cmdservice removal assistance badly needed...

[fadingcaptain]

Hi,

I've gotten the dreaded cmdservice (and i'm sure a lot of other things by now) on my machine, and could use some help getting rid of it. Any assistance would be greatly appreciated!

Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:30:38 PM, on 1/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\OD978F.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\STOPzilla!\STOPzilla.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\WINDOWS\WNSXS~1\smss.exe
C:\Program Files\iPod\bin\iPodService.exe
H:\My Documents\a?sembly\r?gedit.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Sage Software\Peachtree\peachw.exe
C:\Program Files\Sage Software\Peachtree\W32MKDE.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=userinit.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O3 - Toolbar: STOPzilla - {98828DED-A591-462F-83BA-D2F62A68B8B8} - C:\Program Files\STOPzilla!\SZSG.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\Run: [f8c118d4] rundll32.exe "C:\WINDOWS\system32\fgdnvrsy.dll",b
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - HKCU\..\Run: [qrzo] C:\PROGRA~1\COMMON~1\qrzo\qrzom.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: STOPzilla Service (szserver) - iS3, Inc. - C:\Program Files\Common Files\iS3\Anti-Spyware\SZServer.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8409 bytes


THANKS!!!!

[__RiP_ChAiN_]

Hello fadingcaptain :)

Please download ComboFix by sUBs from HERE (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) or HERE (http://subs.geekstogo.com/ComboFix.exe)
You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

[fadingcaptain]

Here's the combofix log:

ComboFix 08-02.01.6 - andrew rush 2008-02-01 9:11:43.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1374 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\rqrpqnk.dll
C:\WINDOWS\system32\rrmglwvh.dll
H:\My Documents\ASEMBL~1\r?gedit.exe
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Program Files\Common Files\qrzo
C:\Program Files\Common Files\qrzo\qrzoa.lck
C:\Program Files\Common Files\qrzo\qrzod\class-barrel
C:\Program Files\Common Files\qrzo\qrzod\qrzoc.dll
C:\Program Files\Common Files\qrzo\qrzod\vocabulary
C:\Program Files\Common Files\qrzo\qrzol.exe
C:\Program Files\Common Files\qrzo\qrzol.lck
C:\Program Files\Common Files\qrzo\qrzom.lck
C:\Program Files\Common Files\qrzo\qrzop.exe
C:\Program Files\Insider
C:\Program Files\Insider\UnInstall.exe
C:\Program Files\outerinfo
C:\Program Files\security toolbar
C:\Program Files\security toolbar\Security Toolbar.dll
C:\Program Files\security toolbar\Uninstall.bat
C:\Program Files\Temporary
C:\Program Files\Temporary\kernInst.exe
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b116.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b147.exe
C:\WINDOWS\b149.exe
C:\WINDOWS\qrzo
C:\WINDOWS\qrzo\qrzo.dat
C:\WINDOWS\qrzo\wu
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\fgdnvrsy.dll
C:\WINDOWS\system32\hph.dll
C:\WINDOWS\system32\nnnkjge.dll
C:\WINDOWS\system32\ohlhdtfu.dll
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\rqrpqnk.dll
C:\WINDOWS\system32\rqtobyoj.dll
C:\WINDOWS\system32\rrmglwvh.dll
C:\WINDOWS\system32\rrmglwvh.dllbox
C:\WINDOWS\system32\ysrvndgf.ini
C:\WINDOWS\wnsxs~1
C:\WINDOWS\wnsxs~1\smss.exe
C:\WINDOWS\wnsxs~1\W?nSxS\

----- BITS: Possible infected sites -----

hxxp://au.download.windowsupdate.com
hxxp://au.download.windowsupdate.co
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_NETWORK_MONITOR


((((((((((((((((((((((((( Files Created from 2008-01-01 to 2008-02-01 )))))))))))))))))))))))))))))))
.

2008-01-31 14:31 . 2008-01-31 14:31 2,048 --a------ C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
2008-01-31 14:27 . 2008-01-31 14:27 4,096 --a------ C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 13:04 . 2008-01-31 14:27 <DIR> d--hs---- C:\WINDOWS\T3duZXI
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-01-30 12:20 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-08 09:15 . 2008-01-08 09:15 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-31 19:29 --------- d-----w C:\Program Files\Trillian
2008-01-31 17:49 10 ----a-w C:\Program Files\.autoreg
2008-01-30 17:17 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-29 22:10 --------- d-----w C:\Program Files\Soulseek
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-12-10 04:27 --------- d-----w C:\Documents and Settings\wardrobe intern\Application Data\Apple Computer
2007-12-05 23:40 --------- d-----w C:\Documents and Settings\elmonmay\Application Data\Sonic
2007-12-05 23:40 --------- d-----w C:\Documents and Settings\elmonmay\Application Data\HotSync
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\T3duZXI\asappsrv.dll
2005-07-29 21:24 472 --sha-r C:\WINDOWS\T3duZXI\naxRtrK.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]
"Dot1XCfg"="C:\Program Files\Dot1XCfg\Dot1XCfg.exe" [2008-01-30 12:20 61440]
"Etnr"="C:\WINDOWS\WNSXS~1\smss.exe" [ ]
"Ckgkfzp"="H:\My Documents\a?sembly\r?gedit.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices]
"Microsoft Update Machine"="dxegpq.exe" [2007-06-13 05:23 218721 C:\WINDOWS\system32\dxegpq.exe]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-01-31 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-01 09:19:39
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Windows Media Player\WMPNetwk.exe
C:\WINDOWS\TEMP\DJ9F86.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
.
**************************************************************************
.
Completion time: 2008-02-01 9:26:44 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-01 14:26:41
.
2008-01-09 13:37:08 --- E O F ---

[fadingcaptain]

And here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:29, on 2008-02-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\DJ9F86.EXE
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Dot1XCfg\Dot1XCfg.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [Dot1XCfg] C:\Program Files\Dot1XCfg\Dot1XCfg.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
--
End of file - 8257 bytes

Thanks!

[__RiP_ChAiN_]

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download SDFix (http://download.bleepingcomputer.com/andymanchesta/SDFix.exe) by AndyManchesta and save it to your desktop.
When using this tool, you must use the Administrator's account or an account with "Administrative rights" Double click SDFix.exe and it will extract the files to %systemdrive%
(this is the drive that contains the Windows Directory, typically C:\SDFix). DO NOT use it just yet.Reboot your computer in "Safe Mode (http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/boot_failsafe.mspx?mfr=true)" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process.
It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
Press any Key and it will restart the PC.
When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
Copy and paste the contents of the results file Report.txt in your next replyalong with a new HijackThis log.-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

STEP #1

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for his/her Operating System
Microsoft Windows XP Home Edition
Without Service Packs
http://www.microsoft.com/downloads/details...55-BD5AFEE126D8 (http://www.microsoft.com/downloads/details.aspx?FamilyID=E8FE6868-6E4F-471C-B455-BD5AFEE126D8)
Service Pack 1
http://www.microsoft.com/downloads/details...05-719F45C382A4 (http://www.microsoft.com/downloads/details.aspx?FamilyID=FBE5E4FC-695F-43E5-AF05-719F45C382A4)
Service Pack 2
http://www.microsoft.com/downloads/details...3D-81C2137FF464 (http://www.microsoft.com/downloads/details.aspx?FamilyId=15491F07-99F7-4A2D-983D-81C2137FF464)

Microsoft Windows XP Professional
Without Service Packs
http://www.microsoft.com/downloads/details...B7-4FED408EA73F (http://www.microsoft.com/downloads/details.aspx?FamilyID=55820EDB-5039-4955-BCB7-4FED408EA73F)
Service Pack 1
http://www.microsoft.com/downloads/details...C2-631504EF5E26 (http://www.microsoft.com/downloads/details.aspx?FamilyID=83F53BE9-28FA-40E8-8EC2-631504EF5E26)
Service Pack 2
http://www.microsoft.com/downloads/details...0C-0A0205368124 (http://www.microsoft.com/downloads/details.aspx?FamilyId=535D248D-5E10-49B5-B80C-0A0205368124)

## Important ##
As we do not know the name of the file that's downloaded, you have to save the file as RC.exe to the root of SystemDrive e.g. C:\RC.exe



STEP #2

Download the latest copy of ComboFix.exe => http://download.bleepingcomputer.com/sUBs/ComboFix.exe

Open notepad and copy/paste the text in the quotebox below into it:


RecoveryConsole::
C:\RC.EXE

Save this as "CFScript"


http://img.photobucket.com/albums/v666/sUBs/CFScript.gif

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you, C:\CF-RC.txt. Post that log in your next reply.


## Important ##
This is a precautionary measure. Please do not reboot the machine until we have reviewed the log & responded to you.

[fadingcaptain]

SDFix: Version 1.136

Run by andrew rush on 02/04/2008 at 09:03 AM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:18:41 AM, on 02/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\OU7641.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8042 bytes

[__RiP_ChAiN_]

When finished, it shall produce a log for you, C:\CF-RC.txt. Post that log in your next reply.
Do you have this log available to post?

[fadingcaptain]

Unfortunately, when i drag the notepad into combofix, it attempts to run, but then stops and gives me an error saying "C:\RC.EXE cannot be found"

Am i doing something wrong?

[__RiP_ChAiN_]

Hello fadingcaptain :)

Did you make sure that the recovery console you downloaded was saved to drive C:\ as RC.EXE?

[fadingcaptain]

Okay...got it. Here's the log:

RC.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

[__RiP_ChAiN_]

Excellent, let's get a new CF log and begin anew :)

Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

[fadingcaptain]

OK...here's the log:

ComboFix 08-02.05.3 - andrew rush 2008-02-08 15:37:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1491 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

H:\My Documents\ASEMBL~1

.
((((((((((((((((((((((((( Files Created from 2008-01-08 to 2008-02-08 )))))))))))))))))))))))))))))))
.

2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:31 . 2008-01-31 14:31 2,048 --a------ C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
2008-01-31 14:27 . 2008-01-31 14:27 4,096 --a------ C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 13:04 . 2008-01-31 14:27 <DIR> d--hs---- C:\WINDOWS\T3duZXI
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-02-04 08:56 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod
2008-01-10 15:27 . 2008-01-10 15:27 90,112 --a------ C:\WINDOWS\system32\QuickTimeVR.qtx
2008-01-10 15:27 . 2008-01-10 15:27 57,344 --a------ C:\WINDOWS\system32\QuickTime.qts
2008-01-08 09:15 . 2008-01-08 09:15 <DIR> d-------- C:\Program Files\Snood

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 20:39 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-02-04 13:24 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-12-10 04:27 --------- d-----w C:\Documents and Settings\wardrobe intern\Application Data\Apple Computer
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
2005-08-02 21:46 187,904 --sha-r C:\WINDOWS\T3duZXI\asappsrv.dll
2005-07-29 21:24 472 --sha-r C:\WINDOWS\T3duZXI\naxRtrK.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Etnr"="C:\WINDOWS\WNSXS~1\smss.exe" [ ]
"Ckgkfzp"="H:\My Documents\a?sembly\r?gedit.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-08 15:42:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-08 15:43:33
ComboFix-quarantined-files.txt 2008-02-08 20:42:42
ComboFix2.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---

[fadingcaptain]

And here's the fresh HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:50, on 2008-02-08
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Etnr] "C:\WINDOWS\WNSXS~1\smss.exe" -vt yazb
O4 - HKCU\..\Run: [Ckgkfzp] "H:\My Documents\a?sembly\r?gedit.exe"
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8004 bytes

[__RiP_ChAiN_]

Hello fadingcaptain :)

Jotti File Submission:
Please go to Jotti's malware scan (http://virusscan.jotti.org/)

Copy and paste the following file path into the "File to upload & scan"box on the top of the page:

C:\WINDOWS\system32\dxegpq.exe

Click on the submit button

Please post the results in your next reply.

1. Please open Notepad
Click Start , then Run
Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
DirLook::
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\Program Files\Dot1XCfg
Folder::
C:\WINDOWS\T3duZXI
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Etnr"=-
"Ckgkfzp"=-

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif


6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next replyafter you re-enable all the programs that were disabled during the running of ComboFix:
Combofix.txt
A new HijackThis log.
Please take note:

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

[fadingcaptain]

Jotti Results:
Scan taken on 11 Feb 2008 13:53:24 (GMT)
A-Squared
Found Backdoor.Win32.Rbot.ghb
AntiVir
Found WORM/Rbot.218721
ArcaVir
Found Trojan.Rbot.Ghb
Avast
Found nothing
AVG Antivirus
Found IRC/BackDoor.SdBot3.YJO
BitDefender
Found Backdoor.IRCBot.ABHS
ClamAV
Found Trojan.Pakes-994
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found nothing
F-Secure Anti-Virus
Found Backdoor.Win32.Rbot.ghb
Fortinet
Found W32/RBot.GHB!tr.bdr
Ikarus
Found Backdoor.Win32.Rbot.ghb
Kaspersky Anti-Virus
Found Backdoor.Win32.Rbot.ghb
NOD32
Found Win32/Rbot
Norman Virus Control
Found nothing
Panda Antivirus
Found nothing
Rising Antivirus
Found nothing
Sophos Antivirus
Found Mal/Generic-A
VirusBuster
Found Worm.Rbot.VDO
VBA32
Found Backdoor.Win32.Rbot.ghb

[fadingcaptain]

ComboFix log:

ComboFix 08-02.05.3 - andrew rush 2008-02-11 8:49:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1393 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andrew Rush\Desktop\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\drivers\01BA01C3-FE4A-46B8-A3EF-4811773EC267.cxv
C:\WINDOWS\system32\drivers\356D4712-EA57-43AB-9903-27CBE1E5C165.cxv
C:\WINDOWS\T3duZXI
C:\WINDOWS\T3duZXI\asappsrv.dll
C:\WINDOWS\T3duZXI\naxRtrK.vbs

.
((((((((((((((((((((((((( Files Created from 2008-01-11 to 2008-02-11 )))))))))))))))))))))))))))))))
.

2008-02-10 13:03 . 2008-02-10 13:03 <DIR> d-------- C:\Documents and Settings\tsguest.TSNETSERVER\Application Data\ATI
2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-05 10:38 . 2004-08-04 07:00 388,608 --a------ C:\kmd.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-31 12:54 . 2008-01-31 12:54 <DIR> d-------- C:\WINDOWS\system32\F1F4F3F3F7FBF
2008-01-30 12:20 . 2008-02-04 08:56 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-08 20:39 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-02-04 13:24 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:15 --------- d-----w C:\Program Files\Snood
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
2007-06-13 10:23 218,721 --sha-r C:\WINDOWS\system32\dxegpq.exe
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\Program Files\Dot1XCfg ----


---- Directory of C:\WINDOWS\system32\F1F4F3F3F7FBF ----

2008-01-31 12:54 13988 --a------ C:\WINDOWS\system32\F1F4F3F3F7FBF\242726262A2E2


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 19:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 22:06 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-11 08:50:21
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-11 8:51:27
ComboFix-quarantined-files.txt 2008-02-11 13:50:49
ComboFix2.txt 2008-02-08 20:43:33
ComboFix3.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---

[fadingcaptain]

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:57, on 2008-02-11
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Sage Software\Peachtree\peachw.exe
C:\Program Files\Sage Software\Peachtree\W32MKDE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\WINDOWS\system32\dxegpq.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1137\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1137\..\Run: [Aim6] "C:\Program Files\Common Files\AOL\Launch\AOLLaunch.exe" /d locale=en-US ee://aol/imApp (User '?')
O4 - HKUS\S-1-5-21-1312592511-137365415-2714469920-1157\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 8720 bytes

[__RiP_ChAiN_]

Hello fadingcaptain :)

A. Please RUN HijackThis
Click the SCAN button to produce a log.


Place a check mark beside each one of the following items:

O4 - HKLM\..\Run: [Microsoft Update Machine] dxegpq.exe
O4 - HKLM\..\RunServices: [Microsoft Update Machine] dxegpq.exe
O4 - HKCU\..\Run: [Microsoft Update Machine] dxegpq.exe


Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.
B. 1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box.
2. Now copy/paste the entire content of the codebox below into the Notepad window:



http://forums.spybot.info/showthread.php?p=163561#post163561

Collect::[27]
C:\WINDOWS\system32\dxegpq.exe
Folder::
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\Program Files\Dot1XCfg

3. Save the above as CFScript.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

4. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

http://users.pandora.be/bluepatchy/miekiemoes/images/CFScript.gif


6. Additonally, ComboFix will generate the following files on your desktop
A zipped file on your desktop called Submit [Date Time].zip
And another file named - CF-Submit.htm
7. ComboFix may need to reboot to finish its work. Let it.

8. When CF has finished running, it will generate the ComboFix.log which will appear on your screen.

9. Next, a window will popup prompting you to "Submit Files for further analysis". Click "OK" but first, re-enable all the programs that were disabled during the running of ComboFix.

10. Your system's browser will automatically respond by loading the CF-Submit.htm file and open a window :
Click the "Browse" button and locate the Submit [Date Time].zip file on your desktop.
Click on the file to Select it.
Submit the file by clicking "OK"
11. Post the following reports/logs into your next reply: Combofix.txt A new HijackThis log.
CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

[fadingcaptain]

It was submitted successfully...

Combofix Log:

ComboFix 08-02.05.3 - andrew rush 2008-02-12 14:52:07.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1475 [GMT -5:00]
Running from: C:\Documents and Settings\Andrew Rush\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Andrew Rush\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Dot1XCfg
C:\WINDOWS\system32\dxegpq.exe
C:\WINDOWS\system32\F1F4F3F3F7FBF
C:\WINDOWS\system32\F1F4F3F3F7FBF\242726262A2E2

.
((((((((((((((((((((((((( Files Created from 2008-01-12 to 2008-02-12 )))))))))))))))))))))))))))))))
.

2008-02-12 10:20 . 2008-02-12 10:20 <DIR> d-------- C:\WINDOWS\LastGood
2008-02-12 10:20 . 2008-02-12 10:20 <DIR> d-------- C:\Program Files\Pocket Tunes
2008-02-11 15:48 . 2008-02-11 15:48 <DIR> d-------- C:\Program Files\NoviiMedia
2008-02-11 08:49 . 2004-08-04 07:00 388,608 --a------ C:\kmd.exe
2008-02-10 13:03 . 2008-02-10 13:03 <DIR> d-------- C:\Documents and Settings\tsguest.TSNETSERVER\Application Data\ATI
2008-02-05 14:43 . 2004-08-03 23:00 260,272 --a------ C:\cmldr
2008-02-05 14:41 . 2008-02-05 14:41 4,608,744 --a------ C:\RC.exe
2008-02-04 08:52 . 2008-02-04 08:52 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-04 08:51 . 2008-02-05 10:26 <DIR> d-------- C:\SDFix
2008-02-01 09:41 . 2008-02-01 09:41 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-02-01 09:09 . 2008-02-01 09:09 1,592,659 --a------ C:\ComboFix.exe
2008-01-31 14:25 . 2008-01-31 14:25 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-31 14:25 . 2008-01-31 15:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\STOPzilla!
2008-01-24 12:11 . 2007-11-02 11:26 <DIR> d---s---- C:\Documents and Settings\ADMIN INTERN\UserData
2008-01-24 12:11 . 2007-10-31 13:13 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\Sonic
2008-01-24 12:11 . 2007-10-25 08:57 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\PureEdge
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\HotSync
2008-01-24 12:11 . 2008-01-24 12:11 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\ATI
2008-01-24 12:11 . 2007-12-14 10:16 <DIR> d-------- C:\Documents and Settings\ADMIN INTERN\Application Data\AdobeUM
2008-01-22 08:54 . 2008-01-22 08:54 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\Move Networks
2008-01-18 15:29 . 2008-01-18 15:29 <DIR> d-------- C:\Program Files\Analog Devices
2008-01-18 15:29 . 2006-07-10 15:42 49,152 --a------ C:\WINDOWS\system32\DSndUp.exe
2008-01-18 15:29 . 2002-04-17 15:05 45,056 --a------ C:\WINDOWS\system32\CleanUp.exe
2008-01-18 15:06 . 2007-06-12 17:05 920,344 --a------ C:\WINDOWS\system32\heciudlg.exe
2008-01-18 15:06 . 2007-06-12 17:05 45,056 --a------ C:\WINDOWS\system32\drivers\HECI.sys
2008-01-18 14:59 . 2008-01-18 14:59 <DIR> d-------- C:\Documents and Settings\Andrew Rush\Application Data\ATI
2008-01-18 14:53 . 2007-07-12 21:31 5,431,296 --a------ C:\WINDOWS\system32\atioglxx.dll
2008-01-18 14:53 . 2007-06-12 17:05 319,456 --a------ C:\WINDOWS\system32\difxapi.dll
2008-01-18 14:52 . 2001-09-19 13:47 765,952 --a------ C:\WINDOWS\system\crlds3d.dll
2008-01-18 14:52 . 2006-03-17 18:18 392,960 --a------ C:\WINDOWS\system32\drivers\senfilt.sys
2008-01-18 14:52 . 2007-05-11 15:21 306,176 --a------ C:\WINDOWS\system32\drivers\ADIHdAud.sys
2008-01-18 14:52 . 2007-03-27 10:36 28,160 --a------ C:\WINDOWS\system32\PostProc.dll
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\WINDOWS\system32\vmm32
2008-01-18 14:50 . 2008-01-18 14:50 <DIR> d-------- C:\Program Files\Dell
2008-01-18 14:43 . 2008-01-18 15:03 <DIR> d-------- C:\Program Files\Intel
2008-01-18 14:42 . 2008-01-18 14:42 <DIR> d-------- C:\Intel
2008-01-18 14:39 . 2007-04-13 13:33 254,872 --a------ C:\WINDOWS\system32\drivers\e1e5132.sys
2008-01-18 14:39 . 2007-01-17 15:59 179,048 --a------ C:\WINDOWS\system32\e1000msg.dll
2008-01-18 14:39 . 2007-01-17 16:02 66,424 --a------ C:\WINDOWS\system32\NicEtCoE.dll
2008-01-18 14:39 . 2007-01-29 14:36 62,840 --a------ C:\WINDOWS\system32\NicInstE.dll
2008-01-18 14:39 . 2007-01-17 16:02 28,536 --a------ C:\WINDOWS\system32\NicCo.dll
2008-01-18 14:39 . 2006-06-02 17:00 2,889 --a------ C:\WINDOWS\system32\e1e5132.din
2008-01-18 14:28 . 2008-01-18 14:28 0 --a------ C:\WINDOWS\ativpsrm.bin
2008-01-18 14:24 . 2008-01-18 14:54 <DIR> d-------- C:\Program Files\ATI Technologies
2008-01-18 14:24 . 2007-07-12 21:15 520,192 --a------ C:\WINDOWS\system32\ati2sgag.exe
2008-01-17 08:21 . 2008-01-17 08:21 <DIR> d-------- C:\Program Files\iPod

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-12 15:03 --------- d-----w C:\Documents and Settings\Andrew Rush\Application Data\Azureus
2008-02-11 21:48 --------- d-----w C:\Program Files\Trillian
2008-02-08 13:48 --------- d-----w C:\Program Files\Soulseek
2008-01-31 20:40 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-31 20:03 --------- d-----w C:\Program Files\Trend Micro
2008-01-25 17:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-01-18 20:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-17 13:22 --------- d-----w C:\Program Files\iTunes
2008-01-17 13:19 --------- d-----w C:\Program Files\QuickTime
2008-01-08 14:15 --------- d-----w C:\Program Files\Snood
2008-01-08 14:10 --------- d-----w C:\Program Files\Azureus
2008-01-08 13:33 --------- d-----w C:\Program Files\Common Files\Peach
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-30 08:01 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"AdobeUpdater"="C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-02-28 22:06 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" [2005-11-02 23:32 372813]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 01:05 122939]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 01:01 110592]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 08:04 53248]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-09-20 08:35 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-09-20 08:32 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-09-20 08:36 114688]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-19 08:24 180269]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 10:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 18:51 39792]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-10 15:27 385024]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-01-15 03:22 267048]
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-09-25 09:12 90112]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-05-08 09:28 1015808]

C:\Documents and Settings\Andrew Rush\Start Menu\Programs\Startup\
palmOne Registration.lnk - C:\Program Files\palmOne\register.exe [2005-09-19 12:20:36 2367488]
Trillian.lnk - C:\Program Files\Trillian\trillian.exe [2007-12-11 1873280]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HOTSYNCSHORTCUTNAME.lnk - C:\Program Files\palmOne\Hotsync.exe [2004-06-09 13:27:34 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)


*Newly Created Service* - WUDFPF
*Newly Created Service* - WUDFSVC
.
Contents of the 'Scheduled Tasks' folder
"2008-02-07 03:56:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-12 14:52:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-02-12 14:53:31
ComboFix-quarantined-files.txt 2008-02-12 19:52:59
ComboFix2.txt 2008-02-11 13:51:27
ComboFix3.txt 2008-02-08 20:43:33
ComboFix4.txt 2008-02-01 14:26:44
.
2008-01-09 13:37:08 --- E O F ---

[fadingcaptain]

New HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:55, on 2008-02-12
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 7726 bytes

[__RiP_ChAiN_]

Hello fadingcaptain :)

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

Please download DrWeb-CureIt (ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe) & save it to your desktop. DO NOT perform a scan yet.

Reboot your computer in "SAFE MODE (http://www.bleepingcomputer.com/forums/tutorial61.html)" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Scan with DrWeb-CureIt as follows: Double-click on drweb-cureit.exe to start the program. An "Express Scan of your PC" notice will appear.
Under "Start the Express Scan Now", Click "OK" to start. This is a short scan that will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it.
Once the short scan has finished, Click Options > Change settings
Choose the "Scan tab" and UNcheck "Heuristic analysis"
Back at the main window, click "Custom Scan", then Select drives (a red dot will show which drives have been chosen).
Then click the "Start/Stop Scanning" button (green arrow on the right) and the scan will start.
When done, a message will be displayed at the bottom advising if any viruses were found.
Click "Yes to all" if it asks if you want to cure/move the file.
When the scan has finished, look if you can see the icon next to the files found. If so, click it, then click the next icon right below and select "Move incurable".
(This will move it to the C:\Documents and Settings\userprofile\DoctorWeb\Quarantine folder if it can't be cured)
Next, in the Dr.Web CureIt menu on top, click file and choose save report list.
Save the DrWeb.csv report to your desktop.
Exit Dr.Web Cureit when done.
Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log from Dr.Web in your next reply. (You can use Notepad to open the DrWeb.cvs report)

[fadingcaptain]

CureIt log:

Proof.dll;C:\Documents and Settings\tsguest\Application Data\Microsoft;Trojan.Fakealert;Deleted.;
qrzol.exe.vir;C:\QooBox\Quarantine\C\Program Files\Common Files\qrzo;Trojan.DownLoader.11354;Deleted.;
qrzop.exe.vir;C:\QooBox\Quarantine\C\Program Files\Common Files\qrzo;Adware.TargetServer;Moved.;
qrzoc.dll.vir;C:\QooBox\Quarantine\C\Program Files\Common Files\qrzo\qrzod;Adware.TargetServer;Moved.;
UnInstall.exe.vir;C:\QooBox\Quarantine\C\Program Files\Insider;Trojan.Rond.origin;Incurable.Moved.;
kernInst.exe.vir;C:\QooBox\Quarantine\C\Program Files\Temporary;Trojan.Winpop.origin;Incurable.Moved.;
b103.exe.vir;C:\QooBox\Quarantine\C\WINDOWS;Trojan.Rond;Deleted.;
b116.exe.vir;C:\QooBox\Quarantine\C\WINDOWS;Trojan.MulDrop.9222;Deleted.;
fgdnvrsy.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Click.16975;Deleted.;
hph.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Adware.ClickSpring.origin;Moved.;
ohlhdtfu.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.260;Deleted.;
rrmglwvh.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\system32;Trojan.Virtumod.260;Deleted.;
asappsrv.dll.vir;C:\QooBox\Quarantine\C\WINDOWS\T3duZXI;Trojan.Proxy.493;Deleted.;
smss.exe.vir;C:\QooBox\Quarantine\C\WINDOWS\WNSXS~1;Trojan.DownLoader.origin;Incurable.Moved.;
Process.exe;C:\SDFix\apps;Tool.Prockill;Moved.;
Dot1XCfg.exe;C:\SDFix\backups_old2;Trojan.Stars.184;Deleted.;
A0050580.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP797;Trojan.Popuper;Deleted.;
A0050582.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP797;Trojan.Popuper;Deleted.;
A0050583.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP797;Trojan.Fakealert;Deleted.;
A0052738.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP822;Trojan.DownLoader.45546;Deleted.;
A0052779.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP823;Trojan.DownLoader.45546;Deleted.;
A0054234.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824;Adware.Ttc;Moved.;
A0054237.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824;Adware.ClickSpring - read error;;
A0054241.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824;Trojan.DnsChange;Deleted.;
A0054244.exe\data002;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824\A0054244.exe;Trojan.DownLoader.origin;;
A0054244.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824;Archive contains infected objects;Moved.;
A0054258.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP824;Trojan.Virtumod.268;Deleted.;
A0054301.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;Adware.TargetServer;Moved.;
A0054302.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;BackDoor.Vomba;Deleted.;
A0054304.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;Trojan.DownLoader.45546;Deleted.;
A0054306.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;Trojan.Proxy.493;Deleted.;
A0054307.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;Trojan.Insider;Deleted.;
A0054308.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP825;Trojan.DownLoader.11355;Deleted.;
A0055102.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Rond;Deleted.;
A0055104.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.MulDrop.9222;Deleted.;
A0055109.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Adware.ClickSpring.origin;Moved.;
A0055110.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Click.16975;Deleted.;
A0055112.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Virtumod.260;Deleted.;
A0055115.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Rond.origin;Incurable.Moved.;
A0055118.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Winpop.origin;Incurable.Moved.;
A0055119.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.DownLoader.origin;Incurable.Moved.;
A0055121.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.DownLoader.11354;Deleted.;
A0055124.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Adware.TargetServer;Moved.;
A0055125.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Adware.TargetServer;Moved.;
A0055130.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Virtumod.268;Deleted.;
A0055132.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Virtumod.260;Deleted.;
A0055143.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP829;Trojan.Virtumod.260;Deleted.;
A0055283.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP831;Trojan.Stars.184;Deleted.;
A0056012.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP842;Trojan.Proxy.493;Deleted.;
A0056596.dll;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP846;Trojan.Fakealert;Deleted.;
A0056597.exe;C:\System Volume Information\_restore{C0DBE494-8501-40C0-AAC9-D8981BB43087}\RP846;Trojan.Stars.184;Deleted.;
ldC664.tmp;C:\WINDOWS\system32\1024;Trojan.Fakealert;Deleted.;
ldFF71.tmp;C:\WINDOWS\system32\1024;Trojan.Fakealert;Deleted.;

[__RiP_ChAiN_]

Hello fadingcaptain :)

Please post back with a new HijackThis log, and and update on how your computer is currently running.

[fadingcaptain]

HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:26:42 AM, on 02/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe
C:\WINDOWS\TEMP\IH57A6.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\Trillian\trillian.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\iTunes\iTunes.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe
C:\Program Files\Sage Software\Peachtree\peachw.exe
C:\Program Files\Sage Software\Peachtree\W32MKDE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\Trend Micro\Client Server Security Agent\pccntmon.exe" -HideWindow
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: palmOne Registration.lnk = C:\Program Files\palmOne\register.exe
O4 - Startup: Trillian.lnk = C:\Program Files\Trillian\trillian.exe
O4 - Global Startup: HOTSYNCSHORTCUTNAME.lnk = C:\Program Files\palmOne\Hotsync.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3BFFE033-BF43-11D5-A271-00A024A51325} (iNotes6 Class) - https://email1.uncg.edu/iNotes6W.cab
O16 - DPF: {A922B6AB-3B87-11D3-B3C2-0008C7DA6CB9} (InetDownload Class) - https://media.pineconeresearch.com/ActiveX/downloadcontrol.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\Software\..\Telephony: DomainName = TSNetServer.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = TSNetServer.local
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = TSNetServer.local
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Client/Server Security Agent RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\ntrtscan.exe
O23 - Service: Trend Micro Client/Server Security Agent Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\Trend Micro\Client Server Security Agent\tmlisten.exe

--
End of file - 7907 bytes


My machine seems to be running great. I haven't had any popups, and there seems to be nothing out of the ordinary.

[__RiP_ChAiN_]

Hello fadingcaptain :)

Time for some housekeeping

Click START then RUN
Now type Combofix /u in the runbox and click OK


http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png


When shown the disclaimer, Select "2"

The above procedure will:

Delete the following:
ComboFix and its associated files and folders.
VundoFix backups, if present
The C:\Deckard folder, if present
The C:_OtMoveIt folder, if present

Reset the clock settings.
Hide file extensions, if required.
Hide System/Hidden files, if required.
Reset System Restore.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.

Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

See this link for a listing of some online & their stand-alone antivirus programs:

Virus, Spyware, and Malware Protection and Removal Resources (http://www.bleepingcomputer.com/forums/topict405.html)

Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

For a tutorial on Firewalls and a listing of some available ones see the link below:

Understanding and Using Firewalls (http://www.bleepingcomputer.com/forums/tutorial60.html)

Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

A tutorial on installing & using this product can be found here:

Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/forums/tutorial49.html)

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety
IE/Spyad (http://www.bleepingcomputer.com/tutorials/tutorial53.html) <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Google Toolbar (http://toolbar.google.com/) <= Get the free google toolbar to help stop pop up windows.
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)

[fadingcaptain]

Thank you so much for all of your help! I truly appreciate it.

fadingcaptain.

[__RiP_ChAiN_]

Your very welcome fadingcaptain :)