fnform
2008-08-21, 23:15
I read through the sticky and a few other threads to try and solve this problem. So I've run HijackThis and Combofix. Each log, respectively, is below. Where do I go from here?
HIJACK THIS LOG BELOW
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:07 PM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [lphcjfaj0er6v] C:\WINDOWS\system32\lphcjfaj0er6v.exe
O4 - HKLM\..\Run: [BM3f6ee7cb] Rundll32.exe "C:\WINDOWS\system32\qksaptju.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [s9201] "C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\as2008xp.exe" /autorun
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180576044114
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - AppInit_DLLs: syxbpl.dll vjzmgn.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 7477 bytes
COMBOFIX LOG BELOW
ComboFix 08-08-19.06 - Jonny 2008-08-21 12:50:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.627 [GMT -7:00]
Running from: C:\Documents and Settings\Jonny\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jonny\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\as2008xp.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080818223925500.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080818235048109.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819022732906.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819025026000.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819105824671.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819112327390.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819121319046.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819164522593.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819233609546.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080820152250156.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821004630062.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821015954343.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821030307609.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821095221156.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821104209515.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821122908062.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821123923359.log
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\interclick.com
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\interclick.com\ud.sol
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\www.broadcaster.com (http://www.broadcaster.com)
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com (http://www.broadcaster.com)
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol (http://www.broadcaster.com%5Csettings.sol)
C:\Documents and Settings\Jonny\Cookies\jonny@2o7[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@ads.pointroll[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@advertising[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@clicktorrent[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@ehg.fedex[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@h.foxsports[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@hits.gureport.co[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@insightexpressai[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@revsci[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@serving-sys[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@trafficmp[1].txt
C:\Program Files\Common Files\crosof~1.net
C:\Program Files\dobe~1
C:\Program Files\dobe~1\?dobe\
C:\Program Files\ipwindows
C:\Program Files\winupdates
C:\temp\0b9
C:\temp\0b9\tmpTF.log
C:\temp\tn3
C:\WINDOWS\BM3f6ee7cb.txt
C:\WINDOWS\BM3f6ee7cb.xml
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\bgvenvyr.ini
C:\WINDOWS\system32\BIOWaccf.ini
C:\WINDOWS\system32\BIOWaccf.ini2
C:\WINDOWS\system32\blphcjfaj0er6v.scr
C:\WINDOWS\system32\byXOExWo.dll
C:\WINDOWS\system32\fccaWOIB.dll
C:\WINDOWS\system32\fnxcumxi.ini
C:\WINDOWS\system32\goushvij.dll
C:\WINDOWS\system32\ixmucxnf.dll
C:\WINDOWS\system32\jedwdhce.dll
C:\WINDOWS\system32\jswuopfc.dll
C:\WINDOWS\system32\lphcjfaj0er6v.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\phcjfaj0er6v.bmp
C:\WINDOWS\system32\ryvnevgb.dll
C:\WINDOWS\system32\syxbpl.dll
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\vjzmgn.dll
C:\WINDOWS\system32\winxtx32.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.
2008-08-21 12:33 . 2008-08-21 12:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 02:17 . 2008-08-21 03:18 202 --a------ C:\WINDOWS\wininit.ini
2008-08-21 01:54 . 2008-08-21 01:57 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-21 01:54 . 2008-08-21 02:18 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-08-20 15:31 . 2008-08-20 15:31 303,104 --a------ C:\WINDOWS\system32\pgnxvosb.exe
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\sensor.INI
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\hqstat.mtl
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\hqstat.mnt
2008-08-18 22:39 . 2008-08-19 04:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\services
2008-08-18 22:38 . 2008-08-18 23:59 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-08-18 22:37 . 2008-08-20 15:32 <DIR> d-------- C:\WINDOWS\system32\349168
2008-08-16 18:58 . 2008-08-20 15:33 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-12 17:48 . 2008-08-20 15:59 <DIR> d-------- C:\Program Files\CDisplay
2008-08-09 23:18 . 2008-08-20 15:35 <DIR> d-------- C:\Documents and Settings\Jonny\Application Data\acccore
2008-08-09 23:17 . 2008-08-09 23:17 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\acccore
2008-08-09 23:16 . 2008-08-20 16:00 <DIR> d-------- C:\Program Files\AIM6
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 19:26 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Azureus
2008-08-20 23:00 --------- d-----w C:\Program Files\World of Warcraft
2008-08-20 23:00 --------- d-----w C:\Program Files\QuickTime
2008-08-20 23:00 --------- d-----w C:\Program Files\MSN Messenger
2008-08-20 23:00 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2008-08-20 23:00 --------- d-----w C:\Program Files\iTunes
2008-08-20 23:00 --------- d-----w C:\Program Files\Google
2008-08-20 23:00 --------- d-----w C:\Program Files\Azureus
2008-08-20 22:59 --------- d-----w C:\Program Files\Viewpoint
2008-08-20 22:59 --------- d-----w C:\Program Files\VideoLAN
2008-08-20 22:59 --------- d-----w C:\Program Files\Unrar
2008-08-20 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-20 22:59 --------- d-----w C:\Program Files\MSN Games
2008-08-20 22:59 --------- d-----w C:\Program Files\MixMeister BPM Analyzer
2008-08-20 22:59 --------- d-----w C:\Program Files\iPod
2008-08-20 22:59 --------- d-----w C:\Program Files\InterVideo
2008-08-20 22:59 --------- d-----w C:\Program Files\Image-Line
2008-08-20 22:59 --------- d-----w C:\Program Files\Envy24 Family Audio Controller
2008-08-20 22:58 --------- d--h--w C:\Program Files\Zero G Registry
2008-08-20 22:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-20 22:58 --------- d-----w C:\Program Files\Winamp
2008-08-20 22:58 --------- d-----w C:\Program Files\VstPlugins
2008-08-20 22:58 --------- d-----w C:\Program Files\Sony
2008-08-20 22:58 --------- d-----w C:\Program Files\Realtek
2008-08-20 22:58 --------- d-----w C:\Program Files\NETGEAR
2008-08-20 22:58 --------- d-----w C:\Program Files\Microsoft LifeCam
2008-08-20 22:58 --------- d-----w C:\Program Files\Microsoft Games
2008-08-20 22:58 --------- d-----w C:\Program Files\LimeWire
2008-08-20 22:58 --------- d-----w C:\Program Files\Java
2008-08-20 22:57 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-20 22:57 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-20 22:57 --------- d-----w C:\Program Files\ATI Technologies
2008-08-20 22:57 --------- d-----w C:\Program Files\Apple Software Update
2008-08-20 22:57 --------- d-----w C:\Program Files\AIM
2008-08-20 22:36 --------- d-----w C:\Documents and Settings\Jonny\Application Data\dvdcss
2008-08-20 22:35 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\vlc
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Viewpoint
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Ventrilo
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Sony Corporation
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Nero
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Move Networks
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\LimeWire
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\InterVideo
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\DivX
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Apple Computer
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Nullsoft
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Nero
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Java
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Apple
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-10 06:17 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2007-12-07 11:54 642,796 ----a-w C:\Program Files\XviD-1.1.3-28062007.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-08-06 08:21 50472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 01:51 172032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 16:54 269104]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-06-29 16:55 707376]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
C:\Documents and Settings\Jonny\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-09-15 18:14:31 155648]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-09-18 02:42:47 122880]
NETGEAR WG311v3 Wireless Assistant.lnk - C:\WINDOWS\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2008-05-27 18:37:50 2238]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=syxbpl.dll vjzmgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 16:54]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 14:38]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM V1.01 (Envy24HT-S Eval. Only);C:\WINDOWS\system32\drivers\Envy24HF.sys [2003-03-27 02:23]
.
Contents of the 'Scheduled Tasks' folder
2008-08-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -
BHO-{C25AAB33-F7BF-40C4-94F5-EF137D0B5838} - C:\Documents and Settings\Jonny\Local Settings\Temporary Internet Files\Content.IE5\5B2LS7NU\3077htsbdjyf[1].dll
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-lphcjfaj0er6v - C:\WINDOWS\system32\lphcjfaj0er6v.exe
HKLM-Run-BM3f6ee7cb - C:\WINDOWS\system32\qksaptju.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.myspace.com/
O16 -: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
C:\WINDOWS\Downloaded Program Files\OberonGameHost_dbg.inf
C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 13:00:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tsd32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\VIEWPO~1\Common\VIEWPO~1.EXE
C:\PROGRA~1\MICROS~2\type32.exe
C:\PROGRA~1\Java\JRE16~4.0_0\bin\jusched.exe
C:\PROGRA~1\iTunes\ITUNES~1.EXE
C:\PROGRA~1\AIM6\aim6.exe
C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE
C:\PROGRA~1\NETGEAR\WG311v3\wlancfg5.exe
C:\PROGRA~1\Sony\SONYPI~1\VOLUME~1\SPUVOL~1.EXE
C:\PROGRA~1\AIM6\AOLSOF~1.EXE
C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-08-21 13:06:24 - machine was rebooted [Jonny]
ComboFix-quarantined-files.txt 2008-08-21 20:06:21
Pre-Run: 6,280,048,640 bytes free
Post-Run: 6,482,870,272 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
265 --- E O F --- 2008-08-15 10:01:29
Thank you in advance for the help!
-Jonny
--------------------------------
Do NOT run 'fixes' before helpers have analyzed the HJT log (http://forums.spybot.info/showthread.php?t=16806)
File Sharing, otherwise known as Peer To Peer. (P2P) (http://forums.spybot.info/showthread.php?t=282)
Particularly post #4, http://forums.spybot.info/showpost.php?p=218503&postcount=4
-------------------------------------------------------
http://forums.spybot.info/showthread.php?t=33011
HIJACK THIS LOG BELOW
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:34:07 PM, on 8/21/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Microsoft LifeCam\MSCamSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Microsoft IntelliType Pro\type32.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\vVX3000.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\NETGEAR\WG311v3\wlancfg5.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O4 - HKLM\..\Run: [type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [VX3000] C:\WINDOWS\vVX3000.exe
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [lphcjfaj0er6v] C:\WINDOWS\system32\lphcjfaj0er6v.exe
O4 - HKLM\..\Run: [BM3f6ee7cb] Rundll32.exe "C:\WINDOWS\system32\qksaptju.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [s9201] "C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\as2008xp.exe" /autorun
O4 - Startup: Cyber-shot Viewer Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: NETGEAR WG311v3 Wireless Assistant.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {64D01C7F-810D-446E-A07E-16C764235644} (AtlAtomadersCtlAttrib Class) - http://zone.msn.com/bingame/amad/default/atomaders.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1180576044114
O16 - DPF: {9AA73F41-EC64-489E-9A73-9CD52E528BC4} (ZoneAxRcMgr Class) - http://cdn2.zone.msn.com/binframework/v10/ZAxRcMgr.cab31267.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://zone.msn.com/bingame/feed/default/SproutLauncher.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O20 - AppInit_DLLs: syxbpl.dll vjzmgn.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 7477 bytes
COMBOFIX LOG BELOW
ComboFix 08-08-19.06 - Jonny 2008-08-21 12:50:42.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.627 [GMT -7:00]
Running from: C:\Documents and Settings\Jonny\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jonny\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\as2008xp.exe
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080818223925500.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080818235048109.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819022732906.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819025026000.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819105824671.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819112327390.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819121319046.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819164522593.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080819233609546.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080820152250156.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821004630062.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821015954343.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821030307609.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821095221156.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821104209515.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821122908062.log
C:\Documents and Settings\All Users.WINDOWS\Application Data\Secure Solutions\Antispyware 2008 XP\LOG\20080821123923359.log
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\interclick.com
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\interclick.com\ud.sol
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\#SharedObjects\J6SBYYFX\www.broadcaster.com (http://www.broadcaster.com)
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com (http://www.broadcaster.com)
C:\Documents and Settings\Jonny\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol (http://www.broadcaster.com%5Csettings.sol)
C:\Documents and Settings\Jonny\Cookies\jonny@2o7[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@ads.pointroll[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@advertising[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@clicktorrent[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@ehg.fedex[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@h.foxsports[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@hits.gureport.co[1].txt
C:\Documents and Settings\Jonny\Cookies\jonny@insightexpressai[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@revsci[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@serving-sys[2].txt
C:\Documents and Settings\Jonny\Cookies\jonny@trafficmp[1].txt
C:\Program Files\Common Files\crosof~1.net
C:\Program Files\dobe~1
C:\Program Files\dobe~1\?dobe\
C:\Program Files\ipwindows
C:\Program Files\winupdates
C:\temp\0b9
C:\temp\0b9\tmpTF.log
C:\temp\tn3
C:\WINDOWS\BM3f6ee7cb.txt
C:\WINDOWS\BM3f6ee7cb.xml
C:\WINDOWS\system32\_000005_.tmp.dll
C:\WINDOWS\system32\_000006_.tmp.dll
C:\WINDOWS\system32\bgvenvyr.ini
C:\WINDOWS\system32\BIOWaccf.ini
C:\WINDOWS\system32\BIOWaccf.ini2
C:\WINDOWS\system32\blphcjfaj0er6v.scr
C:\WINDOWS\system32\byXOExWo.dll
C:\WINDOWS\system32\fccaWOIB.dll
C:\WINDOWS\system32\fnxcumxi.ini
C:\WINDOWS\system32\goushvij.dll
C:\WINDOWS\system32\ixmucxnf.dll
C:\WINDOWS\system32\jedwdhce.dll
C:\WINDOWS\system32\jswuopfc.dll
C:\WINDOWS\system32\lphcjfaj0er6v.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\phcjfaj0er6v.bmp
C:\WINDOWS\system32\ryvnevgb.dll
C:\WINDOWS\system32\syxbpl.dll
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T6
C:\WINDOWS\system32\vjzmgn.dll
C:\WINDOWS\system32\winxtx32.dll
.
((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 )))))))))))))))))))))))))))))))
.
2008-08-21 12:33 . 2008-08-21 12:33 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-21 02:17 . 2008-08-21 03:18 202 --a------ C:\WINDOWS\wininit.ini
2008-08-21 01:54 . 2008-08-21 01:57 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-21 01:54 . 2008-08-21 02:18 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-08-20 15:31 . 2008-08-20 15:31 303,104 --a------ C:\WINDOWS\system32\pgnxvosb.exe
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\sensor.INI
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\hqstat.mtl
2008-08-19 00:27 . 2008-08-19 00:27 0 --a------ C:\WINDOWS\hqstat.mnt
2008-08-18 22:39 . 2008-08-19 04:34 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\services
2008-08-18 22:38 . 2008-08-18 23:59 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-08-18 22:37 . 2008-08-20 15:32 <DIR> d-------- C:\WINDOWS\system32\349168
2008-08-16 18:58 . 2008-08-20 15:33 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-12 17:48 . 2008-08-20 15:59 <DIR> d-------- C:\Program Files\CDisplay
2008-08-09 23:18 . 2008-08-20 15:35 <DIR> d-------- C:\Documents and Settings\Jonny\Application Data\acccore
2008-08-09 23:17 . 2008-08-09 23:17 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\acccore
2008-08-09 23:16 . 2008-08-20 16:00 <DIR> d-------- C:\Program Files\AIM6
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-21 19:26 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Azureus
2008-08-20 23:00 --------- d-----w C:\Program Files\World of Warcraft
2008-08-20 23:00 --------- d-----w C:\Program Files\QuickTime
2008-08-20 23:00 --------- d-----w C:\Program Files\MSN Messenger
2008-08-20 23:00 --------- d-----w C:\Program Files\Microsoft IntelliType Pro
2008-08-20 23:00 --------- d-----w C:\Program Files\iTunes
2008-08-20 23:00 --------- d-----w C:\Program Files\Google
2008-08-20 23:00 --------- d-----w C:\Program Files\Azureus
2008-08-20 22:59 --------- d-----w C:\Program Files\Viewpoint
2008-08-20 22:59 --------- d-----w C:\Program Files\VideoLAN
2008-08-20 22:59 --------- d-----w C:\Program Files\Unrar
2008-08-20 22:59 --------- d-----w C:\Program Files\MSXML 4.0
2008-08-20 22:59 --------- d-----w C:\Program Files\MSN Games
2008-08-20 22:59 --------- d-----w C:\Program Files\MixMeister BPM Analyzer
2008-08-20 22:59 --------- d-----w C:\Program Files\iPod
2008-08-20 22:59 --------- d-----w C:\Program Files\InterVideo
2008-08-20 22:59 --------- d-----w C:\Program Files\Image-Line
2008-08-20 22:59 --------- d-----w C:\Program Files\Envy24 Family Audio Controller
2008-08-20 22:58 --------- d--h--w C:\Program Files\Zero G Registry
2008-08-20 22:58 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-20 22:58 --------- d-----w C:\Program Files\Winamp
2008-08-20 22:58 --------- d-----w C:\Program Files\VstPlugins
2008-08-20 22:58 --------- d-----w C:\Program Files\Sony
2008-08-20 22:58 --------- d-----w C:\Program Files\Realtek
2008-08-20 22:58 --------- d-----w C:\Program Files\NETGEAR
2008-08-20 22:58 --------- d-----w C:\Program Files\Microsoft LifeCam
2008-08-20 22:58 --------- d-----w C:\Program Files\Microsoft Games
2008-08-20 22:58 --------- d-----w C:\Program Files\LimeWire
2008-08-20 22:58 --------- d-----w C:\Program Files\Java
2008-08-20 22:57 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-08-20 22:57 --------- d-----w C:\Program Files\microsoft frontpage
2008-08-20 22:57 --------- d-----w C:\Program Files\ATI Technologies
2008-08-20 22:57 --------- d-----w C:\Program Files\Apple Software Update
2008-08-20 22:57 --------- d-----w C:\Program Files\AIM
2008-08-20 22:36 --------- d-----w C:\Documents and Settings\Jonny\Application Data\dvdcss
2008-08-20 22:35 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\vlc
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Viewpoint
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Ventrilo
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Sony Corporation
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Nero
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Move Networks
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\LimeWire
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\InterVideo
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\DivX
2008-08-20 22:35 --------- d-----w C:\Documents and Settings\Jonny\Application Data\Apple Computer
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Nullsoft
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Nero
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Java
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Apple
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\AOL
2008-08-20 22:34 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-10 06:17 --------- d-----w C:\Documents and Settings\All Users.WINDOWS\Application Data\Viewpoint
2007-12-07 11:54 642,796 ----a-w C:\Program Files\XviD-1.1.3-28062007.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
"StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 12:35 90112]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-08-06 08:21 50472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"type32"="C:\Program Files\Microsoft IntelliType Pro\type32.exe" [2004-06-03 01:51 172032]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2006-06-29 16:54 269104]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2006-06-29 16:55 707376]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
C:\Documents and Settings\Jonny\Start Menu\Programs\Startup\
Cyber-shot Viewer Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2006-09-15 18:14:31 155648]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2006-09-18 02:42:47 122880]
NETGEAR WG311v3 Wireless Assistant.lnk - C:\WINDOWS\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2008-05-27 18:37:50 2238]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=syxbpl.dll vjzmgn.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Azureus\\Azureus.exe"=
"C:\\Program Files\\World of Warcraft\\Repair.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\WINDOWS\\system32\\winver.exe"=
R2 MSCamSvc;MSCamSvc;C:\Program Files\Microsoft LifeCam\MSCamSvc.exe [2006-06-29 16:54]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 14:38]
R3 Envy24HFS;ICE Envy24 Family Audio Controller WDM V1.01 (Envy24HT-S Eval. Only);C:\WINDOWS\system32\drivers\Envy24HF.sys [2003-03-27 02:23]
.
Contents of the 'Scheduled Tasks' folder
2008-08-16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]
.
- - - - ORPHANS REMOVED - - - -
BHO-{C25AAB33-F7BF-40C4-94F5-EF137D0B5838} - C:\Documents and Settings\Jonny\Local Settings\Temporary Internet Files\Content.IE5\5B2LS7NU\3077htsbdjyf[1].dll
HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
HKLM-Run-NBKeyScan - C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
HKLM-Run-lphcjfaj0er6v - C:\WINDOWS\system32\lphcjfaj0er6v.exe
HKLM-Run-BM3f6ee7cb - C:\WINDOWS\system32\qksaptju.dll
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.myspace.com/
O16 -: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} - hxxp://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab
C:\WINDOWS\Downloaded Program Files\OberonGameHost_dbg.inf
C:\WINDOWS\Downloaded Program Files\OberonGameHost.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-21 13:00:54
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\tsd32.dll
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\ati2evxx.exe
C:\WINDOWS\system32\ati2evxx.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\VIEWPO~1\Common\VIEWPO~1.EXE
C:\PROGRA~1\MICROS~2\type32.exe
C:\PROGRA~1\Java\JRE16~4.0_0\bin\jusched.exe
C:\PROGRA~1\iTunes\ITUNES~1.EXE
C:\PROGRA~1\AIM6\aim6.exe
C:\PROGRA~1\INTERV~1\Common\Bin\WINCIN~1.EXE
C:\PROGRA~1\NETGEAR\WG311v3\wlancfg5.exe
C:\PROGRA~1\Sony\SONYPI~1\VOLUME~1\SPUVOL~1.EXE
C:\PROGRA~1\AIM6\AOLSOF~1.EXE
C:\PROGRA~1\iPod\bin\IPODSE~1.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-08-21 13:06:24 - machine was rebooted [Jonny]
ComboFix-quarantined-files.txt 2008-08-21 20:06:21
Pre-Run: 6,280,048,640 bytes free
Post-Run: 6,482,870,272 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
265 --- E O F --- 2008-08-15 10:01:29
Thank you in advance for the help!
-Jonny
--------------------------------
Do NOT run 'fixes' before helpers have analyzed the HJT log (http://forums.spybot.info/showthread.php?t=16806)
File Sharing, otherwise known as Peer To Peer. (P2P) (http://forums.spybot.info/showthread.php?t=282)
Particularly post #4, http://forums.spybot.info/showpost.php?p=218503&postcount=4
-------------------------------------------------------
http://forums.spybot.info/showthread.php?t=33011