Virtumonde.dll and prx infection pls help

[lunagirls]

Hi,
Please help me, :red:

I think this is how you start right?


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:29:06 PM, on 4/21/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\WINDOWS\Explorer.EXE
C:\DOCUMENTS AND SETTINGS\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe
C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ycomp/defaults/sb/*http://www.yahoo.com/search/ie.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com/pages/business/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [EPSON Stylus Photo R1800 (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9LE.EXE /P33 "EPSON Stylus Photo R1800 (Copy 2)" /O6 "USB005" /M "Stylus Photo R1800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R2400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE /P24 "EPSON Stylus Photo R2400" /O6 "USB006" /M "Stylus Photo R2400"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [sivafobibu] Rundll32.exe "C:\WINDOWS\system32\siniwaba.dll",s
O4 - HKLM\..\RunOnce: [SpybotDeletingA8386] command.com /c del "C:\WINDOWS\system32\letiwozo.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9046] cmd.exe /c del "C:\WINDOWS\system32\letiwozo.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7069] command.com /c del "C:\WINDOWS\system32\duwekide.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9350] cmd.exe /c del "C:\WINDOWS\system32\duwekide.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA1133] command.com /c del "C:\WINDOWS\system32\siniwaba.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3882] cmd.exe /c del "C:\WINDOWS\system32\siniwaba.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA4482] command.com /c del "c:\windows\system32\mosoveva.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC3311] cmd.exe /c del "c:\windows\system32\mosoveva.dll_old"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB3288] command.com /c del "C:\WINDOWS\system32\letiwozo.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD1267] cmd.exe /c del "C:\WINDOWS\system32\letiwozo.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB5985] command.com /c del "C:\WINDOWS\system32\duwekide.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8971] cmd.exe /c del "C:\WINDOWS\system32\duwekide.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9386] command.com /c del "C:\WINDOWS\system32\siniwaba.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD4846] cmd.exe /c del "C:\WINDOWS\system32\siniwaba.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB3708] command.com /c del "c:\windows\system32\mosoveva.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD3243] cmd.exe /c del "c:\windows\system32\mosoveva.dll_old"
O4 - HKUS\S-1-5-19\..\Run: [sivafobibu] Rundll32.exe "C:\WINDOWS\system32\siniwaba.dll",s (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [sivafobibu] Rundll32.exe "C:\WINDOWS\system32\siniwaba.dll",s (User 'NETWORK SERVICE')
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: Kothari Gamma Loader.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3DFD2B52-C6E9-11D4-8226-005004F658FC} (XeWare Control) - https://northamerica.sagecrm.com/OmniPrintInternational713hzolny//Plugin/eWarePluginX.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186967184239
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O18 - Filter hijack: text/html - {70574d39-89a5-4737-9cab-0460949a1d40} - C:\WINDOWS\system32\dsound3dd.dll
O20 - AppInit_DLLs: gfs.dll scnlyd.dll gjyetz.dll c:\windows\system32\hejolese.dll c:\windows\system32\ c:\windows\system32\ c:\windows\system32\zoluvomo.dll c:\windows\system32\revovole.dll C:\WINDOWS\system32\letiwozo.dll c:\windows\system32\hajulofi.dll c:\windows\system32\mosoveva.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\mosoveva.dll (file missing)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\mosoveva.dll (file missing)
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - Unknown owner - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe
O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe
O23 - Service: SmartWiService - Sony Electronics, Inc - C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

--
End of file - 21279 bytes


Thank You !

[Shaba]

Hi lunagirls

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here. (http://www.bleepingcomputer.com/forums/topic114351.html)

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

[lunagirls]

ComboFix 09-04-23.02 - Mariana 04/22/2009 17:02.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1473 [GMT -7:00]
Running from: c:\documents and settings\Mariana\Desktop\ComboFix.exe
FW: Norton Internet Worm Protection *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\ikirejif.ini

.
((((((((((((((((((((((((( Files Created from 2009-03-23 to 2009-04-23 )))))))))))))))))))))))))))))))
.

2009-04-23 00:15 . 2009-04-23 00:15 121 --sh--w c:\windows\system32\ikirejif.ini
2009-04-22 22:08 . 2009-04-22 22:08 100864 --sha-w c:\windows\system32\fijeriki.dll
2009-04-22 22:08 . 2009-04-22 22:08 2713 --sh--w c:\windows\system32\vogomiyi.dll
2009-04-22 10:08 . 2009-04-22 10:08 2713 --sh--w c:\windows\system32\giwogese.exe
2009-04-21 16:09 . 2009-04-21 16:09 64000 --sha-w c:\windows\system32\vidasasa.exe
2009-04-17 11:42 . 2009-04-17 11:42 99328 --sha-w c:\windows\system32\yiyerufe.dll
2009-04-16 11:41 . 2009-04-16 11:41 2713 --sh--w c:\windows\system32\komurolo.exe
2009-04-01 23:40 . 2009-04-01 23:40 100864 ------w c:\windows\system32\burabapa.dll_old
2009-04-01 21:28 . 2009-04-01 22:29 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-01 21:28 . 2009-04-01 22:04 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-04-01 11:39 . 2009-04-01 11:39 2713 --sh--w c:\windows\system32\godidusa.exe
2009-03-31 17:38 . 2009-03-31 17:38 2713 --sh--w c:\windows\system32\pakimati.exe
2009-03-31 01:14 . 2009-03-31 01:26 -------- d-----w C:\Laptop Backup
2009-03-27 23:35 . 2009-03-27 23:35 99328 ------w c:\windows\system32\fivusaju.dll
2009-03-27 11:35 . 2009-03-27 11:35 2713 --sh--w c:\windows\system32\gakemojo.exe
2009-03-26 17:34 . 2009-03-26 17:34 2713 --sh--w c:\windows\system32\vuvubuyo.dll
2009-03-26 17:34 . 2009-03-26 17:34 104448 --sha-w c:\windows\system32\weheyepe.dll
2009-03-26 05:34 . 2009-03-26 05:34 99840 ------w c:\windows\system32\gebojele.dll
2009-03-26 05:34 . 2009-03-26 05:34 105984 --sha-w c:\windows\system32\lusanuwo.dll
2009-03-26 01:47 . 2009-03-26 19:27 -------- d-----w c:\program files\Windows Live Safety CenterRebootActions
2009-03-26 01:47 . 2009-03-26 01:47 28320 ----a-w c:\windows\system32\drivers\eitbjblq.sys
2009-03-25 19:33 . 2009-03-26 19:27 -------- d-----w c:\program files\Windows Live Safety Center
2009-03-24 12:21 . 2009-03-24 12:21 2713 --sh--w c:\windows\system32\napigowu.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 00:11 . 2006-09-22 16:06 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-23 00:11 . 2006-09-22 16:07 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-04-22 23:59 . 2006-09-22 16:07 -------- d-----w c:\program files\Symantec
2009-04-22 23:04 . 2009-03-04 21:23 -------- d-----w c:\program files\Common
2009-04-21 22:26 . 2006-09-22 16:11 -------- d-----w c:\program files\Trend Micro
2009-03-20 18:21 . 2009-03-20 18:21 2713 --sh--w c:\windows\system32\fenopalu.dll
2009-03-18 05:45 . 2009-03-18 05:45 2713 --sh--w c:\windows\system32\tonakuri.dll
2009-03-12 06:59 . 2009-03-12 06:59 2713 --sh--w c:\windows\system32\runilowu.dll
2009-03-11 19:04 . 2009-03-11 19:04 2713 --sh--w c:\windows\system32\kukezifu.dll
2009-03-11 05:59 . 2006-09-22 16:11 -------- d-----w c:\documents and settings\All Users\Application Data\Digital Interactive Systems Corporation
2009-03-10 09:10 . 2009-03-10 09:10 2713 --sh--w c:\windows\system32\zizigosi.dll
2009-03-06 06:25 . 2009-03-06 06:25 2713 --sh--w c:\windows\system32\wojawiho.dll
2009-03-05 18:25 . 2009-03-05 18:25 2713 --sh--w c:\windows\system32\sifugayu.dll
2009-03-05 00:22 . 2009-03-05 00:22 2713 --sh--w c:\windows\system32\pabinula.dll
2009-02-26 06:15 . 2009-02-26 06:15 2713 --sh--w c:\windows\system32\tovituta.dll
2009-02-24 18:14 . 2009-02-24 18:14 2713 --sh--w c:\windows\system32\jedubaji.dll
2009-02-23 18:41 . 2009-02-23 18:41 2713 --sh--w c:\windows\system32\lawewiku.dll
2009-02-19 20:10 . 2009-02-19 20:10 2713 --sh--w c:\windows\system32\rumapuhu.dll
2009-02-19 08:09 . 2009-02-19 08:09 2713 --sh--w c:\windows\system32\zisakawa.dll
2009-02-19 08:09 . 2009-02-19 08:09 2713 --sh--w c:\windows\system32\jufevedu.dll
2009-02-14 08:12 . 2009-02-14 08:12 2713 --sh--w c:\windows\system32\tubevare.dll
2009-02-13 08:16 . 2009-02-13 08:16 2713 --sh--w c:\windows\system32\peritohu.dll
2009-02-11 06:34 . 2009-02-11 06:34 2713 --sh--w c:\windows\system32\sadotawa.dll
2009-02-10 01:19 . 2009-02-10 01:19 36352 ----a-w c:\windows\system32\wvUollIc.dll
2009-02-04 10:07 . 2009-02-04 10:07 2713 --sh--w c:\windows\system32\tifipuwo.dll
2009-02-03 22:12 . 2009-02-03 22:12 2713 --sh--w c:\windows\system32\gezupuye.dll
2009-02-03 22:12 . 2009-02-03 22:12 2713 --sh--w c:\windows\system32\pegupige.dll
2009-02-03 22:12 . 2009-02-03 22:12 2713 --sh--w c:\windows\system32\fibayivu.dll
2009-02-03 22:12 . 2009-02-03 22:12 2713 --sh--w c:\windows\system32\bazomiyu.dll
2009-02-03 10:12 . 2009-02-03 10:12 2713 --sh--w c:\windows\system32\savomazo.dll
2009-02-03 10:12 . 2009-02-03 10:12 2713 --sh--w c:\windows\system32\vedavuri.dll
2009-02-03 10:12 . 2009-02-03 10:12 2713 --sh--w c:\windows\system32\lamobeni.dll
2009-02-03 10:12 . 2009-02-03 10:12 2713 --sh--w c:\windows\system32\kikajeki.dll
2009-02-02 22:06 . 2009-02-02 22:06 2713 --sh--w c:\windows\system32\leyapoma.dll
2009-01-24 02:53 . 2009-01-24 02:53 36864 ----a-w c:\windows\system32\cbXNFyxU.dll
2008-05-12 23:27 . 2006-09-22 16:11 74296 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-08 22:15 . 2008-01-03 18:50 229376 ----a-w c:\documents and settings\Mariana\cwshredder.dll
2007-11-18 14:43 . 2007-11-18 14:43 137 ----a-w c:\documents and settings\NetworkService\Local Settings\Application Data\fusioncache.dat
2007-11-18 14:42 . 2006-10-20 18:56 130 ----a-w c:\documents and settings\Mariana\Local Settings\Application Data\fusioncache.dat
2006-12-01 03:04 . 2006-11-28 21:39 132 ----a-w c:\documents and settings\Mariana\Application Data\wklnhst.dat
2006-09-22 16:11 . 2006-10-20 18:56 64800 ----a-w c:\documents and settings\Mariana\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-07-22 20:09 . 2006-07-22 20:09 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
1601-01-01 00:12 . 1601-01-01 00:12 105472 --sha-w c:\windows\system32\bimoyuka.dll
2009-01-14 17:57 . 2009-01-14 17:57 101888 --sha-w c:\windows\system32\binanuye.dll
2009-01-07 15:01 . 2009-01-07 15:01 61440 --sha-w c:\windows\system32\bivegedu.exe
2008-05-14 19:33 . 2008-05-14 19:28 56 --sh--r c:\windows\system32\DA3B286D5F.sys
1601-01-01 00:12 . 1601-01-01 00:12 100352 --sha-w c:\windows\system32\fapimana.dll
1601-01-01 00:12 . 1601-01-01 00:12 99328 --sha-w c:\windows\system32\fetoraha.dll
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\gajehole.exe
1601-01-01 00:12 . 1601-01-01 00:12 99328 --sha-w c:\windows\system32\ganogeyu.dll
2009-01-21 16:09 . 2009-01-21 16:09 64000 --sha-w c:\windows\system32\gavulowe.exe
2009-01-02 18:35 . 2009-01-02 18:35 104960 --sha-w c:\windows\system32\giwasabu.dll
1601-01-01 00:12 . 1601-01-01 00:12 70301 --sha-w c:\windows\system32\gokehama.dll.tmp
1601-01-01 00:12 . 1601-01-01 00:12 70301 --sha-w c:\windows\system32\guhobeso.dll.tmp
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\jolemanu.exe
1601-01-01 00:12 . 1601-01-01 00:12 64000 --sha-w c:\windows\system32\jorenoli.dll
2008-05-14 19:33 . 2008-05-12 23:27 3454 --sha-w c:\windows\system32\KGyGaAvL.sys
1601-01-01 00:12 . 1601-01-01 00:12 93184 --sha-w c:\windows\system32\kopisuve.dll
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\lopeveje.exe
2009-01-22 22:08 . 2009-01-22 22:08 62976 --sha-w c:\windows\system32\lulosiki.exe
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\muhenali.exe
1601-01-01 00:12 . 1601-01-01 00:12 100864 --sha-w c:\windows\system32\nehaheku.dll
1601-01-01 00:12 . 1601-01-01 00:12 99840 --sha-w c:\windows\system32\nenepoke.dll
1601-01-01 00:12 . 1601-01-01 00:12 64000 --sha-w c:\windows\system32\nonamira.dll
1601-01-01 00:12 . 1601-01-01 00:12 93184 --sha-w c:\windows\system32\pasisako.dll
1601-01-01 00:12 . 1601-01-01 00:12 99328 --sha-w c:\windows\system32\pedovari.dll
1601-01-01 00:12 . 1601-01-01 00:12 70301 --sha-w c:\windows\system32\relipasi.dll.tmp
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\ropepike.exe
2009-01-02 18:35 . 2009-01-02 18:35 61440 --sha-w c:\windows\system32\rorivano.exe
1601-01-01 00:12 . 1601-01-01 00:12 93184 --sha-w c:\windows\system32\sapuvidi.dll
1601-01-01 00:12 . 1601-01-01 00:12 100864 --sha-w c:\windows\system32\sineside.dll
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\sovagejo.exe
1601-01-01 00:12 . 1601-01-01 00:12 98816 --sha-w c:\windows\system32\sozoyota.dll
1601-01-01 00:12 . 1601-01-01 00:12 104448 --sha-w c:\windows\system32\suvejati.dll
2009-01-06 18:17 . 2009-01-06 18:17 100352 --sha-w c:\windows\system32\temoliro.dll
1601-01-01 00:12 . 1601-01-01 00:12 101376 --sha-w c:\windows\system32\tikufozi.dll
2009-01-08 02:58 . 2009-01-08 02:58 61440 --sha-w c:\windows\system32\tojokiyi.exe
1601-01-01 00:12 . 1601-01-01 00:12 91648 --sha-w c:\windows\system32\tosiyago.dll
1601-01-01 00:12 . 1601-01-01 00:12 105984 --sha-w c:\windows\system32\tulayeba.dll
2009-01-06 18:17 . 2009-01-06 18:17 61440 --sha-w c:\windows\system32\wihozoji.exe
1601-01-01 00:12 . 1601-01-01 00:12 100352 --sha-w c:\windows\system32\wumedogu.dll
1601-01-01 00:12 . 1601-01-01 00:12 99328 --sha-w c:\windows\system32\wuzutano.dll
1601-01-01 00:12 . 1601-01-01 00:12 99840 --sha-w c:\windows\system32\yuhisona.dll
1601-01-01 00:12 . 1601-01-01 00:12 61440 --sha-w c:\windows\system32\zetorawi.exe
.

((((((((((((((((((((((((((((( SnapShot@2009-04-22_23.23.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-23 00:12 . 2009-04-23 00:12 16384 c:\windows\Temp\Perflib_Perfdata_7e4.dat
+ 2009-04-23 00:12 . 2009-04-23 00:12 16384 c:\windows\Temp\Perflib_Perfdata_25c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-07-31 2321600]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-02-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-02-28 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-02-28 569413]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-13 217088]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"eFax 4.3"="c:\program files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 116224]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"EPSON Stylus Photo R1800 (Copy 2)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9LE.EXE" [2004-09-08 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-11 289576]
"EPSON Stylus Photo R2400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE" [2004-11-10 98304]
"58a63c70"="c:\windows\system32\fijeriki.dll" [2009-04-22 100864]

c:\documents and settings\Mariana\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-4-7 1773568]
eFax 4.3.lnk - c:\program files\eFax Messenger 4.3\J2GTray.exe [2008-4-30 629248]
Kothari Gamma Loader.lnk - c:\windows\Installer\{A3848EA1-CB60-4876-8D8C-8E9265C6B955}\_18be6784.exe [2008-12-2 766]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= "c:\program files\Trend Micro\Tmas\sshook.dll" [2006-09-22 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-02-23 01:11 39936 ----a-w c:\windows\system32\fusstub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 21:51 73728 ----a-w c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ cli fusstub

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk
backup=c:\windows\pss\Trend Micro Anti-Spyware.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UPS WorldShip Messaging Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\UPS WorldShip Messaging Utility.lnk
backup=c:\windows\pss\UPS WorldShip Messaging Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UPS WorldShip PLD Reminder Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\UPS WorldShip PLD Reminder Utility.lnk
backup=c:\windows\pss\UPS WorldShip PLD Reminder Utility.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sivafobibu"=Rundll32.exe "c:\windows\system32\guhobeso.dll",s
"igfxpers"=c:\windows\system32\igfxpers.exe
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"igfxtray"=c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=
"c:\\Program Files\\Symantec\\LiveUpdate\\LuCallbackProxy.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2006-11-30 102712]
R3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\DRIVERS\GCXX.sys [2005-01-03 114944]
R3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\DRIVERS\GCXXNet.sys [2005-01-03 53248]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-03-07 30080]
R3 SQLAgent$UPSWSDBSERVER;SQLAgent$UPSWSDBSERVER;c:\documents and settings\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlagent.EXE [2005-05-04 323584]
S0 shpf;Sony HDD Protection Filter Driver;c:\windows\system32\DRIVERS\shpf.sys [2005-11-21 9216]
S2 FdRedir;FdRedir;c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-02-23 13440]
S2 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-02-23 33024]
S2 MSSQL$UPSWSDBSERVER;MSSQL$UPSWSDBSERVER;c:\documents and settings\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe [2008-05-26 9154560]
S3 IFXTPM;IFXTPM;c:\windows\system32\DRIVERS\IFXTPM.SYS [2005-10-21 36352]
S3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\DRIVERS\SonyPI.sys [2003-06-19 71961]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-02-22 226304]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cebe62-e673-11dd-8cfa-0013a940d8b0}]
\Shell\Auto\command - auto.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.nytimes.com/pages/business/index.html
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
Trusted Zone: trymedia.com
DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
DPF: {3DFD2B52-C6E9-11D4-8226-005004F658FC} - hxxps://northamerica.sagecrm.com/OmniPrintInternational713hzolny//Plugin/eWarePluginX.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-22 17:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


c:\windows\system32\ikirejif.ini 1408480 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(932)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\passport.dll
c:\program files\Protector Suite QL\BhTcAll.dll
c:\program files\Protector Suite QL\BhDevTfm.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\VESWinlogon.dll
c:\program files\Protector Suite QL\AlgVer.dll
c:\program files\Protector Suite QL\TCBioLib.dll

- - - - - - - > 'lsass.exe'(988)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll

- - - - - - - > 'explorer.exe'(4028)
c:\windows\system32\fijeriki.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\program files\Sony\SmartWi Connection Utility\SmartWiService.exe
c:\program files\Apoint\ApntEx.exe
c:\windows\system32\rundll32.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
.
**************************************************************************
.
Completion time: 2009-04-23 17:24 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-23 00:24
ComboFix2.txt 2009-04-22 23:34

Pre-Run: 86,159,822,848 bytes free
Post-Run: 86,158,147,584 bytes free

323 --- E O F --- 2009-01-14 11:04






--------------------------------------------------------------------------
HIjack this log





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:29:50 PM, on 4/22/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
C:\DOCUMENTS AND SETTINGS\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\Program Files\Sony\VAIO Power Management\SPMgr.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe
C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\eFax Messenger 4.3\J2GTray.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nytimes.com/pages/business/index.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.sony.com/vaiopeople
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] "C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe"
O4 - HKLM\..\Run: [SonyPowerCfg] "C:\Program Files\Sony\VAIO Power Management\SPMgr.exe"
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [VAIO Update 2] "C:\Program Files\Sony\VAIO Update 2\VAIOUpdt.exe" /Stationary
O4 - HKLM\..\Run: [VAIO Recovery] C:\WINDOWS\Sonysys\VAIO Recovery\PartSeal.exe
O4 - HKLM\..\Run: [eFax 4.3] "C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" /R
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [EPSON Stylus Photo R1800 (Copy 2)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9LE.EXE /P33 "EPSON Stylus Photo R1800 (Copy 2)" /O6 "USB005" /M "Stylus Photo R1800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [EPSON Stylus Photo R2400] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE /P24 "EPSON Stylus Photo R2400" /O6 "USB006" /M "Stylus Photo R2400"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [58a63c70] rundll32.exe "C:\WINDOWS\system32\fijeriki.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - S-1-5-18 Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: eFax 4.3.lnk = C:\Program Files\eFax Messenger 4.3\J2GTray.exe
O4 - Global Startup: Kothari Gamma Loader.lnk = ?
O8 - Extra context menu item: &ieSpell Options - res://C:\Program Files\ieSpell\iespell.dll/SPELLOPTION.HTM
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Check &Spelling - res://C:\Program Files\ieSpell\iespell.dll/SPELLCHECK.HTM
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Lookup on Merriam Webster - file://C:\Program Files\ieSpell\Merriam Webster.HTM
O8 - Extra context menu item: Lookup on Wikipedia - file://C:\Program Files\ieSpell\wikipedia.HTM
O9 - Extra button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: (no name) - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra 'Tools' menuitem: ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {254AA86E-5655-4518-AA87-185D7CC41801} (LogMeIn Rescue Technician Console) - https://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3DFD2B52-C6E9-11D4-8226-005004F658FC} (XeWare Control) - https://northamerica.sagecrm.com/OmniPrintInternational713hzolny//Plugin/eWarePluginX.cab
O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://www.ca.com/us/securityadvisor/pestscan/pestscan.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5483.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1186967184239
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - Unknown owner - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (file missing)
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SmartWiService - Sony Electronics, Inc - C:\Program Files\Sony\SmartWi Connection Utility\SmartWiService.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

--
End of file - 15699 bytes

[Shaba]

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:


File::
c:\windows\system32\ikirejif.ini
c:\windows\system32\fijeriki.dll
c:\windows\system32\vogomiyi.dll
c:\windows\system32\giwogese.exe
c:\windows\system32\vidasasa.exe
c:\windows\system32\yiyerufe.dll
c:\windows\system32\komurolo.exe
c:\windows\system32\burabapa.dll_old
c:\windows\system32\godidusa.exe
c:\windows\system32\pakimati.exe
c:\windows\system32\fivusaju.dll
c:\windows\system32\gakemojo.exe
c:\windows\system32\vuvubuyo.dll
c:\windows\system32\weheyepe.dll
c:\windows\system32\gebojele.dll
c:\windows\system32\lusanuwo.dll
c:\windows\system32\drivers\eitbjblq.sys
c:\windows\system32\napigowu.exe
c:\windows\system32\fenopalu.dll
c:\windows\system32\tonakuri.dll
c:\windows\system32\runilowu.dll
c:\windows\system32\kukezifu.dll
c:\windows\system32\zizigosi.dll
c:\windows\system32\wojawiho.dll
c:\windows\system32\sifugayu.dll
c:\windows\system32\pabinula.dll
c:\windows\system32\tovituta.dll
c:\windows\system32\jedubaji.dll
c:\windows\system32\lawewiku.dll
c:\windows\system32\rumapuhu.dll
c:\windows\system32\zisakawa.dll
c:\windows\system32\jufevedu.dll
c:\windows\system32\tubevare.dll
c:\windows\system32\peritohu.dll
c:\windows\system32\sadotawa.dll
c:\windows\system32\wvUollIc.dll
c:\windows\system32\tifipuwo.dll
c:\windows\system32\gezupuye.dll
c:\windows\system32\pegupige.dll
c:\windows\system32\fibayivu.dll
c:\windows\system32\bazomiyu.dll
c:\windows\system32\savomazo.dll
c:\windows\system32\vedavuri.dll
c:\windows\system32\lamobeni.dll
c:\windows\system32\kikajeki.dll
c:\windows\system32\leyapoma.dll
c:\windows\system32\cbXNFyxU.dll
c:\windows\system32\bimoyuka.dll
c:\windows\system32\binanuye.dll
c:\windows\system32\bivegedu.exe
c:\windows\system32\fapimana.dll
c:\windows\system32\fetoraha.dll
c:\windows\system32\gajehole.exe
c:\windows\system32\ganogeyu.dll
c:\windows\system32\gavulowe.exe
c:\windows\system32\giwasabu.dll
c:\windows\system32\gokehama.dll.tmp
c:\windows\system32\guhobeso.dll.tmp
c:\windows\system32\jolemanu.exe
c:\windows\system32\jorenoli.dll
c:\windows\system32\kopisuve.dll
c:\windows\system32\lopeveje.exe
c:\windows\system32\lulosiki.exe
c:\windows\system32\muhenali.exe
c:\windows\system32\nehaheku.dll
c:\windows\system32\nenepoke.dll
c:\windows\system32\nonamira.dll
c:\windows\system32\pasisako.dll
c:\windows\system32\pedovari.dll
c:\windows\system32\relipasi.dll.tmp
c:\windows\system32\ropepike.exe
c:\windows\system32\rorivano.exe
c:\windows\system32\sapuvidi.dll
c:\windows\system32\sineside.dll
c:\windows\system32\sovagejo.exe
c:\windows\system32\sozoyota.dll
c:\windows\system32\suvejati.dll
c:\windows\system32\temoliro.dll
c:\windows\system32\tikufozi.dll
c:\windows\system32\tojokiyi.exe
c:\windows\system32\tosiyago.dll
c:\windows\system32\tulayeba.dll
c:\windows\system32\wihozoji.exe
c:\windows\system32\wumedogu.dll
c:\windows\system32\wuzutano.dll
c:\windows\system32\yuhisona.dll
c:\windows\system32\zetorawi.exe

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"sivafobibu"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cebe62-e673-11dd-8cfa-0013a940d8b0}]



Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.

http://img.photobucket.com/albums/v666/sUBs/CFScriptB-4.gif

Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

[lunagirls]

ComboFix 09-04-23.A3 - Mariana 04/23/2009 9:47.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1520 [GMT -7:00]
Running from: c:\documents and settings\Mariana\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mariana\Desktop\CFScript.txt
FW: Norton Internet Worm Protection *disabled*

FILE ::
c:\windows\system32\bazomiyu.dll
c:\windows\system32\bimoyuka.dll
c:\windows\system32\binanuye.dll
c:\windows\system32\bivegedu.exe
c:\windows\system32\burabapa.dll_old
c:\windows\system32\cbXNFyxU.dll
c:\windows\system32\drivers\eitbjblq.sys
c:\windows\system32\fapimana.dll
c:\windows\system32\fenopalu.dll
c:\windows\system32\fetoraha.dll
c:\windows\system32\fibayivu.dll
c:\windows\system32\fijeriki.dll
c:\windows\system32\fivusaju.dll
c:\windows\system32\gajehole.exe
c:\windows\system32\gakemojo.exe
c:\windows\system32\ganogeyu.dll
c:\windows\system32\gavulowe.exe
c:\windows\system32\gebojele.dll
c:\windows\system32\gezupuye.dll
c:\windows\system32\giwasabu.dll
c:\windows\system32\giwogese.exe
c:\windows\system32\godidusa.exe
c:\windows\system32\gokehama.dll.tmp
c:\windows\system32\guhobeso.dll.tmp
c:\windows\system32\ikirejif.ini
c:\windows\system32\jedubaji.dll
c:\windows\system32\jolemanu.exe
c:\windows\system32\jorenoli.dll
c:\windows\system32\jufevedu.dll
c:\windows\system32\kikajeki.dll
c:\windows\system32\komurolo.exe
c:\windows\system32\kopisuve.dll
c:\windows\system32\kukezifu.dll
c:\windows\system32\lamobeni.dll
c:\windows\system32\lawewiku.dll
c:\windows\system32\leyapoma.dll
c:\windows\system32\lopeveje.exe
c:\windows\system32\lulosiki.exe
c:\windows\system32\lusanuwo.dll
c:\windows\system32\muhenali.exe
c:\windows\system32\napigowu.exe
c:\windows\system32\nehaheku.dll
c:\windows\system32\nenepoke.dll
c:\windows\system32\nonamira.dll
c:\windows\system32\pabinula.dll
c:\windows\system32\pakimati.exe
c:\windows\system32\pasisako.dll
c:\windows\system32\pedovari.dll
c:\windows\system32\pegupige.dll
c:\windows\system32\peritohu.dll
c:\windows\system32\relipasi.dll.tmp
c:\windows\system32\ropepike.exe
c:\windows\system32\rorivano.exe
c:\windows\system32\rumapuhu.dll
c:\windows\system32\runilowu.dll
c:\windows\system32\sadotawa.dll
c:\windows\system32\sapuvidi.dll
c:\windows\system32\savomazo.dll
c:\windows\system32\sifugayu.dll
c:\windows\system32\sineside.dll
c:\windows\system32\sovagejo.exe
c:\windows\system32\sozoyota.dll
c:\windows\system32\suvejati.dll
c:\windows\system32\temoliro.dll
c:\windows\system32\tifipuwo.dll
c:\windows\system32\tikufozi.dll
c:\windows\system32\tojokiyi.exe
c:\windows\system32\tonakuri.dll
c:\windows\system32\tosiyago.dll
c:\windows\system32\tovituta.dll
c:\windows\system32\tubevare.dll
c:\windows\system32\tulayeba.dll
c:\windows\system32\vedavuri.dll
c:\windows\system32\vidasasa.exe
c:\windows\system32\vogomiyi.dll
c:\windows\system32\vuvubuyo.dll
c:\windows\system32\weheyepe.dll
c:\windows\system32\wihozoji.exe
c:\windows\system32\wojawiho.dll
c:\windows\system32\wumedogu.dll
c:\windows\system32\wuzutano.dll
c:\windows\system32\wvUollIc.dll
c:\windows\system32\yiyerufe.dll
c:\windows\system32\yuhisona.dll
c:\windows\system32\zetorawi.exe
c:\windows\system32\zisakawa.dll
c:\windows\system32\zizigosi.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\bazomiyu.dll
c:\windows\system32\bimoyuka.dll
c:\windows\system32\binanuye.dll
c:\windows\system32\bivegedu.exe
c:\windows\system32\burabapa.dll_old
c:\windows\system32\cbXNFyxU.dll
c:\windows\system32\drivers\eitbjblq.sys
c:\windows\system32\fapimana.dll
c:\windows\system32\fenopalu.dll
c:\windows\system32\fetoraha.dll
c:\windows\system32\fibayivu.dll
c:\windows\system32\fijeriki.dll
c:\windows\system32\fivusaju.dll
c:\windows\system32\gajehole.exe
c:\windows\system32\gakemojo.exe
c:\windows\system32\ganogeyu.dll
c:\windows\system32\gavulowe.exe
c:\windows\system32\gebojele.dll
c:\windows\system32\gezupuye.dll
c:\windows\system32\giwasabu.dll
c:\windows\system32\giwogese.exe
c:\windows\system32\godidusa.exe
c:\windows\system32\gokehama.dll.tmp
c:\windows\system32\guhobeso.dll.tmp
c:\windows\system32\ikirejif.ini
c:\windows\system32\jedubaji.dll
c:\windows\system32\jolemanu.exe
c:\windows\system32\jorenoli.dll
c:\windows\system32\jufevedu.dll
c:\windows\system32\kikajeki.dll
c:\windows\system32\komurolo.exe
c:\windows\system32\kopisuve.dll
c:\windows\system32\kukezifu.dll
c:\windows\system32\lamobeni.dll
c:\windows\system32\lawewiku.dll
c:\windows\system32\leyapoma.dll
c:\windows\system32\lopeveje.exe
c:\windows\system32\lulosiki.exe
c:\windows\system32\lusanuwo.dll
c:\windows\system32\muhenali.exe
c:\windows\system32\napigowu.exe
c:\windows\system32\nehaheku.dll
c:\windows\system32\nenepoke.dll
c:\windows\system32\nonamira.dll
c:\windows\system32\pabinula.dll
c:\windows\system32\pakimati.exe
c:\windows\system32\pasisako.dll
c:\windows\system32\pedovari.dll
c:\windows\system32\pegupige.dll
c:\windows\system32\peritohu.dll
c:\windows\system32\relipasi.dll.tmp
c:\windows\system32\ropepike.exe
c:\windows\system32\rorivano.exe
c:\windows\system32\rumapuhu.dll
c:\windows\system32\runilowu.dll
c:\windows\system32\sadotawa.dll
c:\windows\system32\sapuvidi.dll
c:\windows\system32\savomazo.dll
c:\windows\system32\sifugayu.dll
c:\windows\system32\sineside.dll
c:\windows\system32\sovagejo.exe
c:\windows\system32\sozoyota.dll
c:\windows\system32\suvejati.dll
c:\windows\system32\temoliro.dll
c:\windows\system32\tifipuwo.dll
c:\windows\system32\tikufozi.dll
c:\windows\system32\tojokiyi.exe
c:\windows\system32\tonakuri.dll
c:\windows\system32\tosiyago.dll
c:\windows\system32\tovituta.dll
c:\windows\system32\tubevare.dll
c:\windows\system32\tulayeba.dll
c:\windows\system32\vedavuri.dll
c:\windows\system32\vidasasa.exe
c:\windows\system32\vogomiyi.dll
c:\windows\system32\vuvubuyo.dll
c:\windows\system32\weheyepe.dll
c:\windows\system32\wihozoji.exe
c:\windows\system32\wojawiho.dll
c:\windows\system32\wumedogu.dll
c:\windows\system32\wuzutano.dll
c:\windows\system32\wvUollIc.dll
c:\windows\system32\yiyerufe.dll
c:\windows\system32\yuhisona.dll
c:\windows\system32\zetorawi.exe
c:\windows\system32\zisakawa.dll
c:\windows\system32\zizigosi.dll

.
((((((((((((((((((((((((( Files Created from 2009-05-23 to 2009-4-23 )))))))))))))))))))))))))))))))
.

2009-04-22 23:32 . 2009-03-27 07:09 1193414 -c----w c:\windows\system32\dllcache\sysmain.sdb
2009-04-22 23:32 . 2008-04-21 10:02 215552 -c----w c:\windows\system32\dllcache\wordpad.exe
2009-04-01 21:28 . 2009-04-01 22:29 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-01 21:28 . 2009-04-01 22:04 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-03-31 01:14 . 2009-03-31 01:26 -------- d-----w C:\Laptop Backup
2009-03-26 01:47 . 2009-03-26 19:27 -------- d-----w c:\program files\Windows Live Safety CenterRebootActions
2009-03-25 19:33 . 2009-03-26 19:27 -------- d-----w c:\program files\Windows Live Safety Center

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 00:11 . 2006-09-22 16:06 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-04-23 00:11 . 2006-09-22 16:07 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-04-22 23:59 . 2006-09-22 16:07 -------- d-----w c:\program files\Symantec
2009-04-22 23:04 . 2009-03-04 21:23 -------- d-----w c:\program files\Common
2009-04-21 22:26 . 2006-09-22 16:11 -------- d-----w c:\program files\Trend Micro
2009-03-11 05:59 . 2006-09-22 16:11 -------- d-----w c:\documents and settings\All Users\Application Data\Digital Interactive Systems Corporation
2008-05-12 23:27 . 2006-09-22 16:11 74296 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2008-01-08 22:15 . 2008-01-03 18:50 229376 ----a-w c:\documents and settings\Mariana\cwshredder.dll
2007-11-18 14:43 . 2007-11-18 14:43 137 ----a-w c:\documents and settings\NetworkService\Local Settings\Application Data\fusioncache.dat
2007-11-18 14:42 . 2006-10-20 18:56 130 ----a-w c:\documents and settings\Mariana\Local Settings\Application Data\fusioncache.dat
2006-12-01 03:04 . 2006-11-28 21:39 132 ----a-w c:\documents and settings\Mariana\Application Data\wklnhst.dat
2006-09-22 16:11 . 2006-10-20 18:56 64800 ----a-w c:\documents and settings\Mariana\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2006-07-22 20:09 . 2006-07-22 20:09 136 ----a-w c:\documents and settings\Administrator\Local Settings\Application Data\fusioncache.dat
2008-05-14 19:33 . 2008-05-14 19:28 56 --sh--r c:\windows\system32\DA3B286D5F.sys
2008-05-14 19:33 . 2008-05-12 23:27 3454 --sha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-04-22_23.23.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-23 16:57 . 2009-04-23 16:57 16384 c:\windows\Temp\Perflib_Perfdata_7d8.dat
+ 2009-04-23 16:57 . 2009-04-23 16:57 16384 c:\windows\Temp\Perflib_Perfdata_194.dat
- 2008-08-14 17:52 . 2007-11-30 12:39 17272 c:\windows\system32\spmsg.dll
+ 2008-08-14 17:52 . 2007-11-30 11:18 17272 c:\windows\system32\spmsg.dll
+ 2006-07-22 18:44 . 2008-06-12 14:16 91648 c:\windows\system32\mtxoci.dll
+ 2006-07-22 18:31 . 2008-06-12 14:16 66560 c:\windows\system32\mtxclu.dll
- 2006-07-22 18:31 . 2006-03-01 19:42 66560 c:\windows\system32\mtxclu.dll
- 2006-07-22 18:44 . 2006-02-28 12:00 58880 c:\windows\system32\msdtclog.dll
+ 2006-07-22 18:44 . 2008-06-12 14:16 58880 c:\windows\system32\msdtclog.dll
+ 2006-07-22 18:44 . 2006-02-28 12:00 19429 c:\windows\system32\MsDtc\Trace\msdtcvtr.bat
+ 2008-06-12 14:16 . 2008-06-12 14:16 91648 c:\windows\system32\dllcache\mtxoci.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 66560 c:\windows\system32\dllcache\mtxclu.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 58880 c:\windows\system32\dllcache\msdtclog.dll
- 2007-03-08 19:29 . 2009-02-18 04:13 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 23040 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 61440 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 27136 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 11264 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 86016 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 12288 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 4096 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2006-07-22 18:30 . 2006-02-28 12:00 2589 c:\windows\I386\RUNW32.BAT
+ 2006-07-22 18:47 . 2008-02-15 09:06 351744 c:\windows\system32\xpsp3res.dll
- 2006-07-22 18:31 . 2006-02-28 12:00 351232 c:\windows\system32\winhttp.dll
+ 2006-07-22 18:31 . 2008-12-16 12:47 351232 c:\windows\system32\winhttp.dll
+ 2006-07-22 18:31 . 2008-12-05 07:12 144896 c:\windows\system32\schannel.dll
- 2006-07-22 18:31 . 2007-04-25 14:21 144896 c:\windows\system32\schannel.dll
+ 2006-07-22 18:44 . 2008-06-12 14:16 161792 c:\windows\system32\msdtcuiu.dll
+ 2006-07-22 18:44 . 2008-06-12 14:16 956928 c:\windows\system32\msdtctm.dll
+ 2006-07-22 18:44 . 2008-06-12 14:16 428032 c:\windows\system32\msdtcprx.dll
+ 2008-12-16 12:47 . 2008-12-16 12:47 351232 c:\windows\system32\dllcache\winhttp.dll
+ 2007-04-25 14:21 . 2008-12-05 07:12 144896 c:\windows\system32\dllcache\schannel.dll
- 2007-04-25 14:21 . 2007-04-25 14:21 144896 c:\windows\system32\dllcache\schannel.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 161792 c:\windows\system32\dllcache\msdtcuiu.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 956928 c:\windows\system32\dllcache\msdtctm.dll
+ 2008-06-12 14:16 . 2008-06-12 14:16 428032 c:\windows\system32\dllcache\msdtcprx.dll
- 2007-03-08 19:29 . 2009-02-18 04:13 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 409600 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 286720 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 249856 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 794624 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 135168 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2007-03-08 19:29 . 2009-04-23 10:07 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2007-03-08 19:29 . 2009-02-18 04:13 593920 c:\windows\Installer\{90110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-07-31 2321600]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-02-28 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-11-18 118784]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-02-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-02-28 602182]
"EOUApp"="c:\program files\Intel\Wireless\Bin\EOUWiz.exe" [2006-02-28 569413]
"SonyPowerCfg"="c:\program files\Sony\VAIO Power Management\SPMgr.exe" [2006-06-13 217088]
"ISBMgr.exe"="c:\program files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 32768]
"VAIO Update 2"="c:\program files\Sony\VAIO Update 2\VAIOUpdt.exe" [2005-10-12 151552]
"VAIO Recovery"="c:\windows\Sonysys\VAIO Recovery\PartSeal.exe" [2003-04-20 28672]
"eFax 4.3"="c:\program files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 116224]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2005-08-11 249856]
"EPSON Stylus Photo R1800 (Copy 2)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9LE.EXE" [2004-09-08 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-11 289576]
"EPSON Stylus Photo R2400"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9SE.EXE" [2004-11-10 98304]

c:\documents and settings\Mariana\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-3-16 113664]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bluetooth Manager.lnk - c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe [2006-4-7 1773568]
eFax 4.3.lnk - c:\program files\eFax Messenger 4.3\J2GTray.exe [2008-4-30 629248]
Kothari Gamma Loader.lnk - c:\windows\Installer\{A3848EA1-CB60-4876-8D8C-8E9265C6B955}\_18be6784.exe [2008-12-2 766]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= "c:\program files\Trend Micro\Tmas\sshook.dll" [2006-09-22 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2006-02-23 01:11 39936 ----a-w c:\windows\system32\fusstub.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
2006-03-09 21:51 73728 ----a-w c:\windows\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ cli fusstub

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Speed Launcher.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Speed Launcher.lnk
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Acrobat Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Acrobat Synchronizer.lnk
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
backup=c:\windows\pss\Logitech SetPoint.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Service Manager.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Service Manager.lnk
backup=c:\windows\pss\Service Manager.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Trend Micro Anti-Spyware.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Trend Micro Anti-Spyware.lnk
backup=c:\windows\pss\Trend Micro Anti-Spyware.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UPS WorldShip Messaging Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\UPS WorldShip Messaging Utility.lnk
backup=c:\windows\pss\UPS WorldShip Messaging Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^UPS WorldShip PLD Reminder Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\UPS WorldShip PLD Reminder Utility.lnk
backup=c:\windows\pss\UPS WorldShip PLD Reminder Utility.lnkCommon Startup

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"igfxpers"=c:\windows\system32\igfxpers.exe
"igfxhkcmd"=c:\windows\system32\hkcmd.exe
"igfxtray"=c:\windows\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DISC\\DISCover.exe"=
"c:\\Program Files\\DISC\\DiscStreamHub.exe"=
"c:\\Program Files\\DISC\\myFTP.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Intel\\Wireless\\Bin\\S24EvMon.exe"=
"c:\\Program Files\\Symantec\\LiveUpdate\\LuCallbackProxy.exe"=

R3 SEMWModem;Sony Ericsson SEMWModem;c:\windows\system32\DRIVERS\GCXX.sys [2005-01-03 114944]
R3 SEMWWNIC;Sony Ericsson SEMWWNIC;c:\windows\system32\DRIVERS\GCXXNet.sys [2005-01-03 53248]
R3 SonyImgF;Sony Image Conversion Filter Driver;c:\windows\system32\DRIVERS\SonyImgF.sys [2006-03-07 30080]
R3 SQLAgent$UPSWSDBSERVER;SQLAgent$UPSWSDBSERVER;c:\documents and settings\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlagent.EXE [2005-05-04 323584]
S0 shpf;Sony HDD Protection Filter Driver;c:\windows\system32\DRIVERS\shpf.sys [2005-11-21 9216]
S2 FdRedir;FdRedir;c:\program files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-02-23 13440]
S2 FileDisk2;FileDisk Protector Kernel Driver;c:\program files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-02-23 33024]
S2 MSSQL$UPSWSDBSERVER;MSSQL$UPSWSDBSERVER;c:\documents and settings\MARIANA\DESKTOP\UPS\WSTD\MSSQL$UPSWSDBSERVER\Binn\sqlservr.exe [2008-05-26 9154560]
S3 IFXTPM;IFXTPM;c:\windows\system32\DRIVERS\IFXTPM.SYS [2005-10-21 36352]
S3 SPI;Sony Programmable I/O Control Device;c:\windows\system32\DRIVERS\SonyPI.sys [2003-06-19 71961]
S3 ti21sony;ti21sony;c:\windows\system32\drivers\ti21sony.sys [2006-02-22 226304]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b3cebe62-e673-11dd-8cfa-0013a940d8b0}]
\Shell\Auto\command - auto.exe
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL auto.exe
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-58a63c70 - c:\windows\system32\fijeriki.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.nytimes.com/pages/business/index.html
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = hxxp://www.sony.com/vaiopeople
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Append to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
IE: Convert link target to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert link target to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert selected links to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert selected links to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Convert selection to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: Convert selection to existing PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert to Adobe PDF - c:\program files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
IE: Lookup on Merriam Webster - file://c:\program files\ieSpell\Merriam Webster.HTM
IE: Lookup on Wikipedia - file://c:\program files\ieSpell\wikipedia.HTM
Trusted Zone: trymedia.com
DPF: {254AA86E-5655-4518-AA87-185D7CC41801} - hxxps://secure.logmeinrescue.com/TechConsole/x86/RescueControl.cab
DPF: {3DFD2B52-C6E9-11D4-8226-005004F658FC} - hxxps://northamerica.sagecrm.com/OmniPrintInternational713hzolny//Plugin/eWarePluginX.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-23 09:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(936)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll
c:\windows\system32\biologon.dll
c:\program files\Protector Suite QL\homepass.dll
c:\program files\Protector Suite QL\BhTcAll.dll
c:\program files\Protector Suite QL\BhDevTfm.dll
c:\program files\Protector Suite QL\passport.dll
c:\program files\Protector Suite QL\AlgVer.dll
c:\program files\Protector Suite QL\TCBioLib.dll
c:\program files\Protector Suite QL\remote.dll
c:\windows\system32\VESWinlogon.dll

- - - - - - - > 'lsass.exe'(992)
c:\windows\system32\fusstub.dll
c:\program files\Protector Suite QL\infra.dll
c:\program files\Protector Suite QL\homefus.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
c:\windows\system32\nvsvc32.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Sony\VAIO Event Service\VESMgr.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
c:\program files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
c:\program files\Sony\SmartWi Connection Utility\SmartWiService.exe
c:\program files\Apoint\ApntEx.exe
c:\windows\system32\rundll32.exe
c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe
c:\program files\Toshiba\Bluetooth Toshiba Stack\TosBtHSP.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-04-23 10:09 - machine was rebooted
ComboFix-quarantined-files.txt 2009-04-23 17:09
ComboFix2.txt 2009-04-23 00:24
ComboFix3.txt 2009-04-22 23:34

Pre-Run: 85,982,552,064 bytes free
Post-Run: 85,977,112,576 bytes free

464 --- E O F --- 2009-04-23 10:07

[Shaba]

Please go to Kaspersky website (http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html) and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs
Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

[lunagirls]

It wont let me install the aplication from Kaspersky. It says Starting Java applet has failed! Please go online to use this program.

[Shaba]

Then please try this instead:

Please go to ESET Online Scanner (http://www.eset.eu/online-scanner) - © ESET All Rights Reserved... to run an online scan.
Note: You - will - need to use Internet Explorer for this scan!
Check the box next to "YES, I accept the Terms of Use."
Click "Start"
Click Yes... at the run ActiveX prompt. Click Install... at the install ActiveX prompt.
Once installed, the scanner will be initialized.
Click "Start". Make sure that the options: Remove found threats is UNCHECKED
Scan unwanted applications is CHECKED
Click "Scan"
Wait for the scan to finish... it may take a while... please be patient. When the scan is finished...
Use Notepad to open the log file located at C:\Program Files\EsetOnlineScanner\log.txt
Copy and paste the contents of log.txt in your next reply.

[lunagirls]

Hi,

I click on instal active x and theres am internet explorer window that says :

"windows has blocked this software because it cant verify the publisher", and the only button to press in OK

thx

[Shaba]

Please download Malwarebytes Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) and save it to your desktop.
alternate download link 1 (http://malwarebytes.gt500.org/mbam-setup.exe)
alternate download link 2 (http://www.majorgeeks.com/Malwarebytes_Anti-Malware_d5756.html)
Make sure you are connected to the Internet.
Double-click on mbam-setup.exe to install the application.
When the installation begins, follow the prompts and do not make any changes to default settings.
When installation has finished, make sure you leave both of these checked:
Update Malwarebytes' Anti-Malware
Launch Malwarebytes' Anti-Malware

Then click Finish.
MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here (http://www.malwarebytes.org/mbam/database/mbam-rules.exe) and just double-click on mbam-rules.exe to install.
On the Scanner tab:
Make sure the "Perform Full Scan" option is selected.
Then click on the Scan button.

If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
Click OK to close the message box and continue with the removal process.
Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
Make sure that everything is checked, and click Remove Selected.
When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the contents of that report in your next reply and exit MBAM.
Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

[Shaba]

Due to the lack of feedback this Topic is closed.

If it has been four days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than four days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.