Tech Support Forum banner
Status
Not open for further replies.
1 - 4 of 4 Posts

·
Registered
Joined
·
2 Posts
Discussion Starter · #1 ·
Hello Volunteers,

My machine has been acting up for the past month. Somehow (me) my machine had WinAntiVirus Pro amongst other "programs" installed. My internet connection is very weird on the machine. It turns itself on and off and also closes some browser windows. I use Flock and IE mostly. I also have a white desktop that cannot be changed. I get the 'Your computer is infected" pop-up as well as WinAnti Virus Pros' 3 window pop-up.

Thank you for taking the time. I hope I listed all information correctly. On to the log.


HJT LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:27:11 AM, on 6/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\WinAntivirusPro3.8\WinAntivirusPro.exe
C:\WINDOWS\system32\rundll32.exe
C:\Windows\xpupdate.exe
C:\Program Files\Touchpad Pro\Touchpad Media Server Trial\TouchpadMediaServer.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Documents and Settings\Adam\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Adam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O2 - BHO: (no name) - {32341E7E-C319-46DE-91D0-E30BB1A3CABA} - C:\WINDOWS\system32\vtUmJBQI.dll
O2 - BHO: (no name) - {531D648E-5C6F-4377-A01F-92EF5DDB8315} - C:\WINDOWS\system32\qoMccYSM.dll
O2 - BHO: {13c5e190-4a3d-8bf9-a604-c5a7aa937efb} - {bfe739aa-7a5c-406a-9fb8-d3a4091e5c31} - C:\WINDOWS\system32\sprixotd.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [074f9212] rundll32.exe "C:\WINDOWS\system32\pebfcacb.dll",b
O4 - HKCU\..\Run: [WinAntivirusPro] C:\Program Files\WinAntivirusPro3.8\WinAntivirusPro.exe
O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe
O4 - HKCU\..\Run: [TouchpadProTrial] C:\Program Files\Touchpad Pro\Touchpad Media Server Trial\TouchpadMediaServer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://www.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/DeltaCVX.cab
O20 - Winlogon Notify: vtUmJBQI - C:\WINDOWS\SYSTEM32\vtUmJBQI.dll
O20 - Winlogon Notify: __c004D257 - C:\WINDOWS\system32\__c004D257.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)
O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe

--
End of file - 6751 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD7>

S1 eabfiltr - c:\windows\system32\drivers\eabfiltr.sys (file missing)
S3 SYMIDSCO - c:\progra~1\common~1\symant~1\symcdata\idsdefs\20040824.002\symidsco.sys (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 winvnc (VNC Server) - "c:\program files\tightvnc\winvnc.exe" -service <Not Verified; TightVNC Group; TightVNC Win32 Server>

S2 Schedule (Task Scheduler) - c:\windows\system32\drivers\spools.exe (file missing)
S3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett-Packard Development Company, L.P.; hpqwmi Module>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-05-27 20:35:00 366 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job


-- Files created between 2008-05-17 and 2008-06-17 -----------------------------

2008-06-17 09:25:27 0 d-------- C:\Program Files\Trend Micro
2008-06-17 09:11:53 0 d-------- C:\ie-spyad_zo
2008-06-17 09:02:18 0 d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-17 09:01:44 0 d-------- C:\Program Files\SpywareBlaster
2008-06-16 21:36:28 0 d-------- C:\WINDOWS\LastGood
2008-06-16 21:35:49 0 d-------- C:\Program Files\Panda Security
2008-06-16 15:06:05 81408 --a------ C:\WINDOWS\system32\pebfcacb.dll
2008-06-16 15:03:05 99328 --a------ C:\WINDOWS\system32\sprixotd.dll
2008-06-15 14:02:03 99840 --a------ C:\WINDOWS\system32\sdjxlpcg.dll
2008-06-14 13:25:28 98304 --a------ C:\WINDOWS\system32\jnvappdd.dll
2008-06-13 11:33:51 98304 --a------ C:\WINDOWS\system32\sbucelbn.dll
2008-06-11 17:45:24 0 d-------- C:\Program Files\Touchpad Pro
2008-06-11 17:15:14 0 d-------- C:\Program Files\TightVNC
2008-06-11 15:49:35 98816 --a------ C:\WINDOWS\system32\csjuypwx.dll
2008-06-11 13:48:26 59904 --a------ C:\WINDOWS\system32\uRLfDTJa.dll
2008-06-10 15:52:34 184320 --a------ C:\WINDOWS\system32\mgoloxlt.dll
2008-06-09 15:37:00 108544 --a------ C:\WINDOWS\system32\krtxtltn.dll
2008-06-09 12:58:35 92160 --a------ C:\WINDOWS\system32\dthkkpuc.dll
2008-06-08 12:56:04 108544 --a------ C:\WINDOWS\system32\cklirjhs.dll
2008-06-07 05:02:19 108544 --a------ C:\WINDOWS\system32\mfgkphkw.dll
2008-06-07 04:59:27 132608 --a------ C:\WINDOWS\system32\cehxprqk.dll
2008-06-05 22:36:44 133120 --a------ C:\WINDOWS\system32\goobicft.dll
2008-06-05 21:35:02 132608 --a------ C:\WINDOWS\system32\tfwiwnjr.dll
2008-06-04 13:07:36 132608 --a------ C:\WINDOWS\system32\jtxdvqjt.dll
2008-06-04 13:03:19 59904 --a------ C:\WINDOWS\system32\wvUoNETk.dll
2008-06-03 13:09:13 133120 --a------ C:\WINDOWS\system32\xvlqfjen.dll
2008-06-02 13:06:13 133120 --a------ C:\WINDOWS\system32\smmnsebi.dll
2008-05-31 15:46:58 132096 --a------ C:\WINDOWS\system32\kkghyusm.dll
2008-05-30 15:50:55 25088 --a------ C:\WINDOWS\system32\__c0060C80.exe
2008-05-30 13:12:17 134144 --a------ C:\WINDOWS\system32\hvfnvxok.dll
2008-05-29 17:57:37 0 d-------- C:\Program Files\WinAntivirusPro3.8
2008-05-29 17:57:17 35328 --a------ C:\WINDOWS\system32\__c006ED18.exe
2008-05-28 16:32:04 0 d-------- C:\Program Files\AVG
2008-05-28 16:19:57 0 d-------- C:\VundoFix Backups
2008-05-28 15:59:35 202240 --ah----- C:\setup95.exe <Not Verified; DreamWorks Interactive; The Neverhood>
2008-05-28 15:50:59 35328 --a------ C:\WINDOWS\system32\__c00B0693.exe
2008-05-28 15:23:46 1043 --a------ C:\xcrashdump.dat
2008-05-27 18:48:46 133632 --a------ C:\WINDOWS\system32\wbdtuvkw.dll
2008-05-27 18:44:14 2320 --ahs---- C:\WINDOWS\system32\MSYccMoq.ini2
2008-05-27 18:44:02 370688 --a------ C:\WINDOWS\system32\qoMccYSM.dll
2008-05-27 18:38:56 59904 --a------ C:\WINDOWS\system32\vtUmJBQI.dll
2008-05-27 18:38:55 0 d-------- C:\Program Files\LiveAntispy
2008-05-27 18:38:47 1219436 --a------ C:\Documents and Settings\Adam\Application Data\Install.dat
2008-05-27 18:38:45 25088 --a------ C:\WINDOWS\xpupdate.exe
2008-05-27 18:38:45 5120 -----n--- C:\WINDOWS\system32\ftp34.dll
2008-05-27 18:38:42 45056 --a------ C:\WINDOWS\system32\__c006DE06.exe
2008-05-23 19:16:03 27648 --a------ C:\WINDOWS\system32\__c004D257.dat


-- Find3M Report ---------------------------------------------------------------

2008-06-16 21:24:24 0 d-------- C:\Documents and Settings\Adam\Application Data\Viewpoint
2008-06-16 21:24:02 0 d-------- C:\Program Files\Viewpoint
2008-06-16 15:37:23 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-06-16 15:37:22 0 d-------- C:\Program Files\Common Files\muvee Technologies
2008-05-28 16:13:43 0 d-------- C:\Program Files\Acoustica Mixcraft 3
2008-05-28 15:59:25 0 d-------- C:\Program Files\Common Files
2008-05-13 15:51:10 0 d-------- C:\Documents and Settings\Adam\Application Data\Move Networks
2008-05-10 16:10:26 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-10 13:34:15 0 d-------- C:\Program Files\Zune
2008-04-27 04:46:16 0 d-------- C:\Program Files\MySpace
2008-04-24 21:55:30 0 d-------- C:\Program Files\Google


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32341E7E-C319-46DE-91D0-E30BB1A3CABA}]
05/27/2008 06:38 PM 59904 --a------ C:\WINDOWS\system32\vtUmJBQI.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{531D648E-5C6F-4377-A01F-92EF5DDB8315}]
05/27/2008 06:44 PM 370688 --a------ C:\WINDOWS\system32\qoMccYSM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bfe739aa-7a5c-406a-9fb8-d3a4091e5c31}]
06/16/2008 03:03 PM 99328 --a------ C:\WINDOWS\system32\sprixotd.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" [05/07/2007 07:28 PM]
"074f9212"="C:\WINDOWS\system32\pebfcacb.dll" [06/16/2008 03:06 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinAntivirusPro"="C:\Program Files\WinAntivirusPro3.8\WinAntivirusPro.exe" [05/29/2008 05:57 PM]
"Windows update loader"="C:\Windows\xpupdate.exe" [05/30/2008 03:50 PM]
"TouchpadProTrial"="C:\Program Files\Touchpad Pro\Touchpad Media Server Trial\TouchpadMediaServer.exe" [05/06/2008 07:18 AM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"RunNarrator"=Narrator.exe

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"MySpaceIM"=C:\Program Files\MySpace\IM\MySpaceIM.exe

C:\Documents and Settings\Adam\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 11:16:50 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [11/26/2005 2:45:53 PM]
Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [12/5/2005 5:05:06 PM]
Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [12/5/2005 5:05:01 PM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"Wallpaper"=,ôû

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoActiveDesktop"=0 (0x0)
"ForceActiveDesktopOn"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{32341E7E-C319-46DE-91D0-E30BB1A3CABA}"= C:\WINDOWS\system32\vtUmJBQI.dll [05/27/2008 06:38 PM 59904]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\vtUmJBQI]
vtUmJBQI.dll 05/27/2008 06:38 PM 59904 C:\WINDOWS\system32\vtUmJBQI.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c004D257]
C:\WINDOWS\system32\__c004D257.dat 06/16/2008 02:01 PM 27648 C:\WINDOWS\system32\__c004D257.dat

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\qoMccYSM

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{923eaf42-f563-11da-8f72-00c09fd49149}]
AutoRun\command- E:\SETUP.EXE /AUTORUN
configure\command- E:\SETUP.EXE
install\command- E:\SETUP.EXE

*Newly Created Service* - RKPAVPROC



-- End of Deckard's System Scanner: finished at 2008-06-17 09:27:52 ------------
 

Attachments

·
Registered
Joined
·
5,263 Posts
Hello and welcome to TSF

TheKidsGotChops said:
Somehow (me) my machine had WinAntiVirus Pro amongst other "programs" installed.
Why have you got no antivirus protection installed, please stay off the internet as much as possible until we can install one.

========

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear, a lack of symptoms does not mean that it is no longer present.

Please Do Not Attach logs to your posts unless you are advised to do so.

============

P2P

P2P - I see you have P2P software LimeWire 4.12.6 installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

References for the risk of these programs are Here,
Here and Here.

=========

Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery mode. This allows us to help you in the case that your computer has a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once the Recovery Console is installed using ComboFix, you should see a message that says:

The Recovery Console was successfully installed.



Please continue as follows:

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Click Yes to allow ComboFix to continue scanning for malware.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

========
Logs Required
C:\Combofix.txt
Hijackthis Log
 

·
Registered
Joined
·
2 Posts
Discussion Starter · #3 ·
Thank you for the quick response.

After running ComboFix, I already have my desktop background back. That's always a good start in the right direction.


--------------------HJT LOG----------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:46:25 PM, on 6/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Flock\flock\flock.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: {bc7e958e-3e42-774b-5354-67d6bcbaae7f} - {f7eaabcb-6d76-4535-b477-24e3e859e7cb} - C:\WINDOWS\system32\stijinht.dll
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [074f9212] rundll32.exe "C:\WINDOWS\system32\ovpvtyri.dll",b
O4 - HKCU\..\Run: [TouchpadProTrial] C:\Program Files\Touchpad Pro\Touchpad Media Server Trial\TouchpadMediaServer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q305&bd=pavilion&pf=laptop
O16 - DPF: {4FE89055-5300-469E-AFAD-DEB3181EDE76} (PearsonAsstX Control) - http://www.mathxl.com/applets/PearsonInstallAsst.cab
O16 - DPF: {C4DD6732-1E82-4AE7-BD94-180331B84082} (DeltaCVX Control) - http://www.mathxl.com/applets/DeltaCVX.cab
O20 - Winlogon Notify: __c004D257 - C:\WINDOWS\system32\__c004D257.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: VNC Server (winvnc) - TightVNC Group - C:\Program Files\TightVNC\WinVNC.exe

--
End of file - 6031 bytes



----------------------ComboFix Log---------------------------------

ComboFix 08-06-20.4 - Adam 2008-06-21 12:07:51.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1431 [GMT -4:00]
Running from: C:\Documents and Settings\Adam\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Adam\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Adam\Application Data\macromedia\Flash Player\#SharedObjects\2R4U2BDK\www.broadcaster.com
C:\Documents and Settings\Adam\Application Data\macromedia\Flash Player\#SharedObjects\2R4U2BDK\www.broadcaster.com\played_list.sol
C:\Documents and Settings\Adam\Application Data\macromedia\Flash Player\#SharedObjects\2R4U2BDK\www.broadcaster.com\video_queue.sol
C:\Documents and Settings\Adam\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Adam\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\WinAntivirusPro3.8
C:\Program Files\WinAntivirusPro3.8\WinAntivirusPro.exe
C:\WINDOWS\BM047ca18e.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bcacfbep.ini
C:\WINDOWS\system32\cehxprqk.dll
C:\WINDOWS\system32\cklirjhs.dll
C:\WINDOWS\system32\cobqnmsv.ini
C:\WINDOWS\system32\csjuypwx.dll
C:\WINDOWS\system32\cupkkhtd.ini
C:\WINDOWS\system32\dagumcbl.ini
C:\WINDOWS\system32\dthkkpuc.dll
C:\WINDOWS\system32\edwfmcdv.dll
C:\WINDOWS\system32\gesmijus.dll
C:\WINDOWS\system32\goobicft.dll
C:\WINDOWS\system32\hhxgjgwk.ini
C:\WINDOWS\system32\hmpxgtby.ini
C:\WINDOWS\system32\hqvmosny.dll
C:\WINDOWS\system32\hvfnvxok.dll
C:\WINDOWS\system32\iifFyyvU.dll
C:\WINDOWS\system32\ipbjvoyl.ini
C:\WINDOWS\system32\iqlugpxw.ini
C:\WINDOWS\system32\iuphkgbt.dll
C:\WINDOWS\system32\jnvappdd.dll
C:\WINDOWS\system32\jtxdvqjt.dll
C:\WINDOWS\system32\jvhqypyc.ini
C:\WINDOWS\system32\kkghyusm.dll
C:\WINDOWS\system32\krtxtltn.dll
C:\WINDOWS\system32\lppwjkos.ini
C:\WINDOWS\system32\lyprrfwt.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mfgkphkw.dll
C:\WINDOWS\system32\mgoloxlt.dll
C:\WINDOWS\system32\MSYccMoq.ini
C:\WINDOWS\system32\MSYccMoq.ini2
C:\WINDOWS\system32\nljcukyg.ini
C:\WINDOWS\system32\oggdwcmw.dll
C:\WINDOWS\system32\ohukbajg.ini
C:\WINDOWS\system32\oosiltca.ini
C:\WINDOWS\system32\qoMccYSM.dll
C:\WINDOWS\system32\rnxvhkkx.ini
C:\WINDOWS\system32\sbucelbn.dll
C:\WINDOWS\system32\scbptect.ini
C:\WINDOWS\system32\sdjxlpcg.dll
C:\WINDOWS\system32\smmnsebi.dll
C:\WINDOWS\system32\sprixotd.dll
C:\WINDOWS\system32\tfwiwnjr.dll
C:\WINDOWS\system32\uorahmiq.ini
C:\WINDOWS\system32\uqdjedox.dll
C:\WINDOWS\system32\uRLfDTJa.dll
C:\WINDOWS\system32\urqwalio.ini
C:\WINDOWS\system32\vdcmfwde.ini
C:\WINDOWS\system32\vtUmJBQI.dll
C:\WINDOWS\system32\wbdtuvkw.dll
C:\WINDOWS\system32\wmghcdxf.ini
C:\WINDOWS\system32\wvUoNETk.dll
C:\WINDOWS\system32\xvlqfjen.dll
C:\WINDOWS\system32\ytlctllm.ini
C:\WINDOWS\xpupdate.exe
C:\xcrashdump.dat

.
((((((((((((((((((((((((( Files Created from 2008-05-21 to 2008-06-21 )))))))))))))))))))))))))))))))
.

2008-06-21 12:22 . 2008-06-21 12:22 <DIR> d-------- C:\WINDOWS\LastGood
2008-06-21 04:48 . 2008-06-21 04:48 81,408 --a------ C:\WINDOWS\system32\sokjwppl.dll
2008-06-21 04:45 . 2008-06-21 04:45 99,328 --a------ C:\WINDOWS\system32\stijinht.dll
2008-06-21 04:45 . 2008-06-21 04:45 99,328 --a------ C:\WINDOWS\system32\qrkhhpje.dll
2008-06-19 21:36 . 2008-06-19 21:36 79,360 --a------ C:\WINDOWS\system32\mlltclty.dll
2008-06-19 16:34 . 2008-06-19 16:34 79,360 --a------ C:\WINDOWS\system32\ovpvtyri.dll
2008-06-19 16:34 . 2008-06-21 04:42 294 --ahs---- C:\WINDOWS\system32\irytvpvo.ini
2008-06-17 16:35 . 2008-06-18 04:16 1,494 --ahs---- C:\WINDOWS\system32\ybxhsfbm.ini
2008-06-17 09:25 . 2008-06-17 09:25 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-17 09:22 . 2008-06-17 09:22 <DIR> d-------- C:\Deckard
2008-06-17 09:11 . 2008-06-17 09:11 <DIR> d-------- C:\ie-spyad_zo
2008-06-17 09:02 . 2008-06-17 09:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-17 09:01 . 2008-06-17 09:04 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-16 21:35 . 2008-06-16 21:36 <DIR> d-------- C:\Program Files\Panda Security
2008-06-11 17:45 . 2008-06-11 17:45 <DIR> d-------- C:\Program Files\Touchpad Pro
2008-06-11 17:15 . 2008-06-11 17:59 <DIR> d-------- C:\Program Files\TightVNC
2008-05-30 15:50 . 2008-05-30 15:50 25,088 --a------ C:\WINDOWS\system32\__c0060C80.exe
2008-05-29 17:57 . 2008-05-29 17:57 35,328 --a------ C:\WINDOWS\system32\__c006ED18.exe
2008-05-28 18:49 . 2008-05-30 13:11 33,985 --ahs---- C:\WINDOWS\system32\qkkdnlvm.ini
2008-05-28 16:32 . 2008-05-28 16:32 <DIR> d-------- C:\Program Files\AVG
2008-05-28 16:19 . 2008-05-28 16:19 <DIR> d-------- C:\VundoFix Backups
2008-05-28 15:59 . 1996-09-15 22:00 202,240 --ah----- C:\setup95.exe
2008-05-28 15:59 . 2008-06-21 04:48 68 --a------ C:\WINDOWS\wininit.ini
2008-05-28 15:50 . 2008-05-28 15:50 35,328 --a------ C:\WINDOWS\system32\__c00B0693.exe
2008-05-27 18:46 . 2008-05-28 18:46 33,805 --ahs---- C:\WINDOWS\system32\gkqbacal.ini
2008-05-27 18:38 . 2008-05-28 13:35 <DIR> d-------- C:\Program Files\LiveAntispy
2008-05-27 18:38 . 2008-05-27 18:38 1,219,436 --a------ C:\Documents and Settings\Adam\Application Data\Install.dat
2008-05-27 18:38 . 2008-05-27 18:38 45,056 --a------ C:\WINDOWS\system32\__c006DE06.exe
2008-05-23 19:16 . 2008-06-21 04:42 27,648 --a------ C:\WINDOWS\system32\__c004D257.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-21 16:19 96,256 ----a-w C:\WINDOWS\system32\drivers\sptd2189.sys
2008-06-18 23:26 --------- d-----w C:\Documents and Settings\Adam\Application Data\Move Networks
2008-06-17 01:24 --------- d-----w C:\Program Files\Viewpoint
2008-06-17 01:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-06-17 01:24 --------- d-----w C:\Documents and Settings\Adam\Application Data\Viewpoint
2008-06-16 19:37 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-16 19:37 --------- d-----w C:\Program Files\Common Files\muvee Technologies
2008-05-28 20:13 --------- d-----w C:\Program Files\Acoustica Mixcraft 3
2008-05-10 17:34 --------- d-----w C:\Program Files\Zune
2008-05-10 17:33 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2008-05-10 17:33 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
2008-04-29 23:39 40,704 ----a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-04-27 23:28 --------- d-----w C:\Documents and Settings\Pick Me!\Application Data\MySpace
2008-04-27 08:46 --------- d-----w C:\Program Files\MySpace
2008-04-25 01:55 --------- d-----w C:\Program Files\Google
2007-06-02 10:09 284 -c--a-w C:\Documents and Settings\Adam\Application Data\ViewerApp.dat
2006-08-16 21:04 122 -c--a-w C:\Documents and Settings\Adam\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f7eaabcb-6d76-4535-b477-24e3e859e7cb}]
2008-06-21 04:45 99328 --a------ C:\WINDOWS\system32\stijinht.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TouchpadProTrial"="C:\Program Files\Touchpad Pro\Touchpad Media Server Trial\TouchpadMediaServer.exe" [2008-05-06 07:18 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" [2007-05-07 19:28 589824]
"074f9212"="C:\WINDOWS\system32\ovpvtyri.dll" [2008-06-19 16:34 79360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2008-04-17 19:27 9117696]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2006-10-04 04:48 53760 C:\WINDOWS\system32\narrator.exe]

C:\Documents and Settings\Adam\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 23:16:50 113664]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2005-11-26 14:45:53 169472]
Picture Package Menu.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe [2005-12-05 17:05:06 151552]
Picture Package VCD Maker.lnk - C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe [2005-12-05 17:05:01 106496]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c004D257]
C:\WINDOWS\system32\__c004D257.dat 2008-06-21 04:42 27648 C:\WINDOWS\system32\__c004D257.dat

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\WINDOWS\\system32\\dplaysvr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\SmartFTP Client\\SmartFTP.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"C:\\Program Files\\TightVNC\\WinVNC.exe"=
"C:\\Program Files\\Touchpad Pro\\Touchpad Media Server Trial\\TouchpadMediaServer.exe"=
"C:\\Program Files\\TightVNC\\vncviewer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service

R2 MSCamSvc;MSCamSvc;"C:\Program Files\Microsoft LifeCam\MSCamS32.exe" [2006-10-13 17:01]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-04-29 19:39]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-04-29 19:56]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 11:18]
S3 sonypvs1;Sony Digital Imaging Video2;C:\WINDOWS\system32\DRIVERS\sonypvs1.sys [2002-10-16 02:41]
S3 VX6000;Microsoft LifeCam VX-6000;C:\WINDOWS\system32\DRIVERS\VX6000Xp.sys [2006-10-13 17:04]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-04-29 19:56]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\SETUP.EXE /AUTORUN
\Shell\configure\command - E:\SETUP.EXE
\Shell\install\command - E:\SETUP.EXE

.
Contents of the 'Scheduled Tasks' folder
"2008-06-21 16:35:00 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDetect.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-21 12:24:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\wbem\Performance\WmiApRpl_new.ini 924 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\__c004D257.dat
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Zune\ZuneNss.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\ati2evxx.exe
.
**************************************************************************
.
Completion time: 2008-06-21 12:37:46 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-21 16:37:22

Pre-Run: 22,398,156,800 bytes free
Post-Run: 22,347,309,056 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

227 --- E O F --- 2008-05-17 12:16:17
 

·
Registered
Joined
·
5,263 Posts
Hello again

Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly

========

Open notepad and copy/paste the text in the quotebox below.
http://www.techsupportforum.com/security-center/hijackthis-log-help/260290-winantivirus-pro-internet-connection-off-browser-restarts.html

Collect::
C:\WINDOWS\system32\sokjwppl.dll
C:\WINDOWS\system32\stijinht.dll
C:\WINDOWS\system32\qrkhhpje.dll
C:\WINDOWS\system32\mlltclty.dll
C:\WINDOWS\system32\ovpvtyri.dll
C:\WINDOWS\system32\__c0060C80.exe
C:\WINDOWS\system32\__c006ED18.exe
C:\WINDOWS\system32\__c00B0693.exe
C:\WINDOWS\system32\__c006DE06.exe
C:\WINDOWS\system32\__c004D257.dat
File::
C:\WINDOWS\system32\irytvpvo.ini
C:\WINDOWS\system32\ybxhsfbm.ini
C:\WINDOWS\system32\qkkdnlvm.ini
C:\WINDOWS\system32\gkqbacal.ini
C:\WINDOWS\Tasks\Symantec NetDetect.job
Folder::
C:\Program Files\AVG
C:\Program Files\Symantec
C:\VundoFix Backups
C:\Program Files\LiveAntispy
C:\Program Files\Viewpoint
C:\Documents and Settings\All Users\Application Data\Viewpoint
C:\Documents and Settings\Adam\Application Data\Viewpoint
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f7eaabcb-6d76-4535-b477-24e3e859e7cb}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"074f9212"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\__c004D257]
Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).

==========

JAVA OUTDATED


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.
  • Download the latest version of Java Runtime Environment (JRE) 6 Update 6 and save it to your desktop.
  • Scroll down to where it says "Java Runtime Environment (JRE) 6 Update 6. The Java SE Runtime Environment (JRE) allows end-users to run Java applications."
  • Click the "Download" button to the right.
  • Select the Windows platform from the dropdown menu.
  • Read the License Agreement and then check the box that says: "Accept License Agreement". Click on Continue.The page will refresh.
  • Click on the link to download Windows Offline Installation and save the file to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.
  • After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
    • On the General tab, under Temporary Internet Files, click the Settings button.
    • Next, click on the Delete Files button
    • There are two options in the window to clear the cache - Leave BOTH Checked

      • Applications and Applets
        Trace and Log Files
    • Click OK on Delete Temporary Files Window
      Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
    • Click OK to leave the Temporary Files Window
    • Click OK to leave the Java Control Panel.

=========

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache

*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

==========

No AntiVirus Onboard

I see no evidence of an AntiVirus program on your system. This must be resolved. Here are a few very good free Antivirus products which are available:Select one of these, or another of your choice. Download, install, update definitions, and run a full system scan.

=========

Open HijackThis and click on 'Do a System Scan and save a Logfile'. Save the log file and post it here.

=========
Logs Required
C:\Combofix.txt
Saved results from AV scan
Hijackthis Log
 
1 - 4 of 4 Posts
Status
Not open for further replies.
Top