something in my system 32, creating pop ups

[NELSONdeltaZERO]

I'm sure there are other things invading as well but the main thing that comes up is a system 32 message and immediately after a blank pop up appears, it's driving me crazy because it happens frequently, please help me

here is my hijack this log

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:46:41 PM, on 1/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEE9E78-5204-0E18-0778-4CC620930E82} - C:\WINDOWS\system32\cdmdownld\eyornvfqrw.dll (file missing)
O2 - BHO: (no name) - {124CD448-4EFE-6E08-AECA-61A3EAFEFFBC} - C:\WINDOWS\system32\ddlwm.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {E1136B38-D27C-4BE5-9339-DEB3861841FF} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [RecordNow!] (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User 'Owner')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ddcddcc - C:\WINDOWS\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7810 bytes

[ken545]

Hello

Welcome to Safer Networking.

Please read Before You Post (http://forums.spybot.info/showthread.php?t=288)
All advice given by anyone volunteering here, is taken at own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen

Your infected with the Vundo Trojan and another trojan that we need to remove.


You need to disable the Tea Timer in Spybot Search and Destroy or it may prevent the fixes from taking.

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

===================================

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O2 - BHO: (no name) - {0EEE9E78-5204-0E18-0778-4CC620930E82} - C:\WINDOWS\system32\cdmdownld\eyornvfqrw.dll (file missing)
O2 - BHO: (no name) - {124CD448-4EFE-6E08-AECA-61A3EAFEFFBC} - C:\WINDOWS\system32\ddlwm.dll (file missing)
O2 - BHO: (no name) - {E1136B38-D27C-4BE5-9339-DEB3861841FF} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O20 - Winlogon Notify: ddcddcc - C:\WINDOWS\


========================================

Download VundoFix (http://www.atribune.org/ccount/click.php?id=4 ) to your desktop

Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will reboot your computer, click OK.
Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.


===================================


Download ComboFix from Here (http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe) or Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall



I need to see the Vundofix log, the Combofix log and a New HJT log please

[NELSONdeltaZERO]

im still getting the blank pop up, but here are the 3 logs

VundoFix V6.7.7

Checking Java version...

Scan started at 10:03:11 PM 1/22/2008

Listing files found while scanning....

C:\windows\system32\awtss.dll
C:\windows\system32\awvvu.dll
C:\windows\system32\ddcyw.dll
C:\windows\system32\gebya.dll
C:\windows\system32\jkhff.dll
C:\windows\system32\jkhhh.dll
C:\windows\system32\mllmk.dll
C:\windows\system32\mllml.dll
C:\windows\system32\mllmm.dll
C:\windows\system32\pmkjk.dll
C:\windows\system32\ssqrs.dll
C:\windows\system32\sstqp.dll
C:\windows\system32\ssttq.dll
C:\windows\system32\ssttt.dll
C:\windows\system32\sstwa.ini
C:\windows\system32\sstwa.ini2
C:\windows\system32\vturq.dll

Beginning removal...

Attempting to delete C:\windows\system32\awtss.dll
C:\windows\system32\awtss.dll Has been deleted!

Attempting to delete C:\windows\system32\awvvu.dll
C:\windows\system32\awvvu.dll Has been deleted!

Attempting to delete C:\windows\system32\ddcyw.dll
C:\windows\system32\ddcyw.dll Has been deleted!

Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Has been deleted!

Attempting to delete C:\windows\system32\jkhff.dll
C:\windows\system32\jkhff.dll Has been deleted!

Attempting to delete C:\windows\system32\jkhhh.dll
C:\windows\system32\jkhhh.dll Has been deleted!

Attempting to delete C:\windows\system32\mllmk.dll
C:\windows\system32\mllmk.dll Has been deleted!

Attempting to delete C:\windows\system32\mllml.dll
C:\windows\system32\mllml.dll Has been deleted!

Attempting to delete C:\windows\system32\mllmm.dll
C:\windows\system32\mllmm.dll Has been deleted!

Attempting to delete C:\windows\system32\pmkjk.dll
C:\windows\system32\pmkjk.dll Has been deleted!

Attempting to delete C:\windows\system32\ssqrs.dll
C:\windows\system32\ssqrs.dll Has been deleted!

Attempting to delete C:\windows\system32\sstqp.dll
C:\windows\system32\sstqp.dll Has been deleted!

Attempting to delete C:\windows\system32\ssttq.dll
C:\windows\system32\ssttq.dll Has been deleted!

Attempting to delete C:\windows\system32\ssttt.dll
C:\windows\system32\ssttt.dll Has been deleted!

Attempting to delete C:\windows\system32\sstwa.ini
C:\windows\system32\sstwa.ini Has been deleted!

Attempting to delete C:\windows\system32\sstwa.ini2
C:\windows\system32\sstwa.ini2 Has been deleted!

Attempting to delete C:\windows\system32\vturq.dll
C:\windows\system32\vturq.dll Has been deleted!

Performing Repairs to the registry.
Done!


ComboFix 08-01-23.1 - Kim 2008-01-22 22:27:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\ComboFix(2).exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\temp\tn3
C:\WINDOWS\system32\awtqn.dll
C:\WINDOWS\system32\awtss.exe
C:\WINDOWS\system32\awtusrp.dll
C:\WINDOWS\system32\ddayv.dll
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\drivers\core.cache(6).dsk
C:\WINDOWS\system32\drivers\core.cache(7).dsk
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkkjhhh.dll
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\nnnnomj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhf.dll
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\qqtss.ini2
C:\WINDOWS\system32\RCX21.tmp
C:\WINDOWS\system32\RCX22.tmp
C:\WINDOWS\system32\RCX23.tmp
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX44.tmp
C:\WINDOWS\system32\RCX45.tmp
C:\WINDOWS\system32\RCX46.tmp
C:\WINDOWS\system32\wcpsu.exe
D:\Autorun.inf
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-22 22:33 . 2008-01-22 22:33 <DIR> d-------- C:\temp\tn3
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 22:03 . 2008-01-22 22:03 <DIR> d-------- C:\VundoFix Backups
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-18 04:02 . 2008-01-18 04:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-17 16:01 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-12 14:18 . 2008-01-12 15:52 39,936 --a------ C:\WINDOWS\17PHolmes572.exe
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05 .exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd .exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon .exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-10 01:41 . 2008-01-10 01:41 86,016 --a------ C:\WINDOWS\system32\drivers\ati1xbxxx.sys
2008-01-10 01:41 . 2008-01-22 22:32 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 43,387 --a------ C:\WINDOWS\browser.exe
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-22 19:42 --------- d-----w C:\Program Files\Yahoo!
2008-01-17 20:11 --------- d-----w C:\Program Files\WildTangent
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-15 21:46 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
.

<pre>
----a-w 53,248 2008-01-12 08:27:00 C:\hp\bin\AUTOTKIT .EXE
----a-w 61,440 2008-01-12 08:27:13 C:\hp\KBD\KBD .EXE
----a-w 75,128 2008-01-12 08:27:07 C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w 368,706 2008-01-12 08:27:17 C:\Program Files\BroadJump\Client Foundation\CFD .exe
----a-w 110,592 2008-01-12 08:26:59 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 24,576 2008-01-22 19:30:42 C:\Program Files\HP\Digital Imaging\bin\backupnotify .exe
----a-w 90,112 2008-01-12 08:26:56 C:\Program Files\HP\Digital Imaging\Unload\hpqcmon .exe
----a-w 49,152 2008-01-12 08:27:10 C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w 442,455 2008-01-22 19:31:22 C:\Program Files\SBC Self Support Tool\SmartBridge\MotiveSB .exe
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 212,992 2008-01-12 08:27:01 C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w 52,736 2008-01-12 08:26:52 C:\WINDOWS\system\hpsysdrv .exe
----a-w 118,784 2008-01-15 13:44:35 C:\WINDOWS\system32\hkcmd .exe
----a-w 483,328 2008-01-15 13:44:41 C:\WINDOWS\system32\hphmon05 .exe
----a-w 155,648 2008-01-15 13:44:34 C:\WINDOWS\system32\igfxtray .exe
----a-w 99,840 2008-01-11 18:21:50 C:\WINDOWS\system32\M-AudioTaskBarIcon .exe
</pre>


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [ ]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-11 20:45 4898816]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-10 20:30 364032 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2006-04-04 14:42 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-01-11 20:45 4898816 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

R1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys [2008-01-10 01:41]
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-22 22:33:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-22 22:36:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-23 03:36:05
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:37:13 PM, on 1/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6716 bytes

[ken545]

NELSONdeltaZERO,

Let me explain how these forums work, we are all staffed by volunteers,we do this in our free time and the amount of infected computers is way out of hand, we cannot afford to have more than one person helping you.

http://www.techsupportforum.com/security-center/hijackthis-log-help/212702-constant-blank-popups-driving-me-mad.html
You posted here for help. Your are infected with a newer variant of the Vundo Trojan that includes a File Infector, if you want to continue here with me helping you than you need to have the courtesy to inform the the other forum that your being helped here, we all work together so its your call, if you want to continue here, notify them and then let me know. I really cant spare the time to help you if your being helped elsewhere.

[NELSONdeltaZERO]

sorry bout that, i wasnt trying to have more than one person help, i was just trying to find someone who would help. i posted that other thread 6 days ago so i figured they just ignored it. but i did let them know your helping me know.

[ken545]

OK Nelson, thanks for taking care of that.:bigthumb:

Lets proceed, if you look in the Code box in the Combofix log , all those files and programs are infected. It may take a few runs to get them all, the ones that cant be removed you may have to uninstall and reinstall the program, but lets worry about that in a bit.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad. Make sure there is not space above and to the left of File::



File::
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\temp\tn3
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe

Folder::
C:\VundoFix Backups

RenV::
----a-w 53,248 2008-01-12 08:27:00 C:\hp\bin\AUTOTKIT .EXE
----a-w 61,440 2008-01-12 08:27:13 C:\hp\KBD\KBD .EXE
----a-w 75,128 2008-01-12 08:27:07 C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w 368,706 2008-01-12 08:27:17 C:\Program Files\BroadJump\Client Foundation\CFD .exe
----a-w 110,592 2008-01-12 08:26:59 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 24,576 2008-01-22 19:30:42 C:\Program Files\HP\Digital Imaging\bin\backupnotify .exe
----a-w 90,112 2008-01-12 08:26:56 C:\Program Files\HP\Digital Imaging\Unload\hpqcmon .exe
----a-w 49,152 2008-01-12 08:27:10 C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w 442,455 2008-01-22 19:31:22 C:\Program Files\SBC Self Support Tool\SmartBridge\MotiveSB .exe
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 212,992 2008-01-12 08:27:01 C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w 52,736 2008-01-12 08:26:52 C:\WINDOWS\system\hpsysdrv .exe
----a-w 118,784 2008-01-15 13:44:35 C:\WINDOWS\system32\hkcmd .exe
----a-w 483,328 2008-01-15 13:44:41 C:\WINDOWS\system32\hphmon05 .exe
----a-w 155,648 2008-01-15 13:44:34 C:\WINDOWS\system32\igfxtray .exe
----a-w 99,840 2008-01-11 18:21:50 C:\WINDOWS\system32\M-AudioTaskBarIcon .exe



Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-23 13:54:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.212 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\temp\tn3
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\awtss.dll.bad
C:\VundoFix Backups\awvvu.dll.bad
C:\VundoFix Backups\ddcyw.dll.bad
C:\VundoFix Backups\gebya.dll.bad
C:\VundoFix Backups\jkhff.dll.bad
C:\VundoFix Backups\jkhhh.dll.bad
C:\VundoFix Backups\mllmk.dll.bad
C:\VundoFix Backups\mllml.dll.bad
C:\VundoFix Backups\mllmm.dll.bad
C:\VundoFix Backups\pmkjk.dll.bad
C:\VundoFix Backups\ssqrs.dll.bad
C:\VundoFix Backups\sstqp.dll.bad
C:\VundoFix Backups\ssttq.dll.bad
C:\VundoFix Backups\ssttt.dll.bad
C:\VundoFix Backups\sstwa.ini.bad
C:\VundoFix Backups\sstwa.ini2.bad
C:\VundoFix Backups\vturq.dll.bad
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-23 13:58 . 2008-01-23 13:58 <DIR> d-------- C:\temp\tn3
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
.

<pre>
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>


((((((((((((((((((((((((((((( snapshot@2008-01-22_22.35.51.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 03:26:39 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 03:26:40 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 03:26:40 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 03:26:40 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 03:26:40 3,985,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 03:26:40 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 18:54:28 4,001,792 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\ntuser.dat
+ 2008-01-23 18:54:28 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2008-01-23 14:32:10 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\ARPPRODUCTICON.exe
+ 2008-01-23 14:32:11 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2008-01-23 14:32:11 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut3_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2008-01-23 14:35:36 295,606 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A81100000003}\SC_Reader.exe
- 2007-08-22 02:37:11 8,443 -c--a-w C:\WINDOWS\mozver.dat
+ 2008-01-23 14:30:07 8,935 -c--a-w C:\WINDOWS\mozver.dat
- 2008-01-11 01:30:54 560,128 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
+ 2008-01-23 15:43:14 212,992 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
- 2008-01-18 09:14:21 323,520 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-01-23 14:38:01 327,504 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-01-11 01:12:31 1,606,184 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-23 15:28:11 9,417,052 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-23 19:16:57 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4ac.dat
+ 2006-06-05 19:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
+ 2006-06-05 19:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
+ 2006-06-05 19:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 14:17:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-23 14:21:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-23 19:21:02
ComboFix2.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

and heres the hijack this, also, in the combofix log it said something about yahoo messenger, my dad was complaining that his yahoo messenger was not working, when all this is fixed will it work again ?

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:25:33 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7056 bytes

[ken545]

Hello,

Yahoo Messenger is not working because its still infected, look in the code box.

Lets give it one more run, and if Combofix does not remove it than what your going to have to do is uninstall it completely and then do a clean download and install. Don't do that yet though.

Make sure Yahoo Messenger is closed



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad. Make sure there is no space above and to the left of RenV::



RenV::
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe



Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif



This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
together with a new HijackThis log.

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-23 17:21:42.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.243 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
.

<pre>
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>


((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 22:21:35 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 22:21:35 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 22:21:35 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 22:21:35 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-23 22:21:35 4,042,752 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 22:21:35 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 17:25:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-23 17:25:54
ComboFix-quarantined-files.txt 2008-01-23 22:25:46
ComboFix2.txt 2008-01-23 19:21:05
ComboFix3.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:27:15 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7016 bytes

[ken545]

Hello,

I am afraid your going to have to uninstall Yahoo Messenger, if you keep it its just going to reinfect you. After we are done you can do a fresh download and reinstall the program.

Remove this with HJT.
O4 - HKCU\..\Run: [Yahoo! Pager] 1

Try uninstalling Yahoo Messenger from the Add Remove Programs in the Control Panel.



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::



Folder::
C:\Program Files\Yahoo

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-24 11:35:59.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.204 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\inetget2\FINAL -- Fort 5.6_MST-ONLY.exe
C:\Program Files\seekmo
C:\Program Files\seekmo\bin\10.0.406.0\HostOE.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAAX.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAHook.dll
C:\Program Files\Temporary
C:\Program Files\Temporary\kernInst.exe
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b116.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b149.exe
C:\WINDOWS\b151.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkkhhhe.dll
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\ssqrs.dll
C:\WINDOWS\system32\vtutq.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 00:21 . 2008-01-24 00:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-24 00:13 . 2008-01-24 01:01 <DIR> d-------- C:\Program Files\Zango Programs
2008-01-23 23:32 . 2008-01-23 23:43 <DIR> d-------- C:\Program Files\RegCure
2008-01-23 22:52 . 2004-10-25 15:18 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2008-01-23 22:52 . 2003-05-19 16:07 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2008-01-23 22:40 . 2008-01-23 22:40 <DIR> d-------- C:\WINDOWS\system32\AEABB2AFB2B4B0B
2008-01-23 22:40 . 2007-12-14 07:40 120,832 --a------ C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
2008-01-23 21:34 . 2008-01-23 21:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\temp\cXzz9
2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 --a--c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:23 --------- d-----w C:\Program Files\MSN Messenger
2008-01-24 04:54 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-02 13:43 282,624 ----a-w C:\Program Files\TTC.dll
.

<pre>
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>


((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-24 16:34:59 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-24 16:34:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-24 16:34:59 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-24 16:34:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-24 16:34:59 4,501,504 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-24 16:35:00 4,050,944 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\ntuser.dat
+ 2008-01-24 16:35:00 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
+ 2008-01-24 05:22:06 29,926 ----a-r C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F}\MsblIco.Exe
- 2004-08-04 07:56:43 1,392,671 -c--a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-24 02:42:40 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2008-01-19 13:13:12 32,768 ----a-w C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
- 2005-10-12 22:11:06 118,784 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-01-19 17:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 1996-01-12 23:00:00 24,576 ----a-w C:\WINDOWS\system32\STKIT432.DLL
+ 2008-01-24 16:41:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_498.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2924BE2F-CDE4-48AE-B9D3-928C12909CE3}]
C:\Program Files\Internet Explorer\metocodoqC:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"F7F4FBF8FBFDF903F"="B1AEB5B2B5B7B3B.exe" [2007-12-14 07:40 120832 C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
"RegistryMechanic"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-24 04:32:45 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 08:00:00 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 11:41:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-24 11:45:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-24 16:45:28
ComboFix2.txt 2008-01-23 22:25:55
ComboFix3.txt 2008-01-23 19:21:05
ComboFix4.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:46:12 AM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2924BE2F-CDE4-48AE-B9D3-928C12909CE3} - C:\Program Files\Internet Explorer\metocodoqC:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [F7F4FBF8FBFDF903F] B1AEB5B2B5B7B3B.exe
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 7832 bytes

[ken545]

This garbage is getting harder and harder to remove. I need some feedback from you as to what you have done. Did you try to remove Yahoo from the Add Remove programs??

Go to VirusTotal (http://www.virustotal.com/) and submit these files for analysis, just use the browse feature and then submit them , you will get a report back, post the report into this thread for me to see.

C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe




Download OTMoveIt (http://download.bleepingcomputer.com/oldtimer/OTMoveIt.exe) and save it to your desktop

Open OTMoveIt.exe.
In the left pane where it says: "Paste List of Files/Folders to be Moved", copy and paste the files in the quote box including the full path



C:\Program Files\TTC.dll

Then click the MoveIt button below.
In case you get a "Bad Image" error, just click OK at the promt. It will move the file anyway.
When done, it will create a log (********_******.log -- * stands for date and time) in next folder: C:\_OTMoveIt\MovedFiles.
Copy and paste this log in your next reply.





Please download F-Secure Blacklight (fsbl.exe) (ftp://ftp.f-secure.com/anti-virus/tools/fsbl.exe) and save to your C:\ drive. Open a command window by going to Start > Run and typing: cmd
Copy/paste or type the following in the command window: C:\fsbl.exe /expert
Hit "Enter" to start the program and then close the cmd box.
Accept the user agreement and click "Next".
Click "Scan".
After the scan is complete, click "Next", then "Exit".
BlackLight will create a log in C:\ drive named "fsbl-xxxxxxx.log" (the xxxxxxx will be the date and time of the scan).
The log will have a list of all items found. Do not choose to rename any yet!
I want to see the log first because legitimate items can also be present...like "wbemtest.exe" and "tcptest.exe.
Exit Blacklight and post the contents of the log in your next reply.

Note: If Blacklight does not work, rename fsbl.exe to zsbl.exe and try running it again.






Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from Kaspersky Online Virus Scanner (http://www.kaspersky.com/kos/english/kavwebscan.html)

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Standard
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan: Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.
Post the log along with a New HJT Log into your next reply.


Let me see the OtMoveIt log, the report from VirusTotal and the Kaspersky log please

[NELSONdeltaZERO]

i did remove yahoo messenger from the add/remove programs and the hijack this
i couldnt run the kaspersky because i dont have windows 6.0, where do i go to get that?
here are the other logs

Antivirus Version Last Update Result
AhnLab-V3 2008.1.25.10 2008.01.24 -
AntiVir 7.6.0.48 2008.01.24 -
Authentium 4.93.8 2008.01.24 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.24 -
BitDefender 7.2 2008.01.24 -
CAT-QuickHeal 9.00 2008.01.24 -
ClamAV 0.91.2 2008.01.24 -
DrWeb 4.44.0.09170 2008.01.24 -
eSafe 7.0.15.0 2008.01.16 Suspicious File
eTrust-Vet 31.3.5483 2008.01.24 -
Ewido 4.0 2008.01.24 -
FileAdvisor 1 2008.01.24 -
Fortinet 3.14.0.0 2008.01.24 -
F-Prot 4.4.2.54 2008.01.24 W32/VB-Wird-based!Maximus
F-Secure 6.70.13260.0 2008.01.24 -
Ikarus T3.1.1.20 2008.01.24 Trojan-Spy.Win32.Banbra.z
Kaspersky 7.0.0.125 2008.01.24 Trojan-Downloader.Win32.VB.chy
McAfee 5215 2008.01.24 -
Microsoft 1.3109 2008.01.24 -
NOD32v2 2820 2008.01.24 -
Norman 5.80.02 2008.01.24 -
Panda 9.0.0.4 2008.01.24 Suspicious file
Prevx1 V2 2008.01.24 Heuristic: Suspicious File With Bad Child Associations
Rising 20.28.31.00 2008.01.24 -
Sophos 4.24.0 2008.01.24 -
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.24 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.24 -
Additional information
File size: 120832 bytes
MD5: 2a51f6176a685c3205f6ca5d1220d0fe
SHA1: c6cee85fcbc65799fae36d2d1cf64f78cf831034
PEiD: -
packers: Aspack
packers: ASPack, PE_Patch
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=395D6A7E00874A26D86B01B7CA17F300DDE8FD42





LoadLibrary failed for C:\Program Files\TTC.dll
C:\Program Files\TTC.dll NOT unregistered.
C:\Program Files\TTC.dll moved successfully.

Created on 01/24/2008 17:46:26




01/24/08 18:01:53 [Info]: BlackLight Engine 1.0.67 initialized
01/24/08 18:01:53 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/24/08 18:01:53 [Note]: 7019 4
01/24/08 18:01:53 [Note]: 7005 0
01/24/08 18:01:59 [Note]: 7006 0
01/24/08 18:01:59 [Note]: 7011 2984
01/24/08 18:01:59 [Note]: 7026 0
01/24/08 18:01:59 [Note]: 7026 0
01/24/08 18:02:02 [Note]: FSRAW library version 1.7.1024
01/24/08 18:23:45 [Note]: 7007 0

[ken545]

Hi,

FYI Blacklight checks for hidden files and it did not find any.


Drag Combofix to the trash and download the latest version, don't run it yet.

Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::



File::
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2924BE2F-CDE4-48AE-B9D3-928C12909CE3}]

RenV::
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe


Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

http://i24.photobucket.com/albums/c30/ken545/CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.



You can download and install Internet Explorer 7 from here. It has a lot more security features than the older version. After you install it, run the Kaspersky online scan.
http://www.microsoft.com/windows/products/winfamily/ie/default.mspx

Let me see the New Combofix log, the Kaspersky log and a New HJT log

[NELSONdeltaZERO]

ComboFix 08-01-23.1C - Kim 2008-01-24 19:02:31.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.146 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-24 18:49 . 2008-01-24 18:49 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-24 18:46 . 2008-01-24 18:46 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-24 00:21 . 2008-01-24 00:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-24 00:13 . 2008-01-24 01:01 <DIR> d-------- C:\Program Files\Zango Programs
2008-01-23 23:32 . 2008-01-23 23:43 <DIR> d-------- C:\Program Files\RegCure
2008-01-23 22:52 . 2004-10-25 15:18 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2008-01-23 22:52 . 2003-05-19 16:07 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2008-01-23 22:40 . 2008-01-23 22:40 <DIR> d-------- C:\WINDOWS\system32\AEABB2AFB2B4B0B
2008-01-23 21:34 . 2008-01-23 21:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\temp\cXzz9
2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 --a--c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:23 --------- d-----w C:\Program Files\MSN Messenger
2008-01-24 04:54 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
.

<pre>
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>


((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460$\shell32.dll
- 2007-06-13 06:53:14 115,712 -c----w C:\WINDOWS\$NtUninstallKB943460$\xpsp3res.dll
+ 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\shell32.dll
+ 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\shell32.dll.000
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\spuninst\updspapi.dll
+ 2007-06-13 06:53:14 115,712 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\xpsp3res.dll
+ 2007-11-20 21:04:32 1,523,536 ----a-w C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-25 00:02:08 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-25 00:02:08 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-25 00:02:08 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-25 00:02:08 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-25 00:02:08 4,120,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-25 00:02:08 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
+ 2008-01-24 05:22:06 29,926 ----a-r C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F}\MsblIco.Exe
+ 2006-06-03 11:40:49 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
+ 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
- 2007-10-26 03:36:51 8,454,656 -c----w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-10-10 10:59:40 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-13 23:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-01-09 18:45:59 74,649 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
+ 2008-01-24 19:56:08 74,649 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
- 2004-08-04 07:56:43 1,392,671 -c--a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-24 02:42:40 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2008-01-19 13:13:12 32,768 ----a-w C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
- 2007-10-26 03:36:51 8,454,656 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 ----a-w C:\WINDOWS\system32\shell32.dll
- 2005-10-12 22:11:06 118,784 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-01-19 17:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll
- 2006-01-19 19:29:19 14,048 ------w C:\WINDOWS\system32\spmsg.dll
+ 2006-09-06 22:43:16 14,048 ------w C:\WINDOWS\system32\spmsg.dll
- 2005-06-28 15:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-09-06 22:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 1996-01-12 23:00:00 24,576 ----a-w C:\WINDOWS\system32\STKIT432.DLL
- 2004-08-04 07:56:46 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
+ 2006-03-24 04:37:50 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
- 2007-10-29 10:26:53 115,712 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:04:03 350,720 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-01-24 23:43:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4a0.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"F7F4FBF8FBFDF903F"="B1AEB5B2B5B7B3B.exe" []
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
"RegistryMechanic"="" []
"YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-02-11 18:14 352256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-24 22:00:00 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 08:00:00 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 19:05:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-24 19:05:51
ComboFix-quarantined-files.txt 2008-01-25 00:05:43
ComboFix2.txt 2008-01-24 16:45:31
ComboFix3.txt 2008-01-23 22:25:55
ComboFix4.txt 2008-01-23 19:21:05
ComboFix5.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:06:30 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [F7F4FBF8FBFDF903F] B1AEB5B2B5B7B3B.exe
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 8276 bytes

[ken545]

This is one of the hardest infections to remove that I have come across in quite awhile.

Remove this entry with HJT.
O4 - HKLM\..\Run: [F7F4FBF8FBFDF903F] B1AEB5B2B5B7B3B.exe

1. Please download The Avenger (http://swandog46.geekstogo.com/avenger.zip) by Swandog46 to your Desktop. Click on Avenger.zip to open the file Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):



Files to Delete:
C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
C:\Temp\liHco0109.exe
Folders to delete:
C:\Program Files\Yahoo!
C:\Program Files\Yahoo!
C:\Program Files\Zango Programs


Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply



Then run Combofix again and lets see if there gone.

Post the Avenger log, the Combofix log and a New HJT log please

[NELSONdeltaZERO]

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Error: could not create zip file.
Error code: 0


//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\awwhbgji

*******************

Script file located at: \??\C:\ftkxbsnm.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll not found!
Deletion of file C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll failed!

Could not process line:
C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll
Status: 0xc0000034



File C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe not found!
Deletion of file C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe failed!

Could not process line:
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
Status: 0xc0000034

File C:\Temp\liHco0109.exe deleted successfully.
Folder C:\Program Files\Yahoo! deleted successfully.


Folder C:\Program Files\Yahoo! not found!
Deletion of folder C:\Program Files\Yahoo! failed!

Could not process line:
C:\Program Files\Yahoo!
Status: 0xc0000034

Folder C:\Program Files\Zango Programs deleted successfully.

Completed script processing.

*******************

Finished! Terminate.//////////////////////////////////////////


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\bhhphabc

*******************

Script file located at: \??\C:\Documents and Settings\eqxwtidr.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:



File C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll not found!
Deletion of file C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll failed!

Could not process line:
C:\Documents and Settings\Owner\Local Settings\Temp\mst455101.exe.dll
Status: 0xc0000034



File C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe not found!
Deletion of file C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe failed!

Could not process line:
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
Status: 0xc0000034



File C:\Temp\liHco0109.exe not found!
Deletion of file C:\Temp\liHco0109.exe failed!

Could not process line:
C:\Temp\liHco0109.exe
Status: 0xc0000034



Folder C:\Program Files\Yahoo! not found!
Deletion of folder C:\Program Files\Yahoo! failed!

Could not process line:
C:\Program Files\Yahoo!
Status: 0xc0000034



Folder C:\Program Files\Yahoo! not found!
Deletion of folder C:\Program Files\Yahoo! failed!

Could not process line:
C:\Program Files\Yahoo!
Status: 0xc0000034



Folder C:\Program Files\Zango Programs not found!
Deletion of folder C:\Program Files\Zango Programs failed!

Could not process line:
C:\Program Files\Zango Programs
Status: 0xc0000034


Completed script processing.

*******************

Finished! Terminate.




Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 8:02:56 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (file missing)
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 8106 bytes

[NELSONdeltaZERO]

ComboFix 08-01-23.1C - Kim 2008-01-24 20:03:27.6 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.64 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-24 18:49 . 2008-01-24 18:49 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-24 00:21 . 2008-01-24 00:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-23 23:32 . 2008-01-23 23:43 <DIR> d-------- C:\Program Files\RegCure
2008-01-23 22:52 . 2004-10-25 15:18 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2008-01-23 22:52 . 2003-05-19 16:07 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2008-01-23 22:40 . 2008-01-23 22:40 <DIR> d-------- C:\WINDOWS\system32\AEABB2AFB2B4B0B
2008-01-23 21:34 . 2008-01-23 21:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\temp\cXzz9
2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 --a--c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:23 --------- d-----w C:\Program Files\MSN Messenger
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((( snapshot_2008-01-24_19.05.26.90 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-01-25 00:59:18 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4b0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [ ]
"RegistryMechanic"="" []
"YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [ ]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-24 22:00:00 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 08:00:00 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 20:07:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-24 20:08:53
ComboFix-quarantined-files.txt 2008-01-25 01:08:50
ComboFix2.txt 2008-01-25 00:05:51
ComboFix3.txt 2008-01-24 16:45:31
ComboFix4.txt 2008-01-23 22:25:55
ComboFix5.txt 2008-01-23 19:21:05
.
2008-01-22 09:02:07 --- E O F ---

[NELSONdeltaZERO]

also, when i tried to do the kaspersky it wouldnt work, the last line it gave was:
Update process FAILED. No further antivirus actions can be performed!

and thank you so much for all the help your giving, it woulda taken me months to figure this out on my own

[ken545]

Nelson,

It looks like we got it , its gone from Combofix and your HJT log looks fine :bigthumb:

You can go ahead and download and install any Yahoo software you like.

How are things running now???

[NELSONdeltaZERO]

well everything seems to be working fine, exept when i reinstalled yahoo messenger it installed it but when i try to open messenger it still says the same thing

CoCreateInstance for the MyYahoo DLL failed!

im not sure what that means

[ken545]

Hello,

Run this system cleaner, its a free program and I run it on my systems about once a week or so.

Download CCleaner from here (http://www.ccleaner.com/) to clean temp files from your computer.

Double click on the file to start the installation of the program.
Select your language and click OK, then next.
Read the license agreement and click I Agree.
Click next to use the default install location. Click Install then finish to complete installation.
Double click the CCleaner shortcut on the desktop to start the program.
On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
Click on the "Options" icon at the left side of the window, then click on "Advanced."
deselect "Only delete files in Windows Temp folders older than 48 hours."
Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
After CCleaner has completed its process, click Exit.


*NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!


Some info about your Yahoo problem.

http://www.ntcompatible.com/CoCreateInstance_for_my_yahoo_DLL_failed_t29034.html

http://help.yahoo.com/help/in/mesg/twin/twin-42.html

http://help.yahoo.com/l/us/yahoo/messenger/messenger8/messenger/index.html


You can post in there forum.
http://forums.digitalpoint.com/forumdisplay.php?f=6




Malware Complaints (http://malwarecomplaints.info/index.php)
Are you mad ? I mean really mad, seething mad, so mad your ready to spit, mad that you have taken your hard earned dollars to buy a computer only to have some Miscredents, Dirt Bags and Cyber Criminals install a malicious program on your computer without your knowledge or consent. You can post your complaint at the above site. If you live in the U.S.A. you can also report your grievance to your State Attorney Generals Office and the Federal Trade Commission's Bureau of Consumer Protection.


How did I get infected in the first place ? Read these links and find out how to prevent getting infected again.
Tutorial for System Restore (http://www.bleepingcomputer.com/tutorials/tutorial56.html) <-- Do this first to prevent yourself from being reinfected.
WhattheTech (http://forums.whatthetech.com/So_how_did_I_get_infected_in_the_first_place_t57817.html)
TonyKlein CastleCops (http://www.castlecops.com/postlite7736-.html)
Grinler BleepingComputer (http://www.bleepingcomputer.com/forums/topic2520.html)
GeeksTo Go (http://www.geekstogo.com/forum/index.php?autocom=custom&page=How_did_I)
Dslreports (http://www.dslreports.com/faq/10002)



Keep in mind if you install some of these programs. Only ONE Anti Virus and only ONE Firewall is recommended, more is overkill and can cause you problems. You can install all the Spyware programs I have listed without any problems. If you install Spyware Blaster, you can still install Spybot Search and Destroy but do not enable the TeaTimer in Spybot.

Here are some free programs to install, all free and highly regarded by the fine people in the Malware Removal Community

Spybot Search and Destroy 1.5 (http://www.safer-networking.org/en/download/)
Check for Updates/ Immunize and run a Full System Scan on a regular basis. If you install Spyware Blaster ( Recommended ) then do not enable the TeaTimer in Spybot Search and Destroy.

Spyware Blaster (http://www.javacoolsoftware.com/spywareblaster.html) It will prevent most spyware from ever being installed. No scan to run, just update about once a week and enable all protection.

Spyware Guard (http://www.javacoolsoftware.com/spywareguard.html) It offers realtime protection from spyware installation attempts, again, no scan to run, just install it and let it do its thing.

IE-Spyad (http://www.pcworld.com/downloads/file/fid,23332-order,1-page,1-c,antispywaretools/description.html)
IE-Spyad places over 6000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (cookies etc) from the sites listed, although you will still be able to connect to the sites.

Firefox 2.0.0.6 (http://www.mozilla.org/products/firefox/) It has more features and is a lot more secure than IE. It is a very easy and painless download and install, it will no way interfere with IE, you can use them both.

Zone Alarm (http://www.pcworld.com/downloads/file_description/0,fid,7228,00.asp) Here is a free Firewall from Zone Labs


Glad we could help

Safe Surfn
Ken

[NELSONdeltaZERO]

ok, so everything is working fine now including yahoo messenger (i just had to install an older version)
thank you so much for your time and help.

-David :cowboy:

[ken545]

You very welcome David

Stay well,
Ken