Page 1 of 3 123 LastLast
Results 1 to 10 of 23

Thread: Win32/Heur and Backdoor.Generic10.YVB

  1. #1
    Junior Member
    Join Date
    Nov 2007
    Posts
    25

    Cool Win32/Heur and Backdoor.Generic10.YVB

    My wife's laptop was throwing popups and redirecting web pages constantly. Tried Spybot and it identified some stuff and attempted to fix, but bad things persisted. Tried SuperAntiSpyware and it did similar stuff. I installed AVG AV and it is what now reports Win32/Heur and the Backdoor and it does seem to have halted much of the bad behavior on the laptop. But AVG continues to report the infections even as I tell it to handle them.

    I notice the nzssoqq.dll file noted at the bottom of the log. That is the file that AVG reports as being infected with Win32/Heur.

    AVG reports that deskperfl.dll is infected with the Backdoor.

    Thanks for your help.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:40:40 PM, on 1/5/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://start.earthlink.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mor...on/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: (no name) - {C481E723-A100-4B89-86AE-6B6A704ACF4A} - C:\WINDOWS\system32\deskperfl.dll
    O2 - BHO: (no name) - {FE01CF41-5578-48DA-A950-159D4E89CBBB} - c:\windows\system32\nzssoqq.dll
    O3 - Toolbar: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar3.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [s1rq2244] C:\WINDOWS\system32\s1rq2244.exe
    O4 - HKLM\..\Run: [Internet Connection Wizard Configuration Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwconfig.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [s1rq2244] C:\WINDOWS\system32\s1rq2244.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: AltaVista Search - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    O8 - Extra context menu item: Translate - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://atlterm01.lanlaw.com/wficat.cab
    O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (AltaVista Toolbar) - http://toolbar.altavista.com/app/too...a.cab?r=TVYRDR
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://preview.evite.com/js/ImageUploader5.cab
    O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://connect.mckennalong.com/msrdp.cab
    O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
    O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/ao...ad.9.0.0.2.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_0_2_2.cab
    O18 - Protocol: bw+0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O20 - Winlogon Notify: znjpxwve - C:\WINDOWS\SYSTEM32\nzssoqq.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    --
    End of file - 18173 bytes

  2. #2
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi slyder

    We will begin with ComboFix.

    Please download ComboFix from one of these locations:

    Link 1
    Link 2
    Link 3

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



    Click on Yes, to continue scanning for malware.

    When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper


    If you need help, see this link:
    http://www.bleepingcomputer.com/comb...o-use-combofix
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  3. #3
    Junior Member
    Join Date
    Nov 2007
    Posts
    25

    Cool new logs

    Thanks for your time Shaba. Below are the two log files.

    ComboFix 09-01-10.01 - Wendy 2009-01-10 19:14:02.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.227 [GMT -5:00]
    Running from: c:\documents and settings\Wendy\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\Dynamic Toolbar
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\ALTAVISTATB0122.cfg
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\area.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\audio.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\babelfish.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\calculate.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\conversion.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\currency.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\dictionary.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\ErrorLog.txt
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\findword.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\flag_us.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\highlight.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\home.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\images.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\lastsearch.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\localindex.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\lookup.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\news.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\popup_off.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\popup_on.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\thissite.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\time.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\video.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\weather.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\web.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\zip.bmp
    c:\windows\system32\java2.sys c:\windows\system32\snjava.dll
    c:\windows\system32\MabryObj.dll
    c:\windows\system32\msrdo20.dll
    c:\windows\system32\rdocurs.dll
    c:\windows\Tasks\At1.job
    c:\windows\system32\nzssoqq.dll . . . . failed to delete

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_LXKKJRGW
    -------\Service_lxkkjrgw


    ((((((((((((((((((((((((( Files Created from 2008-12-11 to 2009-01-11 )))))))))))))))))))))))))))))))
    .

    2009-01-10 19:50 . 2009-01-10 19:50 54,156 --ah----- c:\windows\QTFont.qfn
    2009-01-10 19:50 . 2009-01-10 19:50 1,409 --a------ c:\windows\QTFont.for
    2009-01-05 21:39 . 2009-01-05 21:39 <DIR> d-------- c:\program files\Trend Micro
    2009-01-05 20:59 . 2009-01-05 21:19 <DIR> d--h----- C:\$AVG8.VAULT$
    2009-01-05 20:58 . 2009-01-05 20:58 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2009-01-05 20:58 . 2009-01-05 20:58 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2009-01-05 20:57 . 2009-01-10 02:23 <DIR> d-------- c:\windows\system32\drivers\Avg
    2009-01-05 20:57 . 2009-01-05 20:57 <DIR> d-------- c:\program files\AVG
    2009-01-05 20:57 . 2009-01-05 20:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2009-01-05 20:39 . 2009-01-05 20:39 <DIR> d-------- c:\documents and settings\Wendy\Application Data\iclaoacz
    2009-01-05 20:36 . 2009-01-05 20:36 <DIR> d-------- c:\documents and settings\NetworkService\Application Data\iclaoacz
    2009-01-01 17:43 . 2009-01-01 17:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-01-01 17:42 . 2009-01-01 17:43 <DIR> d-------- c:\program files\SUPERAntiSpyware
    2009-01-01 17:42 . 2009-01-01 17:42 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2009-01-01 17:42 . 2009-01-01 17:42 <DIR> d-------- c:\documents and settings\Wendy\Application Data\SUPERAntiSpyware.com

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-11-23 13:06 --------- d-----w c:\program files\Smilebox
    2008-11-20 14:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-11-20 11:11 --------- d-----w c:\program files\Spybot - Search & Destroy
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C481E723-A100-4B89-86AE-6B6A704ACF4A}]
    2008-11-12 16:59 105984 --a------ c:\windows\system32\deskperfl.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FE01CF41-5578-48DA-A950-159D4E89CBBB}]
    2009-01-10 19:49 104960 --a------ c:\windows\system32\nzssoqq.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "s1rq2244"="c:\windows\system32\s1rq2244.exe" [2002-12-09 15872]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-12-09 180269]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-02-02 77824]
    "s1rq2244"="c:\windows\system32\s1rq2244.exe" [2002-12-09 15872]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-05 1261336]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "MSACM.G723"= g723.acm
    "vidc.I263"= I263_32.drv

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\palmOne\\Hotsync.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\s1rq2244.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    R0 cagwohgw;cagwohgw;c:\windows\system32\drivers\cagwohgw.sys [2000-01-11 23424]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-05 97928]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
    R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-05 231704]
    S3 icm12blk;Intel(r) PC Camera CS780 Image Storage;c:\windows\system32\drivers\icm12blk.sys [2002-10-03 14184]
    S3 icm12fil;Intel(r) CS780 Audio Filter Driver;c:\windows\system32\drivers\icm12fil.sys [2002-10-03 16312]
    S3 ICM12USB;Intel(r) PC Camera CS780;c:\windows\system32\drivers\ICM12USB.sys [2002-10-03 428152]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
    S3 WPC11;Instant Wireless Network PC Card V3.0 Driver;c:\windows\system32\drivers\LSWLNDS.sys [2003-03-30 54083]
    S4 mrtRate;mrtRate; [x]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{213d4795-dc2b-11dc-9b6e-00022dbc235f}]
    \Shell\AutoRun\command - E:\Launch.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73782890-b96e-11db-9b39-00022dbc235f}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a
    .
    Contents of the 'Scheduled Tasks' folder

    2000-01-01 c:\windows\Tasks\Registration reminder 1.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]

    2000-01-01 c:\windows\Tasks\Registration reminder 2.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]

    2000-01-01 c:\windows\Tasks\Registration reminder 3.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-Internet Connection Wizard Configuration Tool - c:\program files\Internet Explorer\Connection Wizard\icwconfig.exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://my.yahoo.com/
    uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mSearch Bar =
    uInternet Settings,ProxyOverride = localhost
    uSearchURL,(Default) = about:blank
    IE: AltaVista Search - file://c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    IE: Translate - file://c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    Trusted Zone: free.aol.com
    Trusted Zone: www.plaxo.com
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

    O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

    c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\CONFLICT.1\ImageUploader5.ocx
    O16 -: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
    hxxp://preview.evite.com/js/ImageUploader5.cab
    c:\windows\Downloaded Program Files\CONFLICT.1\ImageUploader5.inf
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-10 19:49:43
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(692)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\wscntfy.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    .
    **************************************************************************
    .
    Completion time: 2009-01-10 19:55:42 - machine was rebooted [Wendy]
    ComboFix-quarantined-files.txt 2009-01-11 00:55:38

    Pre-Run: 18,635,055,104 bytes free
    Post-Run: 19,892,822,016 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

    191 --- E O F --- 2008-12-19 08:03:02


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:22:02 PM, on 1/10/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\system32\s1rq2244.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mor...on/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O2 - BHO: (no name) - {C481E723-A100-4B89-86AE-6B6A704ACF4A} - C:\WINDOWS\system32\deskperfl.dll
    O2 - BHO: (no name) - {FE01CF41-5578-48DA-A950-159D4E89CBBB} - c:\windows\system32\nzssoqq.dll
    O3 - Toolbar: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar3.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [s1rq2244] C:\WINDOWS\system32\s1rq2244.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKCU\..\Run: [s1rq2244] C:\WINDOWS\system32\s1rq2244.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: AltaVista Search - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    O8 - Extra context menu item: Translate - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://atlterm01.lanlaw.com/wficat.cab
    O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (AltaVista Toolbar) - http://toolbar.altavista.com/app/too...a.cab?r=TVYRDR
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://preview.evite.com/js/ImageUploader5.cab
    O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://connect.mckennalong.com/msrdp.cab
    O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
    O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/ao...ad.9.0.0.2.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_0_2_2.cab
    O18 - Protocol: bw+0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    --
    End of file - 18015 bytes

  4. #4
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    I'd like you to check a file for malware.

    c:\windows\system32\drivers\cagwohgw.sys
    • Copy/Paste the first file on the list into the white Upload a file box.
    • Click Send/Submit, and the file will upload to VirusTotal/Jotti, where it will be scanned by several anti-virus programmes.
    • After a while, a window will open, with details of what the scans found.
    • Save the complete results in a Notepad/Word document on your desktop.
    • Post back results here, please.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  5. #5
    Junior Member
    Join Date
    Nov 2007
    Posts
    25

    Cool VirusTotal log

    Thanks Shaba. Here you go. The formatting didn't come across, but hopefully it's still readable enough.

    Antivirus Version Last Update Result
    a-squared 4.0.0.73 2009.01.11 -
    AhnLab-V3 2009.1.10.0 2009.01.11 -
    AntiVir 7.9.0.54 2009.01.10 -
    Authentium 5.1.0.4 2009.01.10 -
    Avast 4.8.1281.0 2009.01.11 -
    AVG 8.0.0.229 2009.01.10 -
    BitDefender 7.2 2009.01.11 -
    CAT-QuickHeal 10.00 2009.01.09 -
    ClamAV 0.94.1 2009.01.11 -
    Comodo 915 2009.01.11 -
    DrWeb 4.44.0.09170 2009.01.11 -
    eSafe 7.0.17.0 2009.01.08 -
    eTrust-Vet 31.6.6301 2009.01.10 -
    F-Prot 4.4.4.56 2009.01.10 -
    F-Secure 8.0.14470.0 2009.01.11 -
    Fortinet 3.117.0.0 2009.01.11 -
    GData 19 2009.01.11 -
    Ikarus T3.1.1.45.0 2009.01.11 -
    K7AntiVirus 7.10.584 2009.01.09 -
    Kaspersky 7.0.0.125 2009.01.11 -
    McAfee 5491 2009.01.10 -
    McAfee+Artemis 5491 2009.01.10 -
    Microsoft 1.4205 2009.01.11 -
    NOD32 3756 2009.01.10 -
    Norman 5.99.02 2009.01.09 -
    Panda 9.4.3.3 2009.01.11 -
    PCTools 4.4.2.0 2009.01.11 -
    Prevx1 V2 2009.01.11 -
    Rising 21.11.62.00 2009.01.11 -
    SecureWeb-Gateway 6.7.6 2009.01.11 -
    Sophos 4.37.0 2009.01.11 -
    Sunbelt 3.2.1831.2 2009.01.09 -
    Symantec 10 2009.01.11 -
    TheHacker 6.3.1.4.217 2009.01.10 -
    TrendMicro 8.700.0.1004 2009.01.09 -
    VBA32 3.12.8.10 2009.01.10 -
    ViRobot 2009.1.10.1553 2009.01.10 -
    VirusBuster 4.5.11.0 2009.01.10 -
    Additional information
    File size: 23424 bytes
    MD5...: 5aa87714933a89a5bb210c2bfc1963ea
    SHA1..: 7d9d97c1b74c365132916d73201f545bbf9b27f1
    SHA256: d2668939889047c82c02a46821aecc7c845cb3f2572d4b6595552087648f492e
    SHA512: eff54e16fbfa1e5de4b86130e8024efacd4fcf0d81fd05ce911369896ccd6a03
    34ae253afa6bac70ca9457349d52cc1c7a5cb99190a5f9aa602c87f77b3dd602

    ssdeep: 384:tmCHOwScSjuweH5W+2uu199zoekyvVum5IeVIA3sOnWbX1Wnip0+l9rUqTS3
    eYT/:bfxSjuwE/XKQxX1VTS3PVxUV1X1

    PEiD..: -
    TrID..: File type identification
    Win64 Executable Generic (95.5%)
    Generic Win/DOS Executable (2.2%)
    DOS Executable Generic (2.2%)
    Autodesk FLIC Image File (extensions: flc, fli, cel) (0.0%)
    PEInfo: PE Structure information

    ( base data )
    entrypointaddress.: 0x12b85
    timedatestamp.....: 0x480253ac (Sun Apr 13 18:40:44 2008)
    machinetype.......: 0x14c (I386)

    ( 8 sections )
    name viradd virsiz rawdsiz ntrpy md5
    .text 0x300 0x1fa6 0x2000 6.68 cc278086da9ccc684b5af2cbfb521823
    .rdata 0x2300 0xe1 0x100 3.52 30b6d3f1709c17b6740d617b73ba5440
    .data 0x2400 0xc 0x80 0.38 0c41a08c90a7d5e81bf065649ebabedc
    .edata 0x2480 0x69b 0x700 4.90 02ff9b2411a8579556b494d77696e98c
    INIT 0x2b80 0x49c 0x500 5.11 ad36dda8aa5189e009efb998ac2b6a75
    .cmqd 0x3080 0x2400 0x2400 7.67 bb40fd2e27daa419ad88fc21159194f3
    .rsrc 0x5480 0x3f0 0x400 3.40 77e1fa48719c193c25fd459c9cdeb81a
    .reloc 0x5880 0x28a 0x300 5.49 d5b87dbd334aa89e184ce4e731356b3a

    ( 2 imports )
    > ntoskrnl.exe: Mm64BitPhysicalAddress, _alldiv, KeTickCount, WRITE_REGISTER_BUFFER_ULONG, WRITE_REGISTER_BUFFER_USHORT, WRITE_REGISTER_BUFFER_UCHAR, WRITE_REGISTER_ULONG, WRITE_REGISTER_USHORT, WRITE_REGISTER_UCHAR, READ_REGISTER_BUFFER_ULONG, READ_REGISTER_BUFFER_USHORT, READ_REGISTER_BUFFER_UCHAR, READ_REGISTER_ULONG, READ_REGISTER_USHORT, READ_REGISTER_UCHAR, memmove, DbgPrint, KeBugCheckEx, _allshr, MmGetPhysicalAddress, MmMapMemoryDumpMdl
    > HAL.dll: WRITE_PORT_BUFFER_ULONG, WRITE_PORT_BUFFER_USHORT, WRITE_PORT_BUFFER_UCHAR, READ_PORT_BUFFER_ULONG, READ_PORT_BUFFER_USHORT, READ_PORT_BUFFER_UCHAR, HalGetBusDataByOffset, HalTranslateBusAddress, WRITE_PORT_ULONG, WRITE_PORT_USHORT, WRITE_PORT_UCHAR, READ_PORT_ULONG, READ_PORT_USHORT, READ_PORT_UCHAR, IoFlushAdapterBuffers, IoMapTransfer, HalAllocateCrashDumpRegisters

    ( 46 exports )
    ScsiDebugPrint, ScsiPortCompleteRequest, ScsiPortConvertPhysicalAddressToUlong, ScsiPortConvertUlongToPhysicalAddress, ScsiPortFlushDma, ScsiPortFreeDeviceBase, ScsiPortGetBusData, ScsiPortGetDeviceBase, ScsiPortGetLogicalUnit, ScsiPortGetPhysicalAddress, ScsiPortGetSrb, ScsiPortGetUncachedExtension, ScsiPortGetVirtualAddress, ScsiPortInitialize, ScsiPortIoMapTransfer, ScsiPortLogError, ScsiPortMoveMemory, ScsiPortNotification, ScsiPortQuerySystemTime, ScsiPortReadPortBufferUchar, ScsiPortReadPortBufferUlong, ScsiPortReadPortBufferUshort, ScsiPortReadPortUchar, ScsiPortReadPortUlong, ScsiPortReadPortUshort, ScsiPortReadRegisterBufferUchar, ScsiPortReadRegisterBufferUlong, ScsiPortReadRegisterBufferUshort, ScsiPortReadRegisterUchar, ScsiPortReadRegisterUlong, ScsiPortReadRegisterUshort, ScsiPortSetBusDataByOffset, ScsiPortStallExecution, ScsiPortValidateRange, ScsiPortWritePortBufferUchar, ScsiPortWritePortBufferUlong, ScsiPortWritePortBufferUshort, ScsiPortWritePortUchar, ScsiPortWritePortUlong, ScsiPortWritePortUshort, ScsiPortWriteRegisterBufferUchar, ScsiPortWriteRegisterBufferUlong, ScsiPortWriteRegisterBufferUshort, ScsiPortWriteRegisterUchar, ScsiPortWriteRegisterUlong, ScsiPortWriteRegisterUshort

    packers (Kaspersky): PE_Patch

  6. #6
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Do you recognize this file?

    c:\windows\system32\drivers\cagwohgw.sys
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  7. #7
    Junior Member
    Join Date
    Nov 2007
    Posts
    25

    Cool

    Nope. I can't imagine what it's used for. I looked at my installed programs and none of them really have "cag" or "woh" in the name.

  8. #8
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Open notepad and copy/paste the text in the codebox below into it:

    Code:
    File::
    C:\WINDOWS\system32\deskperfl.dll
    c:\windows\system32\nzssoqq.dll
    c:\windows\system32\s1rq2244.exe
    c:\windows\system32\drivers\cagwohgw.sys
    
    Folder::
    c:\documents and settings\Wendy\Application Data\iclaoacz
    c:\documents and settings\NetworkService\Application Data\iclaoacz
    
    Driver::
    cagwohgw
    
    Registry::
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C481E723-A100-4B89-86AE-6B6A704ACF4A}]
    
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FE01CF41-5578-48DA-A950-159D4E89CBBB}]
    
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "s1rq2244"=-
    
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "c:\\WINDOWS\\system32\\s1rq2244.exe"=-
    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  9. #9
    Junior Member
    Join Date
    Nov 2007
    Posts
    25

    Default

    When ComboFix started, it said there was a newer version, but I chose not to update since we'd started the process with the previous version. Logs are below.

    ComboFix 09-01-10.01 - Wendy 2009-01-11 14:26:11.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.270 [GMT -5:00]
    Running from: c:\documents and settings\Wendy\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Wendy\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
    * Created a new restore point

    FILE ::
    c:\windows\system32\deskperfl.dll
    c:\windows\system32\drivers\cagwohgw.sys
    c:\windows\system32\nzssoqq.dll
    c:\windows\system32\s1rq2244.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\documents and settings\NetworkService\Application Data\iclaoacz
    c:\documents and settings\NetworkService\Application Data\iclaoacz\profiles.ini
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\cert8.db
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\compatibility.ini
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\compreg.dat
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\cookies.sqlite
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\formhistory.sqlite
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\key3.db
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\localstore.rdf
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\permissions.sqlite
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\places.sqlite-journal
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\places.sqlite
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\pluginreg.dat
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\prefs.js
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\secmod.db
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\webappsstore.sqlite
    c:\documents and settings\NetworkService\Application Data\iclaoacz\Profiles\vqgg9wqz.default\xpti.dat
    c:\documents and settings\Wendy\Application Data\iclaoacz
    c:\documents and settings\Wendy\Application Data\iclaoacz\profiles.ini
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\cert8.db
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\compatibility.ini
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\compreg.dat
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\cookies.sqlite
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\formhistory.sqlite
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\key3.db
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\localstore.rdf
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\permissions.sqlite
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\places.sqlite-journal
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\places.sqlite
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\pluginreg.dat
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\prefs.js
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\secmod.db
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\webappsstore.sqlite
    c:\documents and settings\Wendy\Application Data\iclaoacz\Profiles\n21xs20u.default\xpti.dat
    c:\program files\Dynamic Toolbar
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\ALTAVISTATB0122.cfg
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\area.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\audio.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\babelfish.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\calculate.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\conversion.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\currency.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\dictionary.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\findword.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\highlight.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\home.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\images.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\lastsearch.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\localindex.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\lookup.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\news.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\popup_off.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\popup_on.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\thissite.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\time.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\video.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\weather.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\web.bmp
    c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\zip.bmp
    c:\windows\system32\deskperfl.dll
    c:\windows\system32\drivers\cagwohgw.sys
    c:\windows\system32\java2.sys c:\windows\system32\snjava.dll
    c:\windows\system32\nzssoqq.dll
    c:\windows\system32\s1rq2244.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_CAGWOHGW
    -------\Service_cagwohgw


    ((((((((((((((((((((((((( Files Created from 2008-12-11 to 2009-01-11 )))))))))))))))))))))))))))))))
    .

    2009-01-11 14:52 . 2009-01-11 14:52 54,156 --ah----- c:\windows\QTFont.qfn
    2009-01-11 14:52 . 2009-01-11 14:52 1,409 --a------ c:\windows\QTFont.for
    2009-01-05 21:39 . 2009-01-05 21:39 <DIR> d-------- c:\program files\Trend Micro
    2009-01-05 20:59 . 2009-01-05 21:19 <DIR> d--h----- C:\$AVG8.VAULT$
    2009-01-05 20:58 . 2009-01-05 20:58 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2009-01-05 20:58 . 2009-01-05 20:58 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2009-01-05 20:57 . 2009-01-11 02:16 <DIR> d-------- c:\windows\system32\drivers\Avg
    2009-01-05 20:57 . 2009-01-05 20:57 <DIR> d-------- c:\program files\AVG
    2009-01-05 20:57 . 2009-01-05 20:57 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2009-01-01 17:43 . 2009-01-01 17:43 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2009-01-01 17:42 . 2009-01-01 17:43 <DIR> d-------- c:\program files\SUPERAntiSpyware
    2009-01-01 17:42 . 2009-01-01 17:42 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
    2009-01-01 17:42 . 2009-01-01 17:42 <DIR> d-------- c:\documents and settings\Wendy\Application Data\SUPERAntiSpyware.com

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-11-23 13:06 --------- d-----w c:\program files\Smilebox
    2008-11-20 14:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2008-11-20 11:11 --------- d-----w c:\program files\Spybot - Search & Destroy
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2005-12-09 180269]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-02-02 77824]
    "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-05 1261336]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "MSACM.G723"= g723.acm
    "vidc.I263"= I263_32.drv

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
    "c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "c:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "c:\\Program Files\\palmOne\\Hotsync.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-01-05 97928]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-22 8944]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-22 55024]
    R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-05 231704]
    S3 icm12blk;Intel(r) PC Camera CS780 Image Storage;c:\windows\system32\drivers\icm12blk.sys [2002-10-03 14184]
    S3 icm12fil;Intel(r) CS780 Audio Filter Driver;c:\windows\system32\drivers\icm12fil.sys [2002-10-03 16312]
    S3 ICM12USB;Intel(r) PC Camera CS780;c:\windows\system32\drivers\ICM12USB.sys [2002-10-03 428152]
    S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-22 7408]
    S3 WPC11;Instant Wireless Network PC Card V3.0 Driver;c:\windows\system32\drivers\LSWLNDS.sys [2003-03-30 54083]
    S4 mrtRate;mrtRate; [x]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - CAGWOHGW

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{213d4795-dc2b-11dc-9b6e-00022dbc235f}]
    \Shell\AutoRun\command - E:\Launch.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{73782890-b96e-11db-9b39-00022dbc235f}]
    \Shell\AutoRun\command - E:\LaunchU3.exe -a
    .
    Contents of the 'Scheduled Tasks' folder

    2000-01-01 c:\windows\Tasks\Registration reminder 1.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]

    2000-01-01 c:\windows\Tasks\Registration reminder 2.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]

    2000-01-01 c:\windows\Tasks\Registration reminder 3.job
    - c:\windows\System32\OOBE\oobebaln.exe [2008-04-13 19:12]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{C481E723-A100-4B89-86AE-6B6A704ACF4A} - c:\windows\system32\deskperfl.dll
    BHO-{FE01CF41-5578-48DA-A950-159D4E89CBBB} - c:\windows\system32\nzssoqq.dll
    HKLM-Run-s1rq2244 - c:\windows\system32\s1rq2244.exe


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://my.yahoo.com/
    uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
    uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
    mSearch Bar =
    uInternet Settings,ProxyOverride = localhost
    uSearchURL,(Default) = about:blank
    IE: AltaVista Search - file://c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    IE: Translate - file://c:\program files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    Trusted Zone: free.aol.com
    Trusted Zone: www.plaxo.com
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll

    O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
    c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

    c:\windows\system32\unicows.dll - c:\windows\Downloaded Program Files\CONFLICT.1\ImageUploader5.ocx
    O16 -: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3}
    hxxp://preview.evite.com/js/ImageUploader5.cab
    c:\windows\Downloaded Program Files\CONFLICT.1\ImageUploader5.inf
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-11 14:50:44
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(696)
    c:\program files\SUPERAntiSpyware\SASWINLO.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\wscntfy.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    .
    **************************************************************************
    .
    Completion time: 2009-01-11 14:57:08 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-01-11 19:57:04
    ComboFix2.txt 2009-01-11 00:55:46

    Pre-Run: 19,881,091,072 bytes free
    Post-Run: 19,873,562,624 bytes free

    215 --- E O F --- 2008-12-19 08:03:02


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:07:11 PM, on 1/11/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\AVG\AVG8\avgrsx.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/mor...on/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
    O2 - BHO: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\windows\googletoolbar3.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
    O3 - Toolbar: AltaVista Toolbar - {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} - C:\WINDOWS\DOWNLO~1\ALTAVI~1.DLL
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\windows\googletoolbar3.dll
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O8 - Extra context menu item: AltaVista Search - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextSearch.htm
    O8 - Extra context menu item: Translate - file://C:\Program Files\Dynamic Toolbar\ALTAVISTA\Cache\SelectedContextTranslation.htm
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com
    O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/...oUploader5.cab
    O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://atlterm01.lanlaw.com/wficat.cab
    O16 - DPF: {4E7BD74F-2B8D-469E-92EA-EC65A294AE31} (AltaVista Toolbar) - http://toolbar.altavista.com/app/too...a.cab?r=TVYRDR
    O16 - DPF: {5D637FAD-E202-48D1-8F18-5B9C459BD1E3} (Image Uploader Control) - http://preview.evite.com/js/ImageUploader5.cab
    O16 - DPF: {8EDAD21C-3584-4E66-A8AB-EB0E5584767D} - http://toolbar.google.com/data/GoogleActivate.cab
    O16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - http://connect.mckennalong.com/msrdp.cab
    O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
    O16 - DPF: {D670D0B3-05AB-4115-9F87-D983EF1AC747} (AOL Downloader Plugin) - http://pak02.pictures.aol.com/ygp/ao...ad.9.0.0.2.cab
    O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - http://us.dl1.yimg.com/download.yaho...bio5_0_2_2.cab
    O18 - Protocol: bw+0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw+0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw-0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw00s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw10s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw20s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw30s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw40s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw50s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw60s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw70s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw80s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bw90s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwa0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwb0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwc0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwd0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwe0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwf0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: bwg0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwg0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwh0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwi0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwj0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwk0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwl0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwm0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwn0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwo0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwp0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwq0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwr0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bws0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwt0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwu0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwv0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bww0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwx0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwy0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: bwz0s - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O18 - Protocol: offline-8876480 - {629BECDB-FCD2-4A93-B797-5893F7F57F6E} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll
    O20 - AppInit_DLLs: avgrsstx.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

    --
    End of file - 17612 bytes

  10. #10
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    OK, looks like two folders need to restored as they are mozilla profile folders

    Open notepad and copy/paste the text in the codebox below into it:

    Code:
    DeQuarantine::
    c:\documents and settings\Wendy\Application Data\iclaoacz
    c:\documents and settings\NetworkService\Application Data\iclaoacz
    
    Quit::
    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •