View Full Version : virtumonde?
juanacuna24
2008-06-29, 16:53
hello i really need help because this annoying virus is on my system! First of all the explorer.exe goes away then a few days ago my task manager was disabled and i couldnt start it, and also my computer is going super slow.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:52:18 AM, on 6/29/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\ALCMTR.EXE
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Avant Browser\avant.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Config\csrss.exe
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: gxvpsafm - {5EFBB043-CFEC-4A57-BFE7-38FDC518108F} - C:\WINDOWS\gxvpsafm.dll (file missing)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [40ab002f] rundll32.exe "C:\WINDOWS\system32\bdtskgwo.dll",b
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211586668078
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211586659406
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll,avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
O23 - Service: Microsoft security update service (msupdate) - Unknown owner - c:\windows\system32\..\svchost.exe (file missing)
--
End of file - 9359 bytes
Hi juanacuna24
We need first to disable TeaTimer that it doesn't interfere with fixes. You can re-enable it when you're clean again:
1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.
1. Download combofix from any of these links and save it to Desktop:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
**Note: It is important that it is saved directly to your desktop**
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
If you have problems with Combofix usage, see here (http://www.bleepingcomputer.com/combofix/how-to-use-combofix)
Post:
- a fresh HijackThis log
- combofix report
A word of warning: Please do not run ComboFix on your own. This tool is not a toy and not for everyday use.
juanacuna24
2008-07-01, 21:12
My Hijackthis log and combofix
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:03, on 2008-07-01
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\BitTorrent\bittorrent.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\ALCMTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\COMODO\Firewall\cfpupdat.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7FC6B132-EA18-4D69-86E0-423E7B940BDC} - C:\WINDOWS\system32\yaywxXnm.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: gxvpsafm - {5EFBB043-CFEC-4A57-BFE7-38FDC518108F} - C:\WINDOWS\gxvpsafm.dll (file missing)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [40ab002f] rundll32.exe "C:\WINDOWS\system32\bdtskgwo.dll",b
O4 - HKLM\..\Run: [SpybotSnD] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe"
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211586668078
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211586659406
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - Winlogon Notify: yaywxXnm - yaywxXnm.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
--
End of file - 10019 bytes
ComboFix 08-06-30.2 - HP_Administrator 2008-07-01 13:43:50.2 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.357 [GMT -5:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\system32\abcheqfp.ini
C:\WINDOWS\system32\pfqehcba.dll
C:\WINDOWS\system32\QWDLlUtv.ini
C:\WINDOWS\system32\QWDLlUtv.ini2
C:\WINDOWS\system32\vtUlLDWQ.dll
D:\Autorun.inf
.
---- Previous Run -------
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\begtcqkl.dll
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\ejfycqtj.dll
C:\WINDOWS\system32\fkcdxwsf.ini
C:\WINDOWS\system32\fswxdckf.dll
C:\WINDOWS\system32\jtqcyfje.ini
C:\WINDOWS\system32\jusyepnl.ini
C:\WINDOWS\system32\lkqctgeb.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\owgkstdb.ini
C:\WINDOWS\system32\QWDLlUtv.ini
C:\WINDOWS\system32\QWDLlUtv.ini2
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_MSUPDATE
-------\Service_msupdate
-------\Legacy_MSUPDATE
-------\Service_msupdate
((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.
C:\ComboFix\CreateC00.bat .
2008-06-29 16:34 . 2008-06-29 16:34 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-06-29 10:54 . 2008-06-29 10:54 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-06-29 10:52 . 2008-06-29 10:52 319 --a------ C:\WINDOWS\game.ini
2008-06-28 20:48 . 2008-06-28 20:48 <DIR> d-------- C:\VundoFix Backups
2008-06-28 19:20 . 2008-06-28 19:21 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-28 19:20 . 2008-06-28 20:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-28 11:01 . 2008-06-28 12:09 <DIR> d-------- C:\Other
2008-06-28 10:06 . 2008-06-28 10:10 4,642 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-28 10:03 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-28 10:03 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-28 10:03 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-28 10:03 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-28 10:03 . 2008-06-23 23:34 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-06-28 10:03 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-28 10:03 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-28 10:03 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-28 09:58 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-27 20:26 . 2008-06-28 17:39 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-27 20:19 . 2008-06-27 20:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HPQ
2008-06-27 20:09 . 2008-06-27 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Auslogics
2008-06-27 19:47 . 2008-06-27 19:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools
2008-06-27 19:40 . 2008-06-27 19:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SPORE Creature Creator
2008-06-27 19:32 . 2008-06-27 19:32 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3
2008-06-27 18:57 . 2008-07-01 12:47 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-27 18:57 . 2008-06-27 18:57 <DIR> d-------- C:\Program Files\AVG
2008-06-27 18:57 . 2008-06-27 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-27 18:57 . 2008-06-27 18:57 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-27 18:57 . 2008-06-27 18:57 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-27 18:57 . 2008-06-27 18:57 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-27 18:51 . 2008-06-27 18:51 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-27 18:25 . 2008-06-27 18:26 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX
2008-06-25 19:33 . 2008-06-25 19:33 <DIR> dr------- C:\Documents and Settings\HP_Administrator\Application Data\SecuROM
2008-06-25 10:02 . 2008-06-25 10:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-24 13:38 . 2008-06-24 13:39 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-23 18:47 . 2008-06-23 18:47 <DIR> d-------- C:\Program Files\Maxis
2008-06-23 18:47 . 2008-06-23 18:47 538 --a------ C:\WINDOWS\eReg.dat
2008-06-22 18:21 . 2008-06-23 13:39 158 --a------ C:\WINDOWS\TSDataEx.ini
2008-06-22 17:50 . 2008-06-25 20:41 <DIR> d-------- C:\Program Files\Microsoft Games
2008-06-22 16:05 . 2008-06-22 17:03 <DIR> d-------- C:\Program Files\SimBin
2008-06-21 17:24 . 2008-06-29 11:39 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-21 17:24 . 2008-06-21 17:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-21 16:33 . 2008-06-21 16:33 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Ideas From the Deep
2008-06-21 16:33 . 2008-06-21 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ideas From the Deep
2008-06-21 16:30 . 2008-06-25 20:21 <DIR> d-------- C:\Program Files\Ideas From the Deep
2008-06-21 09:52 . 2004-08-10 07:00 66,082 --a------ C:\WINDOWS\system32\dllcache\c_10021.nls
2008-06-21 09:52 . 2004-08-10 07:00 66,082 --a------ C:\WINDOWS\system32\c_10021.nls
2008-06-21 09:52 . 2004-08-10 07:00 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll
2008-06-21 09:52 . 2004-08-10 07:00 6,144 --a------ C:\WINDOWS\system32\dllcache\ftlx041e.dll
2008-06-20 18:10 . 2008-06-20 18:10 <DIR> d-------- C:\Program Files\TrackerChecker
2008-06-20 17:58 . 2008-06-20 17:58 <DIR> d-------- C:\Program Files\WOT
2008-06-20 09:40 . 2008-06-20 09:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Auslogics
2008-06-19 18:33 . 2008-06-19 18:33 <DIR> d-------- C:\Program Files\Demonoid Invitation Generator
2008-06-19 17:52 . 2008-06-01 11:46 32,768 --a------ C:\WINDOWS\system32\Yahoo.exe
2008-06-18 20:01 . 2008-06-18 20:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\DoctorWeb
2008-06-18 14:46 . 2008-06-18 14:46 <DIR> d-------- C:\WINDOWS\Bus Driver
2008-06-18 14:46 . 2008-06-18 14:47 <DIR> d-------- C:\Program Files\Bus Driver
2008-06-18 13:01 . 2008-06-18 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WildTangent
2008-06-18 12:59 . 2008-06-18 14:23 <DIR> d-------- C:\Program Files\WildGames
2008-06-17 10:18 . 2008-06-25 20:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-17 10:04 . 2008-06-29 13:21 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\SPORE Creature Creator
2008-06-17 09:44 . 2008-06-17 09:44 <DIR> d-------- C:\ProgramData
2008-06-17 09:43 . 2008-06-17 10:25 8,112 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-06-15 16:47 . 2008-06-16 11:44 <DIR> d-------- C:\Program Files\NoLimits Coasters v1.6
2008-06-14 16:39 . 2008-06-14 16:39 361,344 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-06-14 16:39 . 2008-06-14 16:39 361,344 --a------ C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-06-14 12:23 . 2008-06-14 12:23 <DIR> d-------- C:\Program Files\BitTorrent
2008-06-14 12:23 . 2008-07-01 13:22 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\BitTorrent
2008-06-13 12:18 . 2008-06-27 20:11 5,536 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-12 11:15 . 2008-06-17 09:44 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-06-12 11:13 . 2008-06-26 12:47 <DIR> d-------- C:\Program Files\Electronic Arts
2008-06-12 11:05 . 2008-06-19 17:56 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SACore
2008-06-12 10:57 . 2008-06-15 09:47 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-06-11 20:56 . 2008-06-11 20:56 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-11 20:55 . 2008-06-11 20:55 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\DAEMON Tools
2008-06-11 20:51 . 2008-06-26 12:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-06-11 17:54 . 2008-06-11 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-06-11 17:53 . 2008-06-11 20:41 <DIR> d-------- C:\Program Files\Pogo Games
2008-06-11 17:49 . 2008-06-11 17:49 <DIR> d-------- C:\Program Files\uTorrent
2008-06-11 17:49 . 2008-06-25 18:35 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\uTorrent
2008-06-11 11:47 . 2008-05-08 09:02 203,136 --a------ C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-11 11:46 . 2008-06-13 06:05 272,128 --a------ C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-11 11:40 . 2005-04-27 13:37 77,824 -ra------ C:\WINDOWS\system32\hpzids01.dll
2008-06-11 11:40 . 2005-04-08 19:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-06-11 11:39 . 2008-06-11 12:03 78,999 --a------ C:\WINDOWS\hpfins05.dat
2008-06-11 11:39 . 2005-05-23 12:51 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-06-11 11:38 . 2008-06-11 11:38 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\HP
2008-06-09 17:56 . 2008-06-09 17:56 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-09 17:54 . 2008-06-10 10:22 <DIR> d-------- C:\Program Files\McAfee
2008-06-07 16:35 . 2008-06-07 16:35 <DIR> d-------- C:\temp
2008-06-07 16:31 . 2008-06-07 16:36 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-07 16:31 . 2008-06-07 16:31 <DIR> d-------- C:\Program Files\CCleaner
2008-06-05 10:46 . 2008-06-20 09:33 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Auslogics
2008-06-04 19:14 . 2008-04-13 19:12 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-06-04 19:14 . 2008-04-13 13:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-04 19:14 . 2008-04-13 13:45 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-04 19:14 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-06-04 14:27 . 2008-06-29 20:24 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\U3
2008-06-03 13:26 . 2008-06-03 13:26 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Atari
2008-06-03 13:25 . 2008-06-12 16:43 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-06-03 13:20 . 2008-06-03 13:20 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Leadertech
2008-06-03 13:07 . 2008-06-24 13:39 <DIR> d-------- C:\Program Files\Atari
2008-06-02 17:52 . 2008-06-20 13:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-02 17:52 . 2008-06-09 17:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-02 16:57 . 2008-06-09 13:09 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
2008-06-01 16:53 . 2005-06-08 12:58 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2008-06-01 09:38 . 2008-06-01 09:38 <DIR> d-------- C:\Program Files\Intel
2008-06-01 09:38 . 2008-06-01 09:38 <DIR> d-------- C:\Intel
2008-06-01 09:38 . 2007-07-26 16:15 53,248 --a------ C:\WINDOWS\system32\CSVer.dll
2008-06-01 09:35 . 2008-06-01 09:35 <DIR> d-------- C:\IEGD
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 03:00 --------- d-----w C:\Program Files\EA GAMES
2008-06-29 16:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-28 00:41 12,400 ----a-w C:\WINDOWS\system32\drivers\SecDrv.sys
2008-06-28 00:09 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 14:44 --------- d-----w C:\Program Files\Avant Browser
2008-06-22 23:05 --------- d-----w C:\Program Files\Easy Internet signup
2008-06-20 22:59 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Avant Profiles
2008-06-20 18:10 --------- d-----w C:\Program Files\SpywareBlaster
2008-06-20 00:27 --------- d-----w C:\Program Files\Auslogics
2008-06-14 21:39 361,344 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 17:53 490 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-06-11 17:02 --------- d-----w C:\Program Files\HP
2008-06-07 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-27 21:38 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Template
2008-05-25 21:44 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\HPQ
2008-05-25 21:41 87,056 ----a-w C:\WINDOWS\system32\drivers\cmdguard.sys
2008-05-25 21:41 24,208 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-05-25 19:18 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-05-25 13:25 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Apple Computer
2008-05-25 02:21 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-25 01:31 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Sony Corporation
2008-05-25 01:19 --------- d-----w C:\Program Files\Sony
2008-05-25 01:18 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\InstallShield
2008-05-25 00:32 --------- d-----w C:\Program Files\Safari
2008-05-25 00:32 --------- d-----w C:\Program Files\QuickTime
2008-05-25 00:25 --------- d-----w C:\Program Files\Apple Software Update
2008-05-25 00:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-24 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2008-05-24 18:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\GoBit Games
2008-05-24 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo
2008-05-23 23:54 --------- d-----w C:\Program Files\COMODO
2008-05-23 23:54 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Comodo
2008-05-23 23:50 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-23 23:34 --------- d-----w C:\Program Files\Alwil Software
2008-05-23 23:33 --------- d-----w C:\Program Files\Quicken
2008-05-23 23:32 --------- d-----w C:\Program Files\VS Revo Group
2008-05-23 23:20 --------- d-----w C:\Program Files\Java
2008-05-23 23:06 1,833 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EG162AA-ABA a1223w_YC_0Pavi_QCNH538_E54NAsyMPC1_48_IGoldfish3_SASUSTeK Computer INC._V1.xx_B3.28_T060123_WXP2_L409_M504_J160_7Intel_8Pentium 4_93.06_#051212_N10EC8139_Z14F12F20_G80862582.MRK
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
2008-04-14 00:11 39,424 ------w C:\WINDOWS\AppPatch\acadproc.dll
2008-04-14 00:11 376,832 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll
2008-04-14 00:11 245,248 ----a-w C:\WINDOWS\AppPatch\acspecfc.dll
2008-04-14 00:11 141,312 ----a-w C:\WINDOWS\AppPatch\aclua.dll
2008-04-14 00:11 116,224 ----a-w C:\WINDOWS\AppPatch\acxtrnal.dll
2008-04-14 00:11 1,852,928 ----a-w C:\WINDOWS\AppPatch\acgenral.dll
.
------- Sigcheck -------
2005-03-14 03:17 359936 6129e70f3d2f1e60860c930ebeaf92c2 C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2005-03-14 02:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-10 14:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2008-04-13 14:20 361344 93ea8d04ec73a85db02eb8805988f733 C:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS
2007-10-30 12:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\SoftwareDistribution\Download\146ae5e7b51a37f45e0e5cf03d0d5e3c\SP2GDR\tcpip.sys
2007-10-30 11:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\SoftwareDistribution\Download\146ae5e7b51a37f45e0e5cf03d0d5e3c\SP2QFE\tcpip.sys
2008-06-14 16:39 361344 8e036eec565910417ea020ce0962aa24 C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-06-14 16:39 361344 8e036eec565910417ea020ce0962aa24 C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
2008-06-03 10:27 121632 --a------ c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C920E44A-7F78-4E64-BDD7-A57026E7FEB7}]
2008-05-20 11:34 1393312 --a------ C:\Program Files\WOT\WOT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{71576546-354D-41c9-AAE8-31F2EC22BF0D}"= "C:\Program Files\WOT\WOT.dll" [2008-05-20 11:34 1393312]
[HKEY_CLASSES_ROOT\clsid\{71576546-354d-41c9-aae8-31f2ec22bf0d}]
[HKEY_CLASSES_ROOT\WOT.WOTBar.1]
[HKEY_CLASSES_ROOT\WOT.WOTBar]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{71576546-354D-41C9-AAE8-31F2EC22BF0D}"= "C:\Program Files\WOT\WOT.dll" [2008-05-20 11:34 1393312]
[HKEY_CLASSES_ROOT\clsid\{71576546-354d-41c9-aae8-31f2ec22bf0d}]
[HKEY_CLASSES_ROOT\WOT.WOTBar.1]
[HKEY_CLASSES_ROOT\WOT.WOTBar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-06-14 12:24 587568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 21:04 59392]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-08 13:03 114688]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 01:35 49152]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 00:34 245760]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-01 08:39 1655552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-08 13:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-08 12:59 77824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-22 17:37 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 18:19 79224]
"SpybotSnD"="C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [2008-01-28 11:43 5146448]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-08 02:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 10:24 86016 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 15:32 2807808 C:\WINDOWS\ALCWZRD.EXE]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 08:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
Hi
Combofix log cuts off.
Please re-send it :)
juanacuna24
2008-07-02, 17:36
I had to rerun the combofix because the old log also was cut off
ComboFix 08-06-30.2 - HP_Administrator 2008-07-02 10:20:31.4 - NTFSx86 MINIMAL
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.364 [GMT -5:00]
Running from: C:\Documents and Settings\HP_Administrator\Desktop\ComboFix.exe
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\abcheqfp.ini
C:\WINDOWS\system32\begtcqkl.dll
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\ejfycqtj.dll
C:\WINDOWS\system32\fkcdxwsf.ini
C:\WINDOWS\system32\fswxdckf.dll
C:\WINDOWS\system32\jtqcyfje.ini
C:\WINDOWS\system32\jusyepnl.ini
C:\WINDOWS\system32\lkqctgeb.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\owgkstdb.ini
C:\WINDOWS\system32\pfqehcba.dll
C:\WINDOWS\system32\QWDLlUtv.ini
C:\WINDOWS\system32\QWDLlUtv.ini2
C:\WINDOWS\system32\vtUlLDWQ.dll
D:\Autorun.inf
.
((((((((((((((((((((((((( Files Created from 2008-06-02 to 2008-07-02 )))))))))))))))))))))))))))))))
.
2008-07-01 14:25 . 2008-07-01 14:30 23 --a------ C:\Documents and Settings\HP_Administrator\jagex_runescape_preferences.dat
2008-06-29 16:34 . 2008-06-29 16:34 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-06-29 10:54 . 2008-06-29 10:54 <DIR> d--hs---- C:\WINDOWS\ftpcache
2008-06-29 10:52 . 2008-06-29 10:52 319 --a------ C:\WINDOWS\game.ini
2008-06-28 20:48 . 2008-07-02 10:10 <DIR> d-------- C:\VundoFix Backups
2008-06-28 19:20 . 2008-06-28 19:21 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-06-28 19:20 . 2008-06-28 20:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-28 11:01 . 2008-06-28 12:09 <DIR> d-------- C:\Other
2008-06-28 10:06 . 2008-06-28 10:10 4,642 --a------ C:\WINDOWS\system32\tmp.reg
2008-06-28 10:03 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-06-28 10:03 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-06-28 10:03 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-06-28 10:03 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-06-28 10:03 . 2008-06-23 23:34 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-06-28 10:03 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-06-28 10:03 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-06-28 10:03 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-06-28 09:58 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-06-27 20:26 . 2008-06-28 17:39 <DIR> d--h----- C:\$AVG8.VAULT$
2008-06-27 20:19 . 2008-06-27 20:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\HPQ
2008-06-27 20:09 . 2008-06-27 20:09 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Auslogics
2008-06-27 19:47 . 2008-06-27 19:47 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\DAEMON Tools
2008-06-27 19:40 . 2008-06-27 19:40 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SPORE Creature Creator
2008-06-27 19:32 . 2008-06-27 19:32 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\U3
2008-06-27 18:57 . 2008-07-01 12:47 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg
2008-06-27 18:57 . 2008-06-27 18:57 <DIR> d-------- C:\Program Files\AVG
2008-06-27 18:57 . 2008-06-27 18:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-27 18:57 . 2008-06-27 18:57 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys
2008-06-27 18:57 . 2008-06-27 18:57 75,272 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys
2008-06-27 18:57 . 2008-06-27 18:57 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll
2008-06-27 18:51 . 2008-06-27 18:51 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-27 18:25 . 2008-06-27 18:26 124,688 --a------ C:\WINDOWS\system32\MSWINSCK.OCX
2008-06-25 19:33 . 2008-06-25 19:33 <DIR> dr------- C:\Documents and Settings\HP_Administrator\Application Data\SecuROM
2008-06-25 10:02 . 2008-06-25 10:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-06-24 13:38 . 2008-06-24 13:39 <DIR> d-------- C:\Program Files\SystemRequirementsLab
2008-06-23 18:47 . 2008-06-23 18:47 <DIR> d-------- C:\Program Files\Maxis
2008-06-23 18:47 . 2008-06-23 18:47 538 --a------ C:\WINDOWS\eReg.dat
2008-06-22 18:21 . 2008-06-23 13:39 158 --a------ C:\WINDOWS\TSDataEx.ini
2008-06-22 17:50 . 2008-06-25 20:41 <DIR> d-------- C:\Program Files\Microsoft Games
2008-06-22 16:05 . 2008-06-22 17:03 <DIR> d-------- C:\Program Files\SimBin
2008-06-21 17:24 . 2008-07-01 19:03 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-21 17:24 . 2008-06-21 17:24 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-21 16:33 . 2008-06-21 16:33 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Ideas From the Deep
2008-06-21 16:33 . 2008-06-21 16:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ideas From the Deep
2008-06-21 16:30 . 2008-06-25 20:21 <DIR> d-------- C:\Program Files\Ideas From the Deep
2008-06-21 09:52 . 2004-08-10 07:00 66,082 --a------ C:\WINDOWS\system32\dllcache\c_10021.nls
2008-06-21 09:52 . 2004-08-10 07:00 66,082 --a------ C:\WINDOWS\system32\c_10021.nls
2008-06-21 09:52 . 2004-08-10 07:00 6,144 --a------ C:\WINDOWS\system32\ftlx041e.dll
2008-06-21 09:52 . 2004-08-10 07:00 6,144 --a------ C:\WINDOWS\system32\dllcache\ftlx041e.dll
2008-06-20 18:10 . 2008-06-20 18:10 <DIR> d-------- C:\Program Files\TrackerChecker
2008-06-20 17:58 . 2008-06-20 17:58 <DIR> d-------- C:\Program Files\WOT
2008-06-20 09:40 . 2008-06-20 09:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Auslogics
2008-06-19 18:33 . 2008-06-19 18:33 <DIR> d-------- C:\Program Files\Demonoid Invitation Generator
2008-06-19 17:52 . 2008-06-01 11:46 32,768 --a------ C:\WINDOWS\system32\Yahoo.exe
2008-06-18 20:01 . 2008-06-18 20:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\DoctorWeb
2008-06-18 14:46 . 2008-06-18 14:46 <DIR> d-------- C:\WINDOWS\Bus Driver
2008-06-18 14:46 . 2008-06-18 14:47 <DIR> d-------- C:\Program Files\Bus Driver
2008-06-18 13:01 . 2008-06-18 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WildTangent
2008-06-18 12:59 . 2008-06-18 14:23 <DIR> d-------- C:\Program Files\WildGames
2008-06-17 10:18 . 2008-06-25 20:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan
2008-06-17 10:04 . 2008-06-29 13:21 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\SPORE Creature Creator
2008-06-17 09:44 . 2008-06-17 09:44 <DIR> d-------- C:\ProgramData
2008-06-17 09:43 . 2008-06-17 10:25 8,112 --a------ C:\WINDOWS\system32\ealregsnapshot1.reg
2008-06-15 16:47 . 2008-06-16 11:44 <DIR> d-------- C:\Program Files\NoLimits Coasters v1.6
2008-06-14 16:39 . 2008-06-14 16:39 361,344 --a------ C:\WINDOWS\system32\drivers\TCPIP.SYS.ORIGINAL
2008-06-14 16:39 . 2008-06-14 16:39 361,344 --a------ C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-06-14 12:23 . 2008-06-14 12:23 <DIR> d-------- C:\Program Files\BitTorrent
2008-06-14 12:23 . 2008-07-02 10:17 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\BitTorrent
2008-06-13 12:18 . 2008-06-27 20:11 5,536 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-06-12 11:15 . 2008-06-17 09:44 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-06-12 11:13 . 2008-06-26 12:47 <DIR> d-------- C:\Program Files\Electronic Arts
2008-06-12 11:05 . 2008-06-19 17:56 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\SACore
2008-06-12 10:57 . 2008-06-15 09:47 <DIR> d-------- C:\Program Files\DAEMON Tools Lite
2008-06-11 20:56 . 2008-06-11 20:56 717,296 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-06-11 20:55 . 2008-06-11 20:55 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\DAEMON Tools
2008-06-11 20:51 . 2008-06-26 12:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WinZip
2008-06-11 17:54 . 2008-06-11 17:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trymedia
2008-06-11 17:53 . 2008-06-11 20:41 <DIR> d-------- C:\Program Files\Pogo Games
2008-06-11 17:49 . 2008-06-11 17:49 <DIR> d-------- C:\Program Files\uTorrent
2008-06-11 17:49 . 2008-06-25 18:35 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\uTorrent
2008-06-11 11:47 . 2008-05-08 09:02 203,136 --a------ C:\WINDOWS\system32\dllcache\rmcast.sys
2008-06-11 11:46 . 2008-06-13 06:05 272,128 --a------ C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-11 11:40 . 2005-04-27 13:37 77,824 -ra------ C:\WINDOWS\system32\hpzids01.dll
2008-06-11 11:40 . 2005-04-08 19:44 45,056 --a------ C:\WINDOWS\system32\hpzll3xu.dll
2008-06-11 11:39 . 2008-06-11 12:03 78,999 --a------ C:\WINDOWS\hpfins05.dat
2008-06-11 11:39 . 2005-05-23 12:51 1,395 --------- C:\WINDOWS\hpfmdl05.dat
2008-06-11 11:38 . 2008-06-11 11:38 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\HP
2008-06-09 17:56 . 2008-06-09 17:56 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-06-09 17:54 . 2008-06-10 10:22 <DIR> d-------- C:\Program Files\McAfee
2008-06-07 16:35 . 2008-06-07 16:35 <DIR> d-------- C:\temp
2008-06-07 16:31 . 2008-06-07 16:36 <DIR> d-------- C:\Program Files\Yahoo!
2008-06-07 16:31 . 2008-06-07 16:31 <DIR> d-------- C:\Program Files\CCleaner
2008-06-05 10:46 . 2008-06-20 09:33 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Auslogics
2008-06-04 19:14 . 2008-04-13 19:12 159,232 --a------ C:\WINDOWS\system32\ptpusd.dll
2008-06-04 19:14 . 2008-04-13 13:45 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys
2008-06-04 19:14 . 2008-04-13 13:45 15,104 --a------ C:\WINDOWS\system32\dllcache\usbscan.sys
2008-06-04 19:14 . 2001-08-17 22:36 5,632 --a------ C:\WINDOWS\system32\ptpusb.dll
2008-06-04 14:27 . 2008-06-29 20:24 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\U3
2008-06-03 13:26 . 2008-06-03 13:26 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Atari
2008-06-03 13:25 . 2008-06-12 16:43 43,520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll
2008-06-03 13:20 . 2008-06-03 13:20 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\Leadertech
2008-06-03 13:07 . 2008-06-24 13:39 <DIR> d-------- C:\Program Files\Atari
2008-06-02 17:52 . 2008-06-20 13:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SiteAdvisor
2008-06-02 17:52 . 2008-06-09 17:56 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-06-02 16:57 . 2008-06-09 13:09 <DIR> d-------- C:\Documents and Settings\HP_Administrator\Application Data\AdobeUM
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 20:11 --------- d-----w C:\Program Files\EA GAMES
2008-06-29 16:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-28 00:41 12,400 ----a-w C:\WINDOWS\system32\drivers\SecDrv.sys
2008-06-28 00:09 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-27 14:44 --------- d-----w C:\Program Files\Avant Browser
2008-06-22 23:05 --------- d-----w C:\Program Files\Easy Internet signup
2008-06-20 22:59 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Avant Profiles
2008-06-20 18:10 --------- d-----w C:\Program Files\SpywareBlaster
2008-06-20 00:27 --------- d-----w C:\Program Files\Auslogics
2008-06-14 21:39 361,344 ----a-w C:\WINDOWS\system32\drivers\TCPIP.SYS
2008-06-13 11:05 272,128 ----a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-11 17:53 490 ----a-w C:\Documents and Settings\HP_Administrator\Application Data\wklnhst.dat
2008-06-11 17:02 --------- d-----w C:\Program Files\HP
2008-06-07 17:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-01 14:38 --------- d-----w C:\Program Files\Intel
2008-05-27 21:38 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Template
2008-05-25 21:44 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\HPQ
2008-05-25 21:41 87,056 ----a-w C:\WINDOWS\system32\drivers\cmdguard.sys
2008-05-25 21:41 24,208 ----a-w C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-05-25 21:41 143,104 ----a-w C:\WINDOWS\system32\guard32.dll
2008-05-25 19:18 81,920 ----a-w C:\WINDOWS\ALCFDRTM.EXE
2008-05-25 13:25 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Apple Computer
2008-05-25 02:21 --------- d-----w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-25 01:31 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Sony Corporation
2008-05-25 01:19 --------- d-----w C:\Program Files\Sony
2008-05-25 01:18 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\InstallShield
2008-05-25 00:50 61,440 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemutil.dll
2008-05-25 00:50 45,056 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\uninstallUI\eHelpSetup.exe
2008-05-25 00:50 44,032 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\Scripts\devcon.exe
2008-05-25 00:50 40,960 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\ScDmi.dll
2008-05-25 00:50 32,768 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\uploadHSC.dll
2008-05-25 00:50 32,768 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\Scom.dll
2008-05-25 00:50 287,310 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\HPBasicDetection.dll
2008-05-25 00:50 163,840 ----a-w C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\modemcheck.dll
2008-05-25 00:32 --------- d-----w C:\Program Files\Safari
2008-05-25 00:32 --------- d-----w C:\Program Files\QuickTime
2008-05-25 00:25 --------- d-----w C:\Program Files\Apple Software Update
2008-05-25 00:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-05-24 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Zylom
2008-05-24 18:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\GoBit Games
2008-05-24 14:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\comodo
2008-05-23 23:54 --------- d-----w C:\Program Files\COMODO
2008-05-23 23:54 --------- d-----w C:\Documents and Settings\HP_Administrator\Application Data\Comodo
2008-05-23 23:50 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-05-23 23:34 --------- d-----w C:\Program Files\Alwil Software
2008-05-23 23:33 --------- d-----w C:\Program Files\Quicken
2008-05-23 23:32 --------- d-----w C:\Program Files\VS Revo Group
2008-05-23 23:20 --------- d-----w C:\Program Files\Java
2008-05-23 23:06 1,833 --sha-r C:\WINDOWS\system32\drivers\103C_HP_CPC_EG162AA-ABA a1223w_YC_0Pavi_QCNH538_E54NAsyMPC1_48_IGoldfish3_SASUSTeK Computer INC._V1.xx_B3.28_T060123_WXP2_L409_M504_J160_7Intel_8Pentium 4_93.06_#051212_N10EC8139_Z14F12F20_G80862582.MRK
2008-05-08 14:02 203,136 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll
2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2008-04-24 03:16 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-04-22 07:40 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-04-22 07:39 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-04-22 07:39 13,824 ----a-w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-04-20 05:07 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-04-14 10:42 985,088 ----a-w C:\WINDOWS\system32\setupapi.dll
2008-04-14 10:42 11,264 ----a-w C:\WINDOWS\system32\spnpinst.exe
2008-04-14 10:41 423,936 ----a-w C:\WINDOWS\system32\licdll.dll
2008-04-14 00:25 1,804 ----a-w C:\WINDOWS\system32\dcache.bin
2008-04-14 00:16 329,728 ----a-w C:\WINDOWS\system32\netsetup.exe
2008-04-14 00:13 92,424 ----a-w C:\WINDOWS\system32\rdpdd.dll
2008-04-14 00:13 87,176 ----a-w C:\WINDOWS\system32\rdpwsx.dll
2008-04-14 00:13 12,168 ----a-w C:\WINDOWS\system32\tsddd.dll
2008-04-14 00:11 997,376 ----a-w C:\WINDOWS\system32\msgina.dll
2008-04-14 00:10 53,279 ----a-w C:\WINDOWS\system32\odbcji32.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\msdxmlc.dll
2008-04-14 00:10 4,126 ----a-w C:\WINDOWS\system32\dllcache\msdxmlc.dll
2008-04-14 00:10 3,584 ----a-w C:\WINDOWS\system32\msafd.dll
2008-04-13 19:30 1,845,632 ----a-w C:\WINDOWS\system32\win32k.sys
2008-04-13 19:24 2,145,280 ----a-w C:\WINDOWS\system32\ntoskrnl.exe
2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\dllcache\portcls.sys
2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\dllcache\ks.sys
2008-04-13 18:45 60,160 ----a-w C:\WINDOWS\system32\dllcache\drmk.sys
2008-04-13 18:45 49,408 ----a-w C:\WINDOWS\system32\dllcache\stream.sys
2008-04-13 18:44 17,664 ----a-w C:\WINDOWS\system32\watchdog.sys
2008-04-13 18:43 9,728 ----a-w C:\WINDOWS\system32\comsdupd.exe
2008-04-13 18:43 12,800 ----a-w C:\WINDOWS\system32\spiisupd.exe
2008-04-13 18:31 7,424 ----a-w C:\WINDOWS\system32\kd1394.dll
2008-04-13 18:31 2,023,936 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe
2008-04-13 18:30 61,440 ----a-w C:\WINDOWS\system32\msvcrt40.dll
2008-04-13 18:14 76,800 ----a-w C:\WINDOWS\system32\msshavmsg.dll
2008-04-13 17:39 438,784 ----a-w C:\WINDOWS\system32\xpob2res.dll
2008-04-13 17:39 2,897,920 ----a-w C:\WINDOWS\system32\xpsp2res.dll
2008-04-13 17:39 187,392 ----a-w C:\WINDOWS\system32\xpsp1res.dll
2008-04-13 17:37 208,384 ----a-w C:\WINDOWS\system32\rsaenh.dll
2008-04-13 17:37 138,752 ----a-w C:\WINDOWS\system32\dssenh.dll
2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\msxml6r.dll
2008-04-13 17:27 79,872 ----a-w C:\WINDOWS\system32\dllcache\msxml6r.dll
2008-04-13 17:26 94,208 ----a-w C:\WINDOWS\system32\odbcint.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\odbcp32r.dll
2008-04-13 17:26 12,288 ----a-w C:\WINDOWS\system32\mscpx32r.dll
2008-04-13 17:24 20,480 ----a-w C:\WINDOWS\system32\msorc32r.dll
2008-04-13 17:21 733,696 ----a-w C:\WINDOWS\system32\qedwipes.dll
2008-04-13 17:09 4,096 ----a-w C:\WINDOWS\system32\dsprpres.dll
2008-04-13 17:03 63,488 ----a-w C:\WINDOWS\system32\browselc.dll
2008-04-13 17:03 549,376 ----a-w C:\WINDOWS\system32\shdoclc.dll
2008-04-13 16:48 1,647,616 ----a-w C:\WINDOWS\system32\winbrand.dll
2008-04-13 16:45 216,064 ----a-w C:\WINDOWS\system32\moricons.dll
.
------- Sigcheck -------
2005-03-14 03:17 359936 6129e70f3d2f1e60860c930ebeaf92c2 C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2005-03-14 02:55 359808 0e66b538096a6529d1ac66e78eb0d5c8 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-10 14:00 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2008-04-13 14:20 361344 93ea8d04ec73a85db02eb8805988f733 C:\WINDOWS\ServicePackFiles\i386\TCPIP.SYS
2007-10-30 12:20 360064 90caff4b094573449a0872a0f919b178 C:\WINDOWS\SoftwareDistribution\Download\146ae5e7b51a37f45e0e5cf03d0d5e3c\SP2GDR\tcpip.sys
2007-10-30 11:53 360832 64798ecfa43d78c7178375fcdd16d8c8 C:\WINDOWS\SoftwareDistribution\Download\146ae5e7b51a37f45e0e5cf03d0d5e3c\SP2QFE\tcpip.sys
2008-06-14 16:39 361344 8e036eec565910417ea020ce0962aa24 C:\WINDOWS\system32\dllcache\TCPIP.SYS
2008-06-14 16:39 361344 8e036eec565910417ea020ce0962aa24 C:\WINDOWS\system32\drivers\TCPIP.SYS
.
((((((((((((((((((((((((((((( snapshot@2008-07-01_14.00.06.89 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-01 19:25:03 45,056 ----a-w C:\WINDOWS\.jagex_cache_32\runescape\browsercontrol.dll
+ 2008-07-01 19:25:04 315,392 ----a-w C:\WINDOWS\.jagex_cache_32\runescape\jogl.dll
+ 2008-07-01 19:25:05 20,480 ----a-w C:\WINDOWS\.jagex_cache_32\runescape\jogl_awt.dll
- 2008-07-01 18:51:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-07-02 15:19:13 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2002-12-12 05:14:32 8,192 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\d3d8thk.dll
+ 2003-05-30 14:00:02 797,184 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\d3dim700.dll
+ 2004-07-09 09:27:28 292,864 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\ddraw.dll
+ 2002-12-12 05:14:32 24,064 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\ddrawex.dll
+ 2001-10-30 13:10:00 459,264 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\diactfrm.dll
+ 2001-10-30 13:10:00 44,032 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dimap.dll
+ 2001-10-30 13:10:00 645,120 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dinput.dll
+ 2002-12-12 05:14:32 28,160 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dplaysvr.exe
+ 2004-07-09 09:27:28 230,400 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dplayx.dll
+ 2002-12-12 05:14:32 77,824 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpmodemx.dll
+ 2002-12-12 05:14:32 3,072 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnaddr.dll
+ 2002-12-12 05:14:32 723,968 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnet.dll
+ 2003-03-24 14:00:02 32,768 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnhpast.dll
+ 2003-03-24 14:00:02 68,096 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnhupnp.dll
+ 2002-12-12 05:14:32 3,072 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnlobby.dll
+ 2002-12-12 05:14:32 16,896 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpnsvr.exe
+ 2002-12-12 05:14:32 19,968 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpvacm.dll
+ 2002-12-12 05:14:32 381,952 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpvoice.dll
+ 2002-12-12 05:14:32 80,896 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpvsetup.exe
+ 2002-12-12 05:14:32 112,128 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpvvox.dll
+ 2004-07-09 09:27:28 79,360 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dpwsockx.dll
+ 2002-12-12 05:14:32 186,880 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dsdmo.dll
+ 2002-12-12 05:14:32 491,520 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dsdmoprp.dll
+ 2004-07-09 09:27:28 381,952 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dsound.dll
+ 2002-12-12 05:14:32 1,294,336 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dsound3d.dll
+ 2002-12-12 05:14:32 602,624 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dx7vb.dll
+ 2003-05-30 14:00:02 1,189,888 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dx8vb.dll
+ 2004-07-09 09:27:28 974,848 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dxdiag.exe
+ 2002-12-12 05:14:32 46,592 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dxdllreg.exe
+ 2005-05-26 20:16:14 129,536 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\dxupdate.dll
+ 2001-10-30 13:10:00 206,336 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\gcdef.dll
+ 2001-10-30 13:10:00 31,744 ----a-w C:\WINDOWS\system32\DirectX\DXCE.tmp\pid.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7FC6B132-EA18-4D69-86E0-423E7B940BDC}]
C:\WINDOWS\system32\yaywxXnm.dll [BU]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B164E929-A1B6-4A06-B104-2CD0E90A88FF}]
2008-06-03 10:27 121632 --a------ c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C920E44A-7F78-4E64-BDD7-A57026E7FEB7}]
2008-05-20 11:34 1393312 --a------ C:\Program Files\WOT\WOT.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{71576546-354D-41c9-AAE8-31F2EC22BF0D}"= "C:\Program Files\WOT\WOT.dll" [2008-05-20 11:34 1393312]
"{5EFBB043-CFEC-4A57-BFE7-38FDC518108F}"= "C:\WINDOWS\gxvpsafm.dll" [BU]
[HKEY_CLASSES_ROOT\clsid\{71576546-354d-41c9-aae8-31f2ec22bf0d}]
[HKEY_CLASSES_ROOT\WOT.WOTBar.1]
[HKEY_CLASSES_ROOT\WOT.WOTBar]
[HKEY_CLASSES_ROOT\clsid\{5efbb043-cfec-4a57-bfe7-38fdc518108f}]
[HKEY_CLASSES_ROOT\gxvpsafm.1]
[HKEY_CLASSES_ROOT\TypeLib\{06024E5D-2C27-49D3-B9CC-B496A55599D8}]
[HKEY_CLASSES_ROOT\gxvpsafm]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{71576546-354D-41C9-AAE8-31F2EC22BF0D}"= "C:\Program Files\WOT\WOT.dll" [2008-05-20 11:34 1393312]
[HKEY_CLASSES_ROOT\clsid\{71576546-354d-41c9-aae8-31f2ec22bf0d}]
[HKEY_CLASSES_ROOT\WOT.WOTBar.1]
[HKEY_CLASSES_ROOT\WOT.WOTBar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" [2008-06-14 12:24 587568]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 21:04 59392]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-06-08 13:03 114688]
"HPHUPD08"="c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe" [2005-06-02 01:35 49152]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2005-02-26 00:34 245760]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-06-01 08:39 1655552]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-06-08 13:02 94208]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-06-08 12:59 77824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2005-08-22 17:37 180269]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-05-15 18:19 79224]
"40ab002f"="C:\WINDOWS\system32\bdtskgwo.dll" [BU]
"High Definition Audio Property Page Shortcut"="HDAShCut.exe" [2005-01-08 02:07 61952 C:\WINDOWS\system32\HdAShCut.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 10:24 86016 C:\WINDOWS\SOUNDMAN.EXE]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 15:32 2807808 C:\WINDOWS\ALCWZRD.EXE]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-05-12 08:23:26 282624]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\WINDOWS\system32\guard32.dll,avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Updates from HP\\9972322\\Program\\Updates from HP.exe"=
"C:\\Program Files\\Avant Browser\\avant.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
S1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-15 18:20]
S1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-27 18:57]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-05-25 16:41]
S1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-05-25 16:41]
S2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-15 18:16]
S2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-06-27 18:57]
S2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-06-27 18:57]
S2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-27 18:57]
S2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;"c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe" [2008-06-08 13:48]
.
Contents of the 'Scheduled Tasks' folder
"2008-05-25 00:25:46 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
- - - - ORPHANS REMOVED - - - -
ShellExecuteHooks-{7FC6B132-EA18-4D69-86E0-423E7B940BDC} - C:\WINDOWS\system32\yaywxXnm.dll
Notify-yaywxXnm - yaywxXnm.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-02 10:24:38
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-07-02 10:26:56
ComboFix-quarantined-files.txt 2008-07-02 15:26:54
Pre-Run: 66,574,561,280 bytes free
Post-Run: 66,682,245,120 bytes free
397 --- E O F --- 2008-06-25 15:03:01
Hi
Open HijackThis, click do a system scan only and checkmark these if present:
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {7FC6B132-EA18-4D69-86E0-423E7B940BDC} - C:\WINDOWS\system32\yaywxXnm.dll (file missing)
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: gxvpsafm - {5EFBB043-CFEC-4A57-BFE7-38FDC518108F} - C:\WINDOWS\gxvpsafm.dll (file missing)
O20 - Winlogon Notify: yaywxXnm - yaywxXnm.dll (file missing)
Close all windows including browser and press fix checked.
Reboot.
Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.
Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Mail databases Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.
juanacuna24
2008-07-05, 00:31
ok The Kaspersky log. it took 20 hours!
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Friday, July 4, 2008
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Thursday, July 03, 2008 17:13:27
Records in database: 910775
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\
J:\
Scan statistics:
Files scanned: 162301
Threat name: 3
Infected objects: 5
Suspicious objects: 0
Duration of the scan: 21:28:18
File name / Threat name / Threats count
C:\QooBox\Quarantine\C\WINDOWS\system32\begtcqkl.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.zja 1
C:\QooBox\Quarantine\C\WINDOWS\system32\fswxdckf.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\QooBox\Quarantine\C\WINDOWS\system32\vtUlLDWQ.dll.vir Infected: Trojan.Win32.Monderb.gen 1
C:\System Volume Information\_restore{D7BD54B8-C977-4903-8CE7-9415B851EC71}\RP93\A0036351.dll Infected: Trojan.Win32.Monderb.gen 1
C:\System Volume Information\_restore{D7BD54B8-C977-4903-8CE7-9415B851EC71}\RP93\A0036525.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f 1
The selected area was scanned.
***********The Hijackthis Log*******
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:29:17 PM, on 7/4/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\ALCWZRD.EXE
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\ALCMTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\HP_Administrator\Application Data\U3\4320330772C2A1EE\B7D0C220-C291-4e41-9571-92EEF742AD3A\Exec\dfsp.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
J:\autorun.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [40ab002f] rundll32.exe "C:\WINDOWS\system32\bdtskgwo.dll",b
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211586668078
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211586659406
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll,avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
--
End of file - 9658 bytes
Hi
Wow, that's much
Open HijackThis, click do a system scan only and checkmark this:
O4 - HKLM\..\Run: [40ab002f] rundll32.exe "C:\WINDOWS\system32\bdtskgwo.dll",b
Close all windows including browser and press fix checked.
Reboot.
Empty this folder:
C:\QooBox\Quarantine
Empty Recycle Bin.
Post back a fresh HijackThis log and tell me if you still have problems?
juanacuna24
2008-07-05, 15:10
No I don't think i have any problems.. here's my log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:09:08 AM, on 7/5/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\ALCWZRD.EXE
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\ALCMTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211586668078
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211586659406
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll,avgrsstx.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
--
End of file - 9427 bytes
Hi
You have two antiviruses installed, avast! and AVG.
Uninstall one of them and post back a fresh HijackThis log, please.
juanacuna24
2008-07-05, 15:42
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:42:03 AM, on 7/5/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\ALCWZRD.EXE
c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Avant Browser\avant.exe
C:\WINDOWS\ALCMTR.EXE
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: WOT Helper - {C920E44A-7F78-4E64-BDD7-A57026E7FEB7} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: WOT - {71576546-354D-41c9-AAE8-31F2EC22BF0D} - C:\Program Files\WOT\WOT.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [HPHUPD08] c:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPwuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Scan link by Dr.Web - http://www.drweb.com/online/drweb-online-en.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211586668078
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1211586659406
O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-delicious-2-deluxe/zylomplayer.cab
O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {D1E7CBDA-E60E-4970-A01C-37301EF7BF98} (Futuremark Measurement Services Client) - http://www.yougamers.com/systeminfo/MSC3.cab
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: wot - {C2A44D6B-CB9F-4663-88A6-DF2F26E4D952} - C:\Program Files\WOT\WOT.dll
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - Unknown owner - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe
--
End of file - 8860 bytes
Hi
Now it looks better.
Still issues or are we ready for all clean?
juanacuna24
2008-07-05, 19:46
All clean! Thanks!!!:):):d:
Hi
Then you're clean!
Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. A malicious site could render Java content under older, vulnerable versions of Sun's software if the user has not removed them. Please follow these steps to remove older version Java components and update: Download the latest version of Java Runtime Environment (JRE) 6 Update 6 (http://java.sun.com/javase/downloads/index.jsp) and save it to your desktop.
Scroll down to where it saysThe Java SE Runtime Environment (JRE) allows end-users to run Java applications..
Click the Download button to the right.
Select Windows on platform combobox and check the box that says:
Accept License Agreement. Click continue.
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Settings > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u6-windows-i586-p.exe to install the newest version.
Now lets uninstall ComboFix:
Click START then RUN
Now type Combofix /u in the runbox and click OK
Next we remove all used tools.
Please download OTCleanIt (http://download.bleepingcomputer.com/oldtimer/OTCleanIt.exe) and save it to desktop.
Double-click OTCleanIt.exe.
Click the CleanUp! button.
Select Yes when the "Begin cleanup Process?" prompt appears.
If you are prompted to Reboot during the cleanup, select Yes.
The tool will delete itself once it finishes, if not delete it by yourself.
Note: If you receive a warning from your firewall or other security programs regarding OTCleanIt attempting to contact the internet, please allow it to do so.
Disable and Enable System Restore. - If you are using Windows XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.
You can find instructions on how to enable and re-enable system restore here:
Windows XP System Restore Guide (http://www.bleepingcomputer.com/forums/tutorial56.html)
Re-enable system restore with instructions from tutorial above
Make your Internet Explorer more secure - This can be done by following these simple instructions:
From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.
Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com (http://www.windowsupdate.com) regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
Install Malwarebytes' Anti-Malware - Malwarebytes' Anti-Malware is a new and powerful anti-malware tool. It is
totally free but for real-time protection you will have to pay a small one-time fee. Tutorial on installing & using this product can be found below:
Malwarebytes' Anti-Malware Setup Guide (http://bfccomputers.com/index.php?showtopic=1644)
Malwarebytes' Anti-Malware Scanning Guide (http://bfccomputers.com/index.php?showtopic=1645)
Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
A tutorial on installing & using this product can be found here:
Using SpywareBlaster to protect your computer from Spyware and Malware (http://www.bleepingcomputer.com/tutorials/tutorial49.html)
Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.
Here are some additional utilities that will enhance your safety
MVPS Hosts file (http://mvps.org/winhelp2002/hosts.htm) <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
Winpatrol (http://www.winpatrol.com/) <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
Using Winpatrol to protect your computer from malicious software (http://www.winpatrol.com/features.html)
Stand Up and Be Counted ---> Malware Complaints (http://www.malwarecomplaints.info/index.php) <--- where you can make difference!
The site offers people who have been (or are) victims of malware the opportunity to document their story and, in that way, launch a complaint against the malware and the makers of the malware.
Also, please read this great article by Tony Klein So How Did I Get Infected In First Place (http://castlecops.com/postlite7736-.html)
Happy surfing and stay clean! :bigthumb:
juanacuna24
2008-07-05, 23:57
Thanks for all your help!
Since this issue appears to be resolved ... this Topic has been closed. Glad I could help.
Note: If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or your helper a private message (pm). A valid, working link to the closed topic is required.