-01-02 19:51 -------- d-------- C:\Documents and Settings\Owner\Application Data\adobe
2007-01-02 19:50 -------- d-------- C:\Program Files\Common Files\adobe
2007-01-01 20:23 -------- d--h----- C:\Program Files\installshield installation information
2007-01-01 20:19 -------- d-------- C:\Program Files\ati technologies
2006-12-31 22:58 134 --a------ C:\AUTOEXEC.BAT
2006-12-31 22:51 -------- d-------- C:\Documents and Settings\Owner\Application Data\installshield installation information
2006-12-28 21:36 -------- d-------- C:\Documents and Settings\Owner\Application Data\google
2006-12-23 15:50 -------- d-------- C:\Documents and Settings\Owner\Application Data\xfire
2006-12-16 21:26 11376 --a------ C:\WINNT\system32\drivers\secdrv.sys
2006-11-23 19:16 -------- d-------- C:\Program Files\lavasoft
2006-11-23 19:16 -------- d-------- C:\Documents and Settings\Owner\Application Data\lavasoft
2006-11-20 19:04 -------- d-------- C:\Program Files\olympus
2006-11-07 23:06 679424 --a------ C:\WINNT\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINNT\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINNT\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINNT\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINNT\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINNT\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINNT\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINNT\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINNT\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINNT\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINNT\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINNT\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINNT\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINNT\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINNT\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINNT\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINNT\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINNT\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINNT\system32\msxml4.dll
2006-10-19 07:56 713216 --a------ C:\WINNT\system32\sxs.dll
2006-10-18 21:58 8704 --------- C:\WINNT\system32\wdfmgr.exe
2006-10-18 21:58 8704 --------- C:\WINNT\system32\uwdf.exe
2006-10-18 21:47 99840 --a------ C:\WINNT\system32\wmpshell.dll
2006-10-18 21:47 991744 --a------ C:\WINNT\system32\drmv2clt.dll
2006-10-18 21:47 937984 --a------ C:\WINNT\system32\wmnetmgr.dll
2006-10-18 21:47 8231936 --a------ C:\WINNT\system32\wmploc.dll
2006-10-18 21:47 767488 --------- C:\WINNT\system32\wmvsencd.dll
2006-10-18 21:47 757248 --a------ C:\WINNT\system32\wmadmod.dll
2006-10-18 21:47 7168 --a------ C:\WINNT\system32\asferror.dll
2006-10-18 21:47 656896 --------- C:\WINNT\system32\wmvxencd.dll
2006-10-18 21:47 63488 --------- C:\WINNT\system32\wpdmtpus.dll
2006-10-18 21:47 629760 --------- C:\WINNT\system32\wpd_ci.dll
2006-10-18 21:47 613376 --------- C:\WINNT\system32\wmpmde.dll
2006-10-18 21:47 603648 --a------ C:\WINNT\system32\wmspdmod.dll
2006-10-18 21:47 542720 --a------ C:\WINNT\system32\blackbox.dll
2006-10-18 21:47 535040 --------- C:\WINNT\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 --------- C:\WINNT\system32\wmdrmdev.dll
2006-10-18 21:47 414208 --a------ C:\WINNT\system32\msscp.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mpg4dmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp4sdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp43dmod.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadve.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadvd.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wdfapi.dll
2006-10-18 21:47 38400 --------- C:\WINNT\system32\wpdshextres.dll
2006-10-18 21:47 37376 --a------ C:\WINNT\system32\wmdmps.dll
2006-10-18 21:47 35840 --------- C:\WINNT\system32\wpdconns.dll
2006-10-18 21:47 356352 --------- C:\WINNT\system32\wpdsp.dll
2006-10-18 21:47 348672 --------- C:\WINNT\system32\wmdrmnet.dll
2006-10-18 21:47 33792 --a------ C:\WINNT\system32\wmdmlog.dll
2006-10-18 21:47 321536 --a------ C:\WINNT\system32\mswmdm.dll
2006-10-18 21:47 317440 --------- C:\WINNT\system32\mp4sdecd.dll
2006-10-18 21:47 314880 --a------ C:\WINNT\system32\wmpdxm.dll
2006-10-18 21:47 295936 --------- C:\WINNT\system32\wmpeffects.dll
2006-10-18 21:47 284160 --------- C:\WINNT\system32\portabledeviceapi.dll
2006-10-18 21:47 276992 --------- C:\WINNT\system32\audiodev.dll
2006-10-18 21:47 27136 --a------ C:\WINNT\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 --------- C:\WINNT\system32\wpdshext.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mpg4decd.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mp43decd.dll
2006-10-18 21:47 2450944 --a------ C:\WINNT\system32\wmvcore.dll
2006-10-18 21:47 242688 --a------ C:\WINNT\system32\wmpasf.dll
2006-10-18 21:47 229376 --a------ C:\WINNT\system32\cewmdm.dll
2006-10-18 21:47 227328 --a------ C:\WINNT\system32\wmerror.dll
2006-10-18 21:47 222208 --a------ C:\WINNT\system32\wmasf.dll
2006-10-18 21:47 212992 --------- C:\WINNT\system32\mfplat.dll
2006-10-18 21:47 211456 --a------ C:\WINNT\system32\qasf.dll
2006-10-18 21:47 204288 --------- C:\WINNT\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 --------- C:\WINNT\system32\portabledevicewmdrm.dll
2006-10-18 21:47 179712 --a------ C:\WINNT\system32\msnetobj.dll
2006-10-18 21:47 175616 --a------ C:\WINNT\system32\mspmsp.dll
2006-10-18 21:47 166912 --------- C:\WINNT\system32\portabledevicetypes.dll
2006-10-18 21:47 1661440 --------- C:\WINNT\system32\wmpencen.dll
2006-10-18 21:47 1574912 --------- C:\WINNT\system32\wmvencod.dll
2006-10-18 21:47 157184 --a------ C:\WINNT\system32\wmidx.dll
2006-10-18 21:47 154624 --------- C:\WINNT\system32\wpdmtp.dll
2006-10-18 21:47 1543680 --------- C:\WINNT\system32\wmvdecod.dll
2006-10-18 21:47 1382912 --------- C:\WINNT\system32\wmvsdecd.dll
2006-10-18 21:47 133632 --------- C:\WINNT\system32\wpdshserviceobj.dll
2006-10-18 21:47 1329152 --a------ C:\WINNT\system32\wmspdmoe.dll
2006-10-18 21:47 132096 --------- C:\WINNT\system32\portabledevicewiacompat.dll
2006-10-18 21:47 130048 --------- C:\WINNT\system32\wmpps.dll
2006-10-18 21:47 11264 --a------ C:\WINNT\system32\laprxy.dll
2006-10-18 21:47 1117696 --a------ C:\WINNT\system32\wmadmoe.dll
2006-10-18 21:47 101888 --------- C:\WINNT\system32\portabledeviceclassextension.dll
2006-10-18 20:03 100864 --a------ C:\WINNT\system32\logagent.exe
2006-10-18 20:00 249856 --------- C:\WINNT\system32\drmupgds.exe
2006-10-18 20:00 17408 --------- C:\WINNT\system32\wpdshextautoplay.exe
2006-10-17 12:06 78336 --a------ C:\WINNT\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINNT\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINNT\system32\winfxdocobj.exe
2006-10-17 12:05 105984 --a------ C:\WINNT\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINNT\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINNT\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINNT\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINNT\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINNT\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINNT\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINNT\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINNT\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINNT\system32\ieapfltr.dll
2006-10-13 06:35 142336 --a------ C:\WINNT\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
@=""
"ATI Launchpad"=""
"ATI Remote Control"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\mnyexpr.exe\""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce]
"FlashPlayerUpdate"="C:\\WINNT\\System32\\Macromed\\Flash\\GetFlash.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Gateway Ink Monitor"="\"C:\\Program Files\\Gateway\\Gateway Ink Monitor\\GWInkMonitor.exe\""
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"BJCFD"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
@=""
"ATI DeviceDetect"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"lxcimon.exe"="\"C:\\Program Files\\Lexmark 7300 Series\\lxcimon.exe\""
"EzPrint"="\"C:\\Program Files\\Lexmark 7300 Series\\ezprint.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"LXCICATS"="rundll32 C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCItime.dll,[email protected]"
"NI.UWA6P_0001_N91M1807"="\"c:\\documents and settings\\owner\\application data\\winantiviruspro2006freeinstall[1].exe\" -nag "
"PinnacleDriverCheck"="C:\\WINNT\\system32\\PSDrvCheck.exe -CheckReg"
"PCLEUSBTip"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\USBTip\\USBTip.exe"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"IS CfgWiz"="C:\\Program Files\\Norton Internet Security\\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE \"REBOOT\""
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰¸u0C:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0Ô@ÔÁß]Ñú"ü‰üžiC:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzî[8C:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files\ISTsvc]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\¢‰¸u0–4·
}ïÁzîžigÝC:\Program Files\ISTsvc\istsvc.exe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="bxshveyb"
"hkey"="HKLM"
"command"="C:\\WINNT\\bxshveyb.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0



Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Norton AntiVirus - Scan my computer - Owner.job

Completion time: 07-01-08 20:55:27
C:\ComboFix2.txt ... 07-01-08 20:45
C:\ComboFix3.txt ... 07-01-07 19:36

HJT log file:
Logfile of HijackThis v1.99.1
Scan saved at 9:20:45 PM, on 1/8/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway\Gateway Ink Monitor\GWInkMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lxcimon.exe] "C:\Program Files\Lexmark 7300 Series\lxcimon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7300 Series\ezprint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,[email protected]
O4 - HKLM\..\Run: [NI.UWA6P_0001_N91M1807] "c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe" -nag
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139962763806
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161483723781
O16 - DPF: {737D14F8-4090-11D4-AE0E-0010830243BD} (SysVerChk Control) - file://F:\Program\SysVerChk.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://F:\Program\AcDcToday.ocx
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://F:\Program\InstFred.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/heavyweapon/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://F:\Program\AcPreview.ocx
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxci_device - - C:\WINNT\System32\lxcicoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
 

·
Security Manager, Analyst , Rangemaster, TSF Acade
Joined
·
39,538 Posts
Hi again

How is your system performing now?


Registry Fix
Click on the zip file attached to this post to open and extract the file biegs.reg to your desktop. Double click on the file biegs.reg to run it. Answer yes to any prompts and allow it to merge into the Registry.


Please choose any one of the following online scanners, run a scan, and post back with any log produced.

http://housecall.trendmicro.com/ <- - you can use Firefox for this scanner
http://www3.ca.com/virusinfo/virusscan.aspx
http://www.bitdefender.com/scan8/ie.html
http://us.mcafee.com/root/mfs/default.asp
http://security.symantec.com/sscv6/d...d=ie&venid=sym



Combofix
Please run combofix again - double click combofix.exe & follow the prompts.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall.



Please post back with c:\combofix.txt, a fresh HijackThis Log and the log, if any, of the online scan.
 

·
Registered
Joined
·
45 Posts
Discussion Starter #7
computer seems to be runnibg fine. Has not rebooted by itself.
Here are the log files.

mcafee:

C:\...\Play Halo Online with Gamespy Arcade.url Adware-Url.gen
C:\Play Halo Custom Edition Online with Gamespy... Adware-Url.gen
C:\...\GameSpy Arcade Help.url Adware-GameSpyArcade.url
C:\...\GameSpy Arcade Website.url Adware-GameSpyArcade.url
C:\...\GameSpy Arcade.lnk Adware-GameSpyArcade.lnk
C:\...\GameSpy.com Gaming's Homepage.url Adware-GameSpyArcade.url
C:\...\Register GameSpy Arcade.url Adware-GameSpyArcade.url
C:\Program Files\BroadJump\...\bak\CFD.exe Adware-BJCFD
C:\Program Files\...\GameSpy Arcade - Debug.lnk Adware-GameSpyArcade.lnk
C:\Program Files\...\GameSpy Arcade Help.url Adware-GameSpyArcade.url
C:\Program Files\...\GameSpy Arcade Website.url Adware-GameSpyArcade.url
C:\Program Files\GameSpy Arcade\GameSpy Arcade.lnk Adware-GameSpyArcade.lnk
C:\...\GameSpy.com Gaming's Homepage.url Adware-GameSpyArcade.url
C:\Program Files\GameSpy Arcade\GSAPak.exe Adware-GameSpyArcade
C:\...\Register GameSpy Arcade.url Adware-GameSpyArcade.url
C:\Program Files\...\_common\PortraitLoader.dll Adware-GameSpyArcade
C:\Program Files\...\GamespyArcade.com.url Adware-Url.gen
C:\WINNT\system32\staff.html Downloader-QG

combofix log:

"Owner" - 07-01-11 22:49:30 Service Pack 2
ComboFix 07-01-06W-BetaE2 - Running from: "C:\Documents and Settings\Owner\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ Purity ~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~
Folders Quarantined:
C:\qoobox\purity\DOCUME~1
C:\qoobox\purity\DOCUME~1\Owner
C:\qoobox\purity\DOCUME~1\Owner\My Documents
C:\qoobox\purity\DOCUME~1\Owner\My Documents\from.txt
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MANTEC~1
C:\qoobox\purity\DOCUME~1\Owner\My Documents\MCROSO~1
C:\qoobox\purity\Program Files\MBOLS~1
C:\qoobox\purity\Program Files\RACLE~1
C:\qoobox\purity\Program Files\Common Files\FNTS~1
C:\qoobox\purity\Program Files\Common Files\SCURIT~1
C:\qoobox\purity\WINNT\SEMBLY~1
C:\qoobox\purity\WINNT\SEMBLY~1\bak
C:\qoobox\purity\WINNT\SEMBLY~1\SEMBLY~1
C:\qoobox\purity\WINNT\system32\STEM~1


((((((((((((((((((((((((((((((( Files Created from 2006-12-11 to 2007-01-11 ))))))))))))))))))))))))))))))))))


2007-01-11 21:00 <DIR> d-------- C:\WINNT\McAfee.com
2007-01-11 17:45 <DIR> d-------- C:\EBay
2007-01-11 03:08 <DIR> d-------- C:\WINNT\LastGood
2007-01-11 03:08 <DIR> d-------- C:\WINNT\ie7updates
2007-01-05 19:39 3,968 --a------ C:\WINNT\system32\drivers\AvgAsCln.sys
2007-01-05 19:39 <DIR> d-------- C:\Program Files\Grisoft
2007-01-05 19:30 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Avg7
2007-01-05 18:51 <DIR> d-------- C:\HiJackThis
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\MSN6
2007-01-04 23:59 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\MSN6
2007-01-03 10:12 <DIR> d-------- C:\WINNT\system32\ActiveScan
2007-01-03 09:35 <DIR> d-------- C:\DOCUME~1\ADMINI~1.NAS\Application Data\Lavasoft
2007-01-02 20:57 73,728 --------- C:\WINNT\system32\MMAviAx.dll
2007-01-02 20:57 41,472 --------- C:\WINNT\system32\CacheX.dll
2007-01-02 20:57 32,768 --------- C:\WINNT\system32\MLPagAx.dll
2007-01-02 20:57 204,881 --------- C:\WINNT\system32\DiskIO.dll
2007-01-02 20:57 171,008 --a------ C:\WINNT\system32\drivers\MarvinBus.sys
2007-01-02 20:57 155,721 --------- C:\WINNT\system32\RALMain.dll
2007-01-02 20:57 126,976 --------- C:\WINNT\system32\AVIPrAx.dll
2007-01-02 20:56 406,016 --------- C:\WINNT\system32\PSDrvCheck.exe
2007-01-02 20:56 19,456 --------- C:\WINNT\system32\asapi.dll
2007-01-02 20:56 11,264 --------- C:\WINNT\system32\drivers\asapiW2k.sys
2007-01-02 20:55 930,992 --------- C:\WINNT\system32\Ltr13n.dll
2007-01-02 20:55 884,736 --------- C:\WINNT\system32\LMUIRes.dll
2007-01-02 20:55 80,896 --------- C:\WINNT\system32\lfwmf13s.dll
2007-01-02 20:55 76,800 --------- C:\WINNT\system32\Lfwmf13n.dll
2007-01-02 20:55 73,728 --------- C:\WINNT\system32\lffax13n.dll
2007-01-02 20:55 70,144 --------- C:\WINNT\system32\lfbmp13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\lfpcx13s.dll
2007-01-02 20:55 65,536 --------- C:\WINNT\system32\Lfpct13n.dll
2007-01-02 20:55 64,512 --------- C:\WINNT\system32\lftga13s.dll
2007-01-02 20:55 59,904 --------- C:\WINNT\system32\lfpcd13s.dll
2007-01-02 20:55 57,856 --------- C:\WINNT\system32\MASD32.DLL
2007-01-02 20:55 453,120 --------- C:\WINNT\system32\ltkrn13n.dll
2007-01-02 20:55 409,600 --------- C:\WINNT\system32\LFCMP13s.DLL
2007-01-02 20:55 393,216 --------- C:\WINNT\system32\LFCMP13n.DLL
2007-01-02 20:55 306,352 --------- C:\WINNT\system32\Ltrio13n.dll
2007-01-02 20:55 30,208 --------- C:\WINNT\system32\lfbmp13n.dll
2007-01-02 20:55 283,648 --------- C:\WINNT\system32\LFJ2K13s.dll
2007-01-02 20:55 278,016 --------- C:\WINNT\system32\LFJ2K13n.dll
2007-01-02 20:55 27,648 --------- C:\WINNT\system32\MA32.DLL
2007-01-02 20:55 24,576 --------- C:\WINNT\system32\lftga13n.dll
2007-01-02 20:55 2,079,232 --------- C:\WINNT\system32\LTCLR13s.dll
2007-01-02 20:55 196,096 --------- C:\WINNT\system32\MACD32.DLL
2007-01-02 20:55 167,936 --------- C:\WINNT\system32\lftif13s.dll
2007-01-02 20:55 153,088 --------- C:\WINNT\system32\ltfil13n.DLL
2007-01-02 20:55 143,360 --------- C:\WINNT\system32\lftif13n.dll
2007-01-02 20:55 138,752 --------- C:\WINNT\system32\MASE32.DLL
2007-01-02 20:55 136,192 --------- C:\WINNT\system32\MAMC32.DLL
2007-01-02 20:55 12,288 --------- C:\WINNT\system32\LMLRes.dll
2007-01-02 20:55 116,224 --------- C:\WINNT\system32\lffax13s.dll
2007-01-02 20:55 110,080 --------- C:\WINNT\system32\lfpsd13s.dll
2007-01-02 20:55 105,984 --------- C:\WINNT\system32\lfpct13s.dll
2007-01-02 20:55 1,693,696 --------- C:\WINNT\system32\LTCLR13n.dll
2007-01-02 20:55 1,013,248 --------- C:\WINNT\system32\Ltwvc13n.dll
2007-01-02 20:39 <DIR> d-------- C:\Program Files\Pinnacle
2007-01-01 12:19 <DIR> d-------- C:\ATI
2006-12-31 23:25 <DIR> d-------- C:\Program Files\proDAD
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-SAL
2006-12-31 23:14 <DIR> d-------- C:\Program Files\AdorageI-GfxDatas
2006-12-31 23:00 <DIR> d-------- C:\Program Files\SmartSound Software(2)
2006-12-31 23:00 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\SmartSound Software Inc(2)
2006-12-31 22:51 <DIR> d-------- C:\DOCUME~1\Owner\Application Data\InstallShield Installation Information
2006-12-31 20:17 <DIR> d-------- C:\Program Files\DivX
2006-12-31 18:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle Studio
2006-12-31 17:54 <DIR> d-------- C:\Program Files\Pinnacle(2)
2006-12-31 17:39 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Pinnacle
2006-12-29 17:25 105,099 --a------ C:\WINNT\cbyvvs.dll
2006-12-26 10:37 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2006-12-26 10:35 <DIR> d-------- C:\WINNT\system32\drivers\UMDF
2006-12-25 12:20 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Google
2006-12-25 12:12 <DIR> d-------- C:\Program Files\Picasa2
2006-12-25 12:09 <DIR> d-------- C:\Program Files\Western Digital Technologies
2006-12-25 08:48 <DIR> d-------- C:\Program Files\GameSpy
2006-12-25 08:36 <DIR> d-------- C:\Program Files\Electronic Arts


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2007-01-11 21:11 -------- d-------- C:\Program Files\mozilla firefox
2007-01-11 20:45 -------- d-------- C:\Program Files\Common Files\symantec shared
2007-01-11 18:27 -------- d-------- C:\Program Files\lx_cats
2007-01-11 17:47 -------- d---s---- C:\DOCUME~1\Owner\Application Data\microsoft
2007-01-09 00:36 -------- d-------- C:\Program Files\norton internet security
2007-01-06 20:19 -------- d-------- C:\Program Files\msn messenger
2007-01-06 20:01 -------- d-------- C:\Program Files\messenger
2007-01-06 20:00 -------- d-------- C:\Program Files\lexmark 7300 series
2007-01-06 19:58 -------- d-------- C:\Program Files\google
2007-01-03 20:23 -------- d-------- C:\Program Files\rr-track v4
2007-01-03 09:17 -------- d-------- C:\Program Files\abbyy finereader 6.0 sprint
2007-01-02 19:51 -------- d-------- C:\DOCUME~1\Owner\Application Data\adobe
2007-01-02 19:50 -------- d-------- C:\Program Files\Common Files\adobe
2007-01-01 20:23 -------- d--h----- C:\Program Files\installshield installation information
2007-01-01 20:19 -------- d-------- C:\Program Files\ati technologies
2006-12-31 22:58 134 --a------ C:\AUTOEXEC.BAT
2006-12-28 21:36 -------- d-------- C:\DOCUME~1\Owner\Application Data\google
2006-12-23 15:50 -------- d-------- C:\DOCUME~1\Owner\Application Data\xfire
2006-12-16 21:26 11376 --a------ C:\WINNT\system32\drivers\secdrv.sys
2006-11-23 19:16 -------- d-------- C:\Program Files\lavasoft
2006-11-23 19:16 -------- d-------- C:\DOCUME~1\Owner\Application Data\lavasoft
2006-11-20 19:04 -------- d-------- C:\Program Files\olympus
2006-11-07 23:06 679424 --a------ C:\WINNT\system32\inetcomm.dll
2006-11-07 21:03 6049280 --------- C:\WINNT\system32\ieframe.dll
2006-11-07 21:03 50688 --------- C:\WINNT\system32\msfeedsbs.dll
2006-11-07 21:03 458752 --------- C:\WINNT\system32\msfeeds.dll
2006-11-07 21:03 413696 --a------ C:\WINNT\system32\vbscript.dll
2006-11-07 21:03 231424 --a------ C:\WINNT\system32\webcheck.dll
2006-11-07 21:03 180736 --------- C:\WINNT\system32\ieui.dll
2006-11-07 21:03 156160 --a------ C:\WINNT\system32\msls31.dll
2006-11-07 03:27 382976 --a------ C:\WINNT\system32\iedkcs32.dll
2006-11-07 03:27 229376 --a------ C:\WINNT\system32\ieaksie.dll
2006-11-07 03:26 71680 --a------ C:\WINNT\system32\admparse.dll
2006-11-07 03:26 55296 --a------ C:\WINNT\system32\iesetup.dll
2006-11-07 03:26 54784 --a------ C:\WINNT\system32\ie4uinit.exe
2006-11-07 03:26 43008 --a------ C:\WINNT\system32\iernonce.dll
2006-11-07 03:26 152064 --a------ C:\WINNT\system32\ieakeng.dll
2006-11-07 03:26 13312 --a------ C:\WINNT\system32\ieudinit.exe
2006-11-07 03:26 123904 --a------ C:\WINNT\system32\advpack.dll
2006-11-07 03:25 161792 --a------ C:\WINNT\system32\ieakui.dll
2006-11-04 14:14 1245696 --a------ C:\WINNT\system32\msxml4.dll
2006-10-19 07:56 713216 --a------ C:\WINNT\system32\sxs.dll
2006-10-18 21:58 8704 --------- C:\WINNT\system32\wdfmgr.exe
2006-10-18 21:58 8704 --------- C:\WINNT\system32\uwdf.exe
2006-10-18 21:47 99840 --a------ C:\WINNT\system32\wmpshell.dll
2006-10-18 21:47 991744 --a------ C:\WINNT\system32\drmv2clt.dll
2006-10-18 21:47 937984 --a------ C:\WINNT\system32\wmnetmgr.dll
2006-10-18 21:47 8231936 --a------ C:\WINNT\system32\wmploc.dll
2006-10-18 21:47 767488 --------- C:\WINNT\system32\wmvsencd.dll
2006-10-18 21:47 757248 --a------ C:\WINNT\system32\wmadmod.dll
2006-10-18 21:47 7168 --a------ C:\WINNT\system32\asferror.dll
2006-10-18 21:47 656896 --------- C:\WINNT\system32\wmvxencd.dll
2006-10-18 21:47 63488 --------- C:\WINNT\system32\wpdmtpus.dll
2006-10-18 21:47 629760 --------- C:\WINNT\system32\wpd_ci.dll
2006-10-18 21:47 613376 --------- C:\WINNT\system32\wmpmde.dll
2006-10-18 21:47 603648 --a------ C:\WINNT\system32\wmspdmod.dll
2006-10-18 21:47 542720 --a------ C:\WINNT\system32\blackbox.dll
2006-10-18 21:47 535040 --------- C:\WINNT\system32\wmdrmsdk.dll
2006-10-18 21:47 429056 --------- C:\WINNT\system32\wmdrmdev.dll
2006-10-18 21:47 414208 --a------ C:\WINNT\system32\msscp.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmvdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmoe2.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\wmsdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mpg4dmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp4sdmod.dll
2006-10-18 21:47 4096 --a------ C:\WINNT\system32\mp43dmod.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadve.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wmvadvd.dll
2006-10-18 21:47 4096 --------- C:\WINNT\system32\wdfapi.dll
2006-10-18 21:47 38400 --------- C:\WINNT\system32\wpdshextres.dll
2006-10-18 21:47 37376 --a------ C:\WINNT\system32\wmdmps.dll
2006-10-18 21:47 35840 --------- C:\WINNT\system32\wpdconns.dll
2006-10-18 21:47 356352 --------- C:\WINNT\system32\wpdsp.dll
2006-10-18 21:47 348672 --------- C:\WINNT\system32\wmdrmnet.dll
2006-10-18 21:47 33792 --a------ C:\WINNT\system32\wmdmlog.dll
2006-10-18 21:47 321536 --a------ C:\WINNT\system32\mswmdm.dll
2006-10-18 21:47 317440 --------- C:\WINNT\system32\mp4sdecd.dll
2006-10-18 21:47 314880 --a------ C:\WINNT\system32\wmpdxm.dll
2006-10-18 21:47 295936 --------- C:\WINNT\system32\wmpeffects.dll
2006-10-18 21:47 284160 --------- C:\WINNT\system32\portabledeviceapi.dll
2006-10-18 21:47 276992 --------- C:\WINNT\system32\audiodev.dll
2006-10-18 21:47 27136 --a------ C:\WINNT\system32\mspmsnsv.dll
2006-10-18 21:47 2603008 --------- C:\WINNT\system32\wpdshext.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mpg4decd.dll
2006-10-18 21:47 259072 --------- C:\WINNT\system32\mp43decd.dll
2006-10-18 21:47 2450944 --a------ C:\WINNT\system32\wmvcore.dll
2006-10-18 21:47 242688 --a------ C:\WINNT\system32\wmpasf.dll
2006-10-18 21:47 229376 --a------ C:\WINNT\system32\cewmdm.dll
2006-10-18 21:47 227328 --a------ C:\WINNT\system32\wmerror.dll
2006-10-18 21:47 222208 --a------ C:\WINNT\system32\wmasf.dll
2006-10-18 21:47 212992 --------- C:\WINNT\system32\mfplat.dll
2006-10-18 21:47 211456 --a------ C:\WINNT\system32\qasf.dll
2006-10-18 21:47 204288 --------- C:\WINNT\system32\wmpsrcwp.dll
2006-10-18 21:47 199168 --------- C:\WINNT\system32\portabledevicewmdrm.dll
2006-10-18 21:47 179712 --a------ C:\WINNT\system32\msnetobj.dll
2006-10-18 21:47 175616 --a------ C:\WINNT\system32\mspmsp.dll
2006-10-18 21:47 166912 --------- C:\WINNT\system32\portabledevicetypes.dll
2006-10-18 21:47 1661440 --------- C:\WINNT\system32\wmpencen.dll
2006-10-18 21:47 1574912 --------- C:\WINNT\system32\wmvencod.dll
2006-10-18 21:47 157184 --a------ C:\WINNT\system32\wmidx.dll
2006-10-18 21:47 154624 --------- C:\WINNT\system32\wpdmtp.dll
2006-10-18 21:47 1543680 --------- C:\WINNT\system32\wmvdecod.dll
2006-10-18 21:47 1382912 --------- C:\WINNT\system32\wmvsdecd.dll
2006-10-18 21:47 133632 --------- C:\WINNT\system32\wpdshserviceobj.dll
2006-10-18 21:47 1329152 --a------ C:\WINNT\system32\wmspdmoe.dll
2006-10-18 21:47 132096 --------- C:\WINNT\system32\portabledevicewiacompat.dll
2006-10-18 21:47 130048 --------- C:\WINNT\system32\wmpps.dll
2006-10-18 21:47 11264 --a------ C:\WINNT\system32\laprxy.dll
2006-10-18 21:47 1117696 --a------ C:\WINNT\system32\wmadmoe.dll
2006-10-18 21:47 101888 --------- C:\WINNT\system32\portabledeviceclassextension.dll
2006-10-18 20:03 100864 --a------ C:\WINNT\system32\logagent.exe
2006-10-18 20:00 249856 --------- C:\WINNT\system32\drmupgds.exe
2006-10-18 20:00 17408 --------- C:\WINNT\system32\wpdshextautoplay.exe
2006-10-17 12:06 78336 --a------ C:\WINNT\system32\ieencode.dll
2006-10-17 12:05 40960 --a------ C:\WINNT\system32\licmgr10.dll
2006-10-17 12:05 206336 --------- C:\WINNT\system32\winfxdocobj.exe
2006-10-17 12:05 105984 --a------ C:\WINNT\system32\url.dll
2006-10-17 12:04 101376 --a------ C:\WINNT\system32\occache.dll
2006-10-17 12:03 17408 --a------ C:\WINNT\system32\corpol.dll
2006-10-17 11:58 61952 --------- C:\WINNT\system32\icardie.dll
2006-10-17 11:58 12288 --------- C:\WINNT\system32\msfeedssync.exe
2006-10-17 11:57 36352 --a------ C:\WINNT\system32\imgutil.dll
2006-10-17 11:57 266752 --------- C:\WINNT\system32\iertutil.dll
2006-10-17 11:56 45568 --a------ C:\WINNT\system32\mshta.exe
2006-10-17 11:28 48128 --a------ C:\WINNT\system32\mshtmler.dll
2006-10-17 11:27 380928 --------- C:\WINNT\system32\ieapfltr.dll
2006-10-13 06:35 142336 --a------ C:\WINNT\system32\nwprovau.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries & legit default entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"ctfmon.exe"="C:\\WINNT\\system32\\ctfmon.exe"
@=""
"ATI Launchpad"=""
"ATI Remote Control"="C:\\Program Files\\ATI Multimedia\\RemCtrl\\ATIRW.exe"
"msnmsgr"="\"C:\\Program Files\\MSN Messenger\\msnmsgr.exe\" /background"
"MoneyAgent"="\"C:\\Program Files\\Microsoft Money\\System\\mnyexpr.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Gateway Ink Monitor"="\"C:\\Program Files\\Gateway\\Gateway Ink Monitor\\GWInkMonitor.exe\""
"IgfxTray"="C:\\WINNT\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINNT\\System32\\hkcmd.exe"
"Symantec NetDriver Monitor"="C:\\PROGRA~1\\SYMNET~1\\SNDMon.exe"
"Microsoft Works Update Detection"="C:\\Program Files\\Common Files\\Microsoft Shared\\Works Shared\\WkUFind.exe"
"MMTray"="C:\\Program Files\\MUSICMATCH\\MUSICMATCH Jukebox\\mm_tray.exe"
"iTunesHelper"="\"C:\\Program Files\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"BJCFD"="C:\\Program Files\\BroadJump\\Client Foundation\\CFD.exe"
"Motive SmartBridge"="C:\\PROGRA~1\\SBCSEL~1\\SMARTB~1\\MotiveSB.exe"
"ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe"
@=""
"ATI DeviceDetect"="C:\\Program Files\\ATI Multimedia\\main\\ATIDtct.EXE"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"lxcimon.exe"="\"C:\\Program Files\\Lexmark 7300 Series\\lxcimon.exe\""
"EzPrint"="\"C:\\Program Files\\Lexmark 7300 Series\\ezprint.exe\""
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"LXCICATS"="rundll32 C:\\WINNT\\System32\\spool\\DRIVERS\\W32X86\\3\\LXCItime.dll,[email protected]"
"NI.UWA6P_0001_N91M1807"="\"c:\\documents and settings\\owner\\application data\\winantiviruspro2006freeinstall[1].exe\" -nag "
"PinnacleDriverCheck"="C:\\WINNT\\system32\\PSDrvCheck.exe -CheckReg"
"PCLEUSBTip"="C:\\Program Files\\Pinnacle\\Shared Files\\Programs\\USBTip\\USBTip.exe"
"mmtask"="c:\\Program Files\\MusicMatch\\MusicMatch Jukebox\\mmtask.exe"
"IS CfgWiz"="C:\\Program Files\\Norton Internet Security\\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE \"REBOOT\""
"UserFaultCheck"=hex(2):25,73,79,73,74,65,6d,72,6f,6f,74,25,5c,73,79,73,74,65,\
6d,33,32,5c,64,75,6d,70,72,65,70,20,30,20,2d,75,00
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"WPDShServiceObj"="{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, zwebauth.dll"


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
WudfServiceGroup REG_MULTI_SZ WUDFSvc\0\0


[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{08d06299-663c-11d8-9339-806d6172696f}]
Shell\AutoRun\command D:\Autorun.exe


Contents of the 'Scheduled Tasks' folder
C:\WINNT\tasks\Norton AntiVirus - Scan my computer - Owner.job

Completion time: 07-01-11 22:53:04
C:\ComboFix2.txt ... 07-01-08 20:55
C:\ComboFix3.txt ... 07-01-08 20:45

HiJack This log:

Logfile of HijackThis v1.99.1
Scan saved at 10:54:49 PM, on 1/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\Ati2evxx.exe
C:\WINNT\Explorer.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Norton Internet Security\ISSVC.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\PIXELA\ImageMixer for HDD Camcorder\IMx3Launcher.exe
C:\Program Files\SBC Self Support Tool\bin\mpbtn.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.8472\GoogleToolbarNotifier.exe
C:\WINNT\System32\lxcicoms.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\HiJackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Norton Internet Security - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton Internet Security - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Gateway Ink Monitor] "C:\Program Files\Gateway\Gateway Ink Monitor\GWInkMonitor.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\System32\hkcmd.exe
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
O4 - HKLM\..\Run: [Motive SmartBridge] C:\PROGRA~1\SBCSEL~1\SMARTB~1\MotiveSB.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ATI DeviceDetect] C:\Program Files\ATI Multimedia\main\ATIDtct.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [lxcimon.exe] "C:\Program Files\Lexmark 7300 Series\lxcimon.exe"
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 7300 Series\ezprint.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [LXCICATS] rundll32 C:\WINNT\System32\spool\DRIVERS\W32X86\3\LXCItime.dll,[email protected]
O4 - HKLM\..\Run: [NI.UWA6P_0001_N91M1807] "c:\documents and settings\owner\application data\winantiviruspro2006freeinstall[1].exe" -nag
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINNT\system32\PSDrvCheck.exe -CheckReg
O4 - HKLM\..\Run: [PCLEUSBTip] C:\Program Files\Pinnacle\Shared Files\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [IS CfgWiz] C:\Program Files\Norton Internet Security\cfgwiz.exe /GUID {257BBC47-1B26-432e-9F84-188603799DD3} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: ImageMixer for HDD Camcorder.lnk = ?
O4 - Global Startup: SBC Self Support Tool.lnk = C:\Program Files\SBC Self Support Tool\bin\matcli.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {24D1BDCE-D835-11D6-BF84-0050047EA0E7} (BlueStream_Flash Class) - http://www.rovion.com/Controls/Rovion.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1139962763806
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1161483723781
O16 - DPF: {737D14F8-4090-11D4-AE0E-0010830243BD} (SysVerChk Control) - file://F:\Program\SysVerChk.ocx
O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://F:\Program\AcDcToday.ocx
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://F:\Program\InstFred.ocx
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.shockwave.com/content/heavyweapon/popcaploader_v6.cab
O16 - DPF: {E5D419D6-A846-4514-9FAD-97E826C84822} (HeartbeatCtl Class) - http://fdl.msn.com/zone/datafiles/heartbeat.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,4937/mcfscan.cab
O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://F:\Program\AcPreview.ocx
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINNT\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: ISSvc (ISSVC) - Symantec Corporation - C:\Program Files\Norton Internet Security\ISSVC.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: lxci_device - - C:\WINNT\System32\lxcicoms.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: X10 Device Network Service (x10nets) - Unknown owner - C:\PROGRA~1\ATIMUL~1\RemCtrl\x10nets.exe (file missing)
 

·
Security Manager, Analyst , Rangemaster, TSF Acade
Joined
·
39,538 Posts
Hi again

Well done - your log is clean. Any more problems? If not we’ll just tidy up and I’ll let you go, along with my recommendations for staying safe and secure.

You can go ahead and delete any special tools we used (SmitRem, SmitfraudFix, ComboFix, etc). They won't serve a future purpose and are replaced with updated versions frequently, so the copies you have are probably already out of date and there is therefore no need to keep them.



Reset Hidden/System Files
To reset your hidden and system files:
  • Click Start.
  • Open My Computer.
  • Select the Tools menu and click Folder Options.
  • Select the View tab.
  • Deselect the Show hidden files and folders option.
  • Select the Hide file extensions for known types option.
  • Select the Hide protected operating system files option.
  • Click Yes to confirm.
  • Click OK.

System Restore
To turn off System Restore click Start > Right Click My Computer > Properties. Click the System Restore tab and Check "Turn off System Restore" or "Turn off System Restore on all drives" Click Apply. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this then Click OK.

To turn on System Restore by Clicking Start. Right-click My Computer, and then click Properties. Click the System Restore tab. Uncheck "Turn off System Restore" or "Turn off System Restore on all drives." Click Apply, and then OK.

This will create a new Restore Point.



Now that you are clean, to help protect your computer in the future I recommend that you get the following free programs:

Spyware Blaster to help prevent spyware from installing in the first place.
Spyware Guard to catch and block spyware before it can execute.
Spybot - Search & Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with the program on a regular basis just as you would an antivirus software. A tutorial on installing & using this product can be found here.


Ad-aware

Download and install Ad-Aware. You should use this program to scan your computer on a regular basis just as you would an antivirus software in conjunction with Spybot. A tutorial on installing & using this product can be found here.


IE-SPYAD
IE-Spyad places more than 4000 dubious websites and domains in the IE Restricted list. This severely impairs attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites. A tutorial on installing this product can be found here.


SnoopFree

SnoopFree is a real time monitor that notifies you when a programme wants to record your keystrokes or read your screen. Note that SnoopFree is only for XP systems.


MVPS Hosts File

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.


Alternate Browsers

Try the following free alternate browsers rather than Internet Explorer
Firefox
Opera
Maxthon


Firewalls

A good firewall will monitor incoming and outgoing traffic. NOTE: Microsoft's Firewall does not monitor outgoing traffic. If you do not have a firewall, here are 3 free ones available for personal use:
Comodo Personal Firewall
Sygate Personal Firewall
ZoneAlarm


Anti Virus Software

It is very important that you have anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See this link for a listing of some online antivirus scanners:
Anti-Spyware Tutorial

Here are three very good free Antivirus products which are available:
BitDefender Free
Avast!
AVG

It is imperative that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.


Other Protection

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.


In light of your recent troubles, I'm sure you'll like to avoid any future infections. Please take a look at these well written articles

PC Safety & Security - What Do I Need?.
Making Internet Explorer Safer.

Keep clean and safe and enjoy your computing!

Please respond to this thread one more time so we can mark this thread as resolved.
 
1 - 9 of 9 Posts
Status
Not open for further replies.
Top