need help with smithfruad. Can you help? have read several threads from other forums and want to get it right the first time.
Here is the HJT
ComboFix 08-03-27.1 - Thomas 2008-03-28 14:09:18.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.254 [GMT -5:00]
Running from: C:\Documents and Settings\Thomas\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Thomas\Application Data\WNSXS~1
C:\Documents and Settings\Thomas\Application Data\WNSXS~1\??rss.exe
C:\Program Files\install provider
C:\Program Files\install provider\InstallProvider.dlldat
C:\Program Files\JavaCore
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\JavaCore\UnInstall.exe
C:\Program Files\MSN\lavufawe17.dll
C:\Program Files\MSN\lavufawe29.dll
C:\Program Files\MSN\lavufawe320.dll
C:\Program Files\MSN\lavufawe373.dll
C:\Program Files\NoDNS
C:\Program Files\NoDNS\UnInstall.exe
C:\Program Files\outerinfo
C:\Program Files\Temporary
C:\Temp\isgTi19
C:\temp\tn3
C:\WINDOWS\BMc3157e93.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\mbols~1
C:\WINDOWS\mbols~1\??mbols\
C:\WINDOWS\mbols~1\scanregw.exe
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bbrqncxt.dll
C:\WINDOWS\system32\d4
C:\WINDOWS\system32\dsgrgnkn.dll
C:\WINDOWS\system32\e5
C:\WINDOWS\system32\e5\idencom1.exe
C:\WINDOWS\system32\eeowvkrr.dll
C:\WINDOWS\system32\fsrwqjvk.dll
C:\WINDOWS\system32\ftshelkp.ini
C:\WINDOWS\system32\g7
C:\WINDOWS\system32\gnwmhucu.dll
C:\WINDOWS\system32\hgnrjvno.dll
C:\WINDOWS\system32\hxtggcey.dll
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\ihkmp.ini2
C:\WINDOWS\system32\ijkkj.ini
C:\WINDOWS\system32\ijkkj.ini2
C:\WINDOWS\system32\irqxmctd.dll
C:\WINDOWS\system32\jkkji.dll
C:\WINDOWS\system32\lvrdatcd.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\nGpxx07
C:\WINDOWS\system32\nGpxx07\nGpxx071084.exe
C:\WINDOWS\system32\nkngrgsd.ini
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pklehstf.dll
C:\WINDOWS\system32\ptz.dll
C:\WINDOWS\system32\qommlij.dll
C:\WINDOWS\system32\t3
C:\WINDOWS\system32\t3\pepsco32.exe
C:\WINDOWS\system32\w8
C:\WINDOWS\system32\winlogo.exe
C:\WINDOWS\system32\wpeiotnr.dll
C:\WINDOWS\system32\wvuvwvs.dll
C:\WINDOWS\system32\xxyvvtq.dll
C:\WINDOWS\system32\yvmyjrbw.dll
C:\WINDOWS\tk58.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_NETWORK_MONITOR
((((((((((((((((((((((((( Files Created from 2008-02-28 to 2008-03-28 )))))))))))))))))))))))))))))))
.
2008-03-28 14:13 . 2008-03-28 14:13 <DIR> d-------- C:\temp\tn3
2008-03-28 13:35 . 2008-03-28 13:35 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-28 13:35 . 2008-03-28 13:44 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-03-28 13:27 . 2008-03-28 13:27 23,552 --a------ C:\Documents and Settings\Thomas\winlogo.exe
2008-03-28 13:27 . 2008-03-28 13:27 223 --a------ C:\Documents and Settings\Thomas\6521.bat
2008-03-28 13:25 . 2008-03-28 13:34 <DIR> d-------- C:\Documents and Settings\Thomas\Application Data\AVG7
2008-03-28 13:25 . 2008-03-28 13:25 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\AVG7
2008-03-28 13:24 . 2008-03-28 13:24 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Grisoft
2008-03-28 13:24 . 2008-03-28 13:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\avg7
2008-03-28 12:07 . 2008-03-28 12:07 <DIR> d-------- C:\Program Files\Windows Defender
2008-03-28 12:06 . 2008-03-28 12:06 223 --a------ C:\Documents and Settings\Thomas\5733.bat
2008-03-28 11:19 . 2008-03-28 13:12 549 --a------ C:\WINDOWS\wininit.ini
2008-03-28 10:41 . 2008-03-28 10:45 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-03-28 10:41 . 2008-03-28 10:41 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-03-28 10:20 . 2008-03-28 10:20 <DIR> d-------- C:\Program Files\Executive Software
2008-03-28 10:17 . 2008-03-28 10:17 <DIR> d-------- C:\Program Files\CCleaner
2008-03-28 10:16 . 2008-03-28 13:13 4,236,457 --ahs---- C:\WINDOWS\system32\ydiincqk.ini
2008-03-20 14:55 . 2008-03-21 09:49 414 --ahs---- C:\WINDOWS\system32\yepealju.ini
2008-03-19 14:14 . 2008-03-19 14:14 5,120 --ahs---- C:\WINDOWS\system32\Thumbs.db
2008-03-18 10:56 . 2008-03-19 13:06 1,326,426 --ahs---- C:\WINDOWS\system32\lvsfhgal.ini
2008-03-18 10:55 . 2008-03-28 13:55 <DIR> d-------- C:\Program Files\CPV
2008-03-17 16:18 . 2008-03-18 10:55 1,359,127 --ahs---- C:\WINDOWS\system32\rujmtaqe.ini
2008-03-17 16:08 . 2008-03-17 16:08 <DIR> d-------- C:\WINDOWS\Ad-Ware Pro
2008-03-14 12:55 . 2008-03-17 16:15 1,366,803 --ahs---- C:\WINDOWS\system32\jsioihfv.ini
2008-03-14 12:49 . 2008-03-28 13:44 <DIR> d-------- C:\Program Files\nvcoi
2008-03-14 12:49 . 2008-03-14 12:49 223 --a------ C:\Documents and Settings\Thomas\7453.bat
2008-03-13 14:27 . 2008-03-13 14:27 223 --a------ C:\Documents and Settings\Thomas\1565.bat
2008-03-13 14:12 . 2008-03-13 14:12 223 --a------ C:\Documents and Settings\Thomas\7808.bat
2008-03-13 13:57 . 2008-03-13 13:57 223 --a------ C:\Documents and Settings\Thomas\4080.bat
2008-03-13 13:42 . 2008-03-13 13:42 223 --a------ C:\Documents and Settings\Thomas\2423.bat
2008-03-13 13:27 . 2008-03-13 13:27 223 --a------ C:\Documents and Settings\Thomas\3019.bat
2008-03-13 13:13 . 2008-03-13 13:13 223 --a------ C:\Documents and Settings\Thomas\5336.bat
2008-03-13 12:57 . 2008-03-13 12:57 223 --a------ C:\Documents and Settings\Thomas\7677.bat
2008-03-13 12:42 . 2008-03-13 12:42 223 --a------ C:\Documents and Settings\Thomas\2834.bat
2008-03-13 12:27 . 2008-03-13 12:27 223 --a------ C:\Documents and Settings\Thomas\9763.bat
2008-03-13 12:12 . 2008-03-13 12:12 223 --a------ C:\Documents and Settings\Thomas\8048.bat
2008-03-13 11:57 . 2008-03-13 11:57 223 --a------ C:\Documents and Settings\Thomas\7138.bat
2008-03-13 11:42 . 2008-03-13 11:42 223 --a------ C:\Documents and Settings\Thomas\2755.bat
2008-03-13 10:30 . 2008-03-13 10:30 223 --a------ C:\Documents and Settings\Thomas\3414.bat
2008-03-13 10:11 . 2008-03-17 16:12 <DIR> d-------- C:\Program Files\Registry Defender
2008-03-13 10:05 . 2008-03-13 10:05 <DIR> d-------- C:\Program Files\RegistryCleanFixer2008
2008-03-13 10:00 . 2008-03-13 10:00 223 --a------ C:\WINDOWS\system32\6177.bat
2008-03-13 09:56 . 2008-03-13 09:56 118 --a------ C:\WINDOWS\system32\MRT.INI
2008-03-13 09:47 . 2008-03-13 09:47 <DIR> d-------- C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\Yahoo!
2008-03-13 08:53 . 2008-03-13 08:53 <DIR> d-------- C:\WINDOWS\system32\iDlo05
2008-03-11 15:05 . 2008-03-28 14:14 218,606 --a------ C:\Program Files\c.zip
2008-03-11 15:05 . 2008-03-28 14:14 217,706 --a------ C:\Program Files\b.zip
2008-03-11 15:05 . 2008-03-28 14:14 217,706 --a------ C:\Program Files\a.zip
2008-03-11 15:05 . 2008-03-11 15:05 147,456 --a------ C:\WINDOWS\system32\vbzip10.dll
2008-03-04 16:32 . 2008-03-04 14:32 105,984 --------- C:\WINDOWS\b152.exe_tobedeleted_old
2008-02-29 15:07 . 2008-03-20 15:41 <DIR> d-------- C:\Documents and Settings\Thomas\Application Data\LimeWire
2008-02-29 15:04 . 2008-02-22 02:33 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-02-29 14:59 . 2008-02-29 15:04 <DIR> d-------- C:\Program Files\LimeWire
2008-02-29 14:58 . 2008-02-29 14:59 4,506,256 --a------ C:\LimeWireWin.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-28 19:14 417,792 ----a-w C:\Program Files\Video.exe
2008-03-28 19:14 417,792 ----a-w C:\Program Files\Track_03.exe
2008-03-28 19:14 25,214 ----a-w C:\Program Files\B.ico
2008-03-28 19:14 25,214 ----a-w C:\Program Files\A.ico
2008-03-28 18:42 9,344 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-03-28 18:42 8,320 ----a-w C:\WINDOWS\system32\drivers\AWRTRD.sys
2008-03-28 18:35 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-03-28 18:23 --------- d-----w C:\Program Files\Java
2008-03-20 20:22 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-03-20 20:22 --------- d-----w C:\Program Files\TweakNow PowerPack 2006
2008-03-17 21:08 --------- d-----w C:\Program Files\Common Files\HP
2008-03-13 16:36 417,792 ----a-w C:\Program Files\Setup.exe
2008-03-13 13:54 86,016 ----a-w C:\WINDOWS\system32\drivers\dxapii.sys
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(9).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(8).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(7).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(6).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(5).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(4).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(3).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(2).dsk
2008-03-13 13:54 167,545 ----a-w C:\WINDOWS\system32\drivers\core.cache(10).dsk
2008-03-13 13:54 167,545 ------w C:\WINDOWS\system32\drivers\core.cache.dsk
2008-02-29 20:43 --------- d-----w C:\Program Files\EPSON Print CD
2008-02-27 19:55 --------- d-----w C:\Program Files\Common Files\Magix Shared
2008-02-07 19:57 --------- d-----w C:\Documents and Settings\Joseph\Application Data\Ahead
2008-02-06 15:52 --------- d-----w C:\Program Files\Rainbow Technologies
2007-06-13 10:23 78,360 --sha-r C:\WINDOWS\system32\p2pnetworking.exe
2005-07-29 21:24 472 --sha-r C:\WINDOWS\VGhvbWFzIEZlcnJlcg\p31SvqIWKHt5wBL5w0.vbs
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15421B84-3488-49A7-AD18-CBF84A3EFAF6}]
C:\Program Files\CPV\CPV7.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{40943d6c-10ba-4431-b1ae-dfbd113ff605}]
C:\WINDOWS\system32\cffexwes.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{65485F41-EB99-46EF-E19E-259FBC232778}]
C:\Program Files\MSN\lavufawe352.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88CA7762-EC95-4835-AF10-8A0F5743CFBF}]
C:\WINDOWS\system32\pmkhi.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 07:00 15360]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 18:05 143360]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 19:04 5562368]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 11:24 1694208]
"RegistryCleanFixMFC"="C:\Program Files\RegistryCleanFixer2008\RegistryCleanFixer2008.exe" [2008-02-26 15:02 10760325]
"nvcoi"="C:\Program Files\nvcoi\nvcoi.exe" [ ]
"Oane"="C:\WINDOWS\MBOLS~1\scanregw.exe" [ ]
"Ptxjelvf"="C:\Documents and Settings\Thomas\Application Data\W?nSxS\??rss.exe" [ ]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 01:07 8491008]
"nwiz"="nwiz.exe" [2007-09-17 01:07 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 01:07 81920]
"EPSON Stylus Photo R220 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"RTHDCPL"="RTHDCPL.EXE" [2007-09-19 18:14 16844800 C:\WINDOWS\RTHDCPL.exe]
"RoxioEngineUtility"="C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe" [2003-05-01 18:44 65536]
"RoxioDragToDisc"="C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe" [2003-10-16 20:15 868352]
"RoxioAudioCentral"="C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe" [2003-07-15 12:38 319488]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-05-11 23:12 49152]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 15:40 155648]
"EPSON Stylus Photo R220 Series (Copy 1)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"EPSON Stylus Photo R220 Series (Copy 2)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2005-01-12 03:01 32768]
"EPSON Stylus Photo R220 Series (Copy 3)"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.exe" [2005-03-09 04:00 98304]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-03 23:33 582992]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 09:59 224248]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 04:42 144784]
"c0264d0f"="C:\WINDOWS\system32\kqcniidy.dll" [ ]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20 866584]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-28 13:24 579072]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-08-13 19:04 5562368]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-28 13:24 219136]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
dllhost.exe [2008-03-13 11:36:00 417792]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvwvs]
wvuvwvs.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
R1 dxapii;dxapii;C:\WINDOWS\system32\drivers\dxapii.sys [2008-03-13 08:54]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3f94b0e2-71cb-11dc-97fe-001731053070}]
\Shell\AutoRun\command - Autorun.exe /run
\Shell\Shell00\Command - Autorun.exe /run
\Shell\Shell01\Command - Autorun.exe /action
\Shell\Shell02\Command - Autorun.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-11-20 20:51:22 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe'
"2007-11-20 20:51:21 C:\WINDOWS\Tasks\McQcTask.job"
- c:\PROGRA~1\mcafee\mqc\QcConsol.exe
"2008-03-28 18:32:57 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
disk not found C:\
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk not found C:\
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\ArcSoft\PhotoImpression 5\share\pihook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\dllhost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
.
**************************************************************************
.
Completion time: 2008-03-28 14:17:25 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-28 19:16:34
Pre-Run: 205,941,149,696 bytes free
Post-Run: 205,898,285,056 bytes free
.
2008-03-20 15:19:16 --- E O F ---
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, March 28, 2008 4:15:52 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 28/03/2008
Kaspersky Anti-Virus database records: 668934
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Thomas\LOCALS~1\Temp\
Scan Statistics:
Total number of scanned objects: 18648
Number of viruses found: 1
Number of infected objects: 1
Number of suspicious objects: 0
Duration of the scan process: 00:15:39
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\b152.exe_tobedeleted_old Infected: not-a-virus:AdWare.Win32.Insider.c skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\regedit.exe Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\cmd.exe Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\core.cache.dsk Object is locked skipped
C:\WINDOWS\system32\drivers\dxapii.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\iDlo05\iDlo051080.exe Object is locked skipped
C:\WINDOWS\system32\ipconfig.exe Object is locked skipped
C:\WINDOWS\system32\netstat.exe Object is locked skipped
C:\WINDOWS\system32\ping.exe Object is locked skipped
C:\WINDOWS\system32\regedt32.exe Object is locked skipped
C:\WINDOWS\system32\taskkill.exe Object is locked skipped
C:\WINDOWS\system32\taskmgr.exe Object is locked skipped
C:\WINDOWS\system32\tracert.exe Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\mcmsc_3Gud0wIDXW93Ns7 Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\hsperfdata_Thomas\3004 Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\~DF39F9.tmp Object is locked skipped
C:\DOCUME~1\Thomas\LOCALS~1\Temp\~DFDC33.tmp Object is locked skipped
Scan process completed.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:52:22 PM, on 3/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\WINDOWS\RTHDCPL.EXE
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\Playlist.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\dllhost.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Thomas\Desktop\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - (no file)
O2 - BHO: {506ff311-dbfd-ea1b-1344-ab01c6d34904} - {40943d6c-10ba-4431-b1ae-dfbd113ff605} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: 0 - {65485F41-EB99-46EF-E19E-259FBC232778} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {88CA7762-EC95-4835-AF10-8A0F5743CFBF} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P30 "EPSON Stylus Photo R220 Series" /O6 "USB001" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [RoxioEngineUtility] "C:\Program Files\Common Files\Roxio Shared\System\EngUtil.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy CD Creator 6\DragToDisc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxioAudioCentral] "C:\Program Files\Roxio\Easy CD Creator 6\AudioCentral\RxMon.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 1)" /O6 "USB003" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 2)" /O6 "USB004" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [RemoteControl] C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [EPSON Stylus Photo R220 Series (Copy 3)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIA.EXE /P39 "EPSON Stylus Photo R220 Series (Copy 3)" /O6 "USB005" /M "Stylus Photo R220"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\RunOnce: [SpybotDeletingA9230] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC5743] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [RegistryCleanFixMFC] C:\Program Files\RegistryCleanFixer2008\RegistryCleanFixer2008.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB9214] command /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD345] cmd /c del "C:\WINDOWS\system32\drivers\core.cache.dsk_tobedeleted"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: dllhost.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1191426921171
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192804088906
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O20 - Winlogon Notify: wvuvwvs - wvuvwvs.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Diskeeper - Executive Software International, Inc. - C:\Program Files\Executive Software\DiskeeperLite\DKService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
--
End of file - 12427 bytes