Almost removed Virtumonde (I think...)

luvmymgb · May 11, 2009

Family computer got horribly infected (despite Norton and Spysweeper), installed Spybot, which found many things, the most persistent being virtumonde (.sdn, .sci, .dll), and WildTangent. Took several days of running Spybot scans (which would not complete until run in safe mode and then in normal mode), but now have clean scans. But now Norton Internet Security will not finish initializing (as evidenced by logo on task bar) from start/reboot for many minutes (30+). Clears all's not well.

Thanks in advance for the help. Here's my HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:29:26 PM, on 5/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.catholicexchange.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 antivirsystem.com
O1 - Hosts: 94.232.248.66 www.antivirsystem.com
O2 - BHO: (no name) - {038ACA2F-16F3-4B4A-B905-ED3F17C22C7c} - C:\WINDOWS\system32\sekutteu.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\NppBho.dll
O2 - BHO: (no name) - {21F0578D-EED7-4F18-A04D-901E866FD9DF} - C:\WINDOWS\system32\awtst.dll (file missing)
O2 - BHO: (no name) - {232D2677-68EE-4FA1-B988-279EBC8969ED} - C:\WINDOWS\system32\khfcayw.dll (file missing)
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: (no name) - {96403BCF-73C3-40C1-8867-AECB77078B25} - C:\WINDOWS\system32\awvtt.dll (file missing)
O2 - BHO: (no name) - {AB9C44D8-4752-4BFC-97E0-612B61A878B3} - C:\WINDOWS\system32\jkhfg.dll (file missing)
O2 - BHO: (no name) - {B0D8EED5-12DE-4837-8797-4847471A2014} - c:\windows\system32\mtmuwhf.dll
O2 - BHO: (no name) - {C0B3DCB7-925D-46F4-9BAA-7A7420FDE186} - C:\WINDOWS\system32\mllml.dll (file missing)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.0\UIBHO.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\RunOnce: [] "C:\Program Files\Internet Explorer\iexplore.exe" http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000049.000000b9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR Media Server.lnk.disabled
O4 - Global Startup: SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe
O4 - Global Startup: WinZip Quick Pick.lnk.disabled
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52....apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O20 - Winlogon Notify: khfcayw - C:\WINDOWS\
O20 - Winlogon Notify: oczafztk - C:\WINDOWS\SYSTEM32\mtmuwhf.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Multimedia Server - Unknown owner - C:\PROGRA~1\NETGEAR\MEDIAS~1\ImmsService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\isPwdSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 11959 bytes

Shaba · May 12, 2009

Hi luvmymgb

We will begin with ComboFix.exe. Please visit this webpage for download links, and instructions for running the tool:
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
If you need help to disable your protection programs see here.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

luvmymgb · May 13, 2009

Below is Combofix and new HJT log. Note I had to remove Norton Internet Security (using Norton removal tool) in order to disable it so that Combofix would run. Will install AVG when we're completed here.
Thanks.

ComboFix 09-05-12.04 - xxxxxxx 05/12/2009 18:10.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1110 [GMT -5:00]
Running from: c:\documents and settings\Bob XXXX\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\xxx xxxx\Local Settings\Temporary Internet Files\Tvm.log
c:\program files\WinBudget
c:\program files\WinBudget\bin\matrix.dat
c:\temp\fCOe
c:\windows\cookies.ini
c:\windows\didduid.ini
c:\windows\system32\aoowvyrn.ini
c:\windows\SYSTEM32\dcbeg.bak1
c:\windows\SYSTEM32\dcbeg.ini
c:\windows\SYSTEM32\gfhkj.bak1
c:\windows\system32\gfhkj.ini
c:\windows\SYSTEM32\lmllm.bak1
c:\windows\SYSTEM32\lmllm.bak2
c:\windows\SYSTEM32\lmllm.ini
c:\windows\system32\lowsec
c:\windows\system32\lowsec\local.ds
c:\windows\system32\lowsec\user.ds
c:\windows\system32\oTt02e
c:\windows\system32\ovpqisnw.ini
c:\windows\system32\system
c:\windows\system32\system\msxml4.dll
c:\windows\system32\system\msxml4r.dll
c:\windows\SYSTEM32\tstwa.bak1
c:\windows\SYSTEM32\tstwa.tmp
c:\windows\SYSTEM32\ttvwa.bak1
c:\windows\SYSTEM32\ttvwa.bak2
c:\windows\SYSTEM32\ttvwa.ini
c:\windows\system32\mtmuwhf.dll . . . . failed to delete
c:\windows\system32\sekutteu.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ZGQDXZOQ
-------\Service_zgqdxzoq

((((((((((((((((((((((((( Files Created from 2009-04-12 to 2009-05-12 )))))))))))))))))))))))))))))))
.

2009-05-11 20:25 . 2009-05-11 20:25 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-11 18:56 . 2009-05-11 18:56 -------- d-----w c:\program files\Trend Micro
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\Sammsoft
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-11 16:25 . 2009-05-11 17:06 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-09 16:44 . 2009-05-09 16:45 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-09 16:44 . 2009-05-09 16:55 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Application Data\ipfjgcxa
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Local Settings\Application Data\ipfjgcxa
2009-04-22 08:00 . 2009-03-11 03:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-22 08:00 . 2009-04-22 08:00 -------- d-----w c:\windows\system32\KB905474
2009-04-22 08:00 . 2009-03-11 03:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-15 11:05 . 2009-03-06 14:44 283648 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 11:05 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-04-15 11:05 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 11:05 . 2009-02-06 17:14 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 11:05 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 11:05 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 11:05 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 11:05 . 2009-02-09 10:20 616960 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 11:05 . 2009-02-09 10:20 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 11:05 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:59 . 2007-09-02 21:08 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-11 20:25 . 2007-09-02 21:33 -------- d-----w c:\program files\Java
2009-04-25 15:55 . 2008-02-23 18:18 189072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-25 15:42 . 2008-02-23 18:18 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-21 13:43 . 2007-07-20 00:44 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-03-17 23:33 . 2009-03-17 23:33 -------- d-----w c:\program files\Stardock Games
2009-03-06 14:44 . 2002-08-29 11:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-27 22:09 . 2008-02-23 18:18 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-20 08:30 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 08:30 . 2004-02-06 23:05 659456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-11-07 15:29 . 2006-11-07 15:29 50736 c:\program files\AIM6\bak\aim6.exe
2008-01-03 16:15 . 2008-01-03 16:15 50528 c:\program files\AIM6\aim6.exe

2004-03-18 15:46 . 2006-05-22 11:58 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2003-05-01 22:44 . 2003-05-01 22:44 65536 c:\program files\Common Files\Roxio Shared\System\bak\EngUtil.exe

2006-10-03 09:45 . 2007-01-10 03:59 115816 c:\program files\Common Files\Symantec Shared\bak\ccApp.exe

2004-03-18 15:45 . 2002-04-03 07:01 135264 c:\program files\Creative\SBLive\Diagnostics\bak\diagent.exe

2004-03-18 15:44 . 2003-08-27 01:47 204800 c:\program files\Dell\Media Experience\bak\PCMService.exe

2005-06-10 06:24 . 2004-07-19 12:51 306688 c:\program files\Dell Support\bak\DSAgnt.exe

2005-02-17 03:11 . 2005-02-17 03:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2004-03-18 15:43 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2006-10-30 14:36 . 2006-10-30 14:36 256576 c:\program files\iTunes\bak\iTunesHelper.exe
2008-09-10 22:40 . 2008-09-10 22:40 289576 c:\program files\iTunes\iTunesHelper.exe

2004-03-18 15:50 . 2005-03-12 12:25 110592 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

2006-10-25 23:58 . 2006-10-25 23:58 282624 c:\program files\QuickTime\bak\qttask.exe
2008-09-06 20:09 . 2008-09-06 20:09 413696 c:\program files\QuickTime\QTTask.exe

2003-07-15 16:36 . 2003-07-15 16:36 319488 c:\program files\Roxio\Easy CD Creator 6\AudioCentral\bak\RxMon.exe

2003-07-17 04:19 . 2003-07-17 04:19 868352 c:\program files\Roxio\Easy CD Creator 6\DragToDisc\bak\DrgToDsc.exe

2004-03-18 15:45 . 2000-05-11 07:00 90112 c:\windows\bak\UpdReg.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038ACA2F-16F3-4B4A-B905-ED3F17C22C7c}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B0D8EED5-12DE-4837-8797-4847471A2014}]
2002-08-29 11:00 103424 ----a-w c:\windows\SYSTEM32\mtmuwhf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-29 68856]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2008-04-01 2084480]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"<NO NAME>"="c:\program files\Internet Explorer\iexplore.exe" [2004-08-04 93184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-30 4800512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR Media Server.lnk.disabled [2005-11-2 1727]
SoftStuff Wallpaper Changer.lnk - c:\program files\SoftStuff\softstrt.exe [2004-3-29 126976]
WinZip Quick Pick.lnk.disabled [2008-2-29 1669]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"wave2"= serwvdrv.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"=
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
"WinUpdater"="c:\program files\WinUpdater\update.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MimBoot"=c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"=
"c:\\Program Files\\EA SPORTS\\Madden NFL 2004\\Updater.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

R0 efriartf;efriartf;c:\windows\SYSTEM32\DRIVERS\efriartf.sys [8/29/2002 6:00 AM 23424]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 10:36 PM 24652]
S3 lac97inf;lac97inf;\??\c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys --> c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys [?]
S3 ldiskl;ldiskl;\??\c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys --> c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys [?]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{114234ee-5c21-11dc-b601-000cf1d6a725}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4488563b-80f2-11d8-a368-806d6172696f}]
\Shell\AutoRun\command - D:\aoesetup.exe /autorun
\Shell\directx\command - d:\directx\dxsetup.exe
\Shell\dplay\command - d:\directx\dplay61a.exe
\Shell\dxdiag\command - d:\goodies\ar40eng.exe
\Shell\dxinfo\command - d:\goodies\DirectX\dxinfo.exe
\Shell\dxtest\command - d:\directx\dxdiag.exe
\Shell\dxtool\command - d:\goodies\DirectX\dxtool.exe
\Shell\log\command - d:\goodies\machine\machine.exe -l
\Shell\machine\command - d:\goodies\machine\machine.exe
\Shell\setup\command - D:\aoesetup.exe /autorun
\Shell\zone\command - d:\goodies\mszone\zoneA600.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-05-12 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 21:39]

2009-05-12 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 03:18]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-_{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
BHO-{21F0578D-EED7-4F18-A04D-901E866FD9DF} - c:\windows\system32\awtst.dll
BHO-{96403BCF-73C3-40C1-8867-AECB77078B25} - c:\windows\system32\awvtt.dll
BHO-{AB9C44D8-4752-4BFC-97E0-612B61A878B3} - c:\windows\system32\jkhfg.dll
BHO-{C0B3DCB7-925D-46F4-9BAA-7A7420FDE186} - c:\windows\system32\mllml.dll
Notify-khfcayw - (no file)

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.att.net
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: doginhispen.com
Trusted Zone: whataboutadog.com
Trusted Zone: musicmatch.com\online
.
.
------- File Associations -------
.
inffile=c:\i386\NOTEPAD.EXE %1
inifile=c:\i386\NOTEPAD.EXE %1
txtfile=c:\i386\NOTEPAD.EXE %1
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]
"ImagePath"="-"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3400476394-1729520875-3007789828-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(2668)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\PnkBstrA.exe
c:\windows\SYSTEM32\PnkBstrB.exe
c:\windows\SYSTEM32\UAService7.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-12 18:21 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-12 23:21

Pre-Run: 204,600,438,784 bytes free
Post-Run: 206,746,558,464 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

287 --- E O F --- 2009-04-22 08:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:22:02 PM, on 5/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\PnkBstrB.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: (no name) - {02030339-B27C-48F3-8BDC-E808C7EBE896} - C:\WINDOWS\system32\sekutteu.dll
O2 - BHO: (no name) - {038ACA2F-16F3-4B4A-B905-ED3F17C22C7c} - C:\WINDOWS\system32\sekutteu.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: (no name) - {B0D8EED5-12DE-4837-8797-4847471A2014} - c:\windows\system32\mtmuwhf.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000049.000000b9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR Media Server.lnk.disabled
O4 - Global Startup: SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe
O4 - Global Startup: WinZip Quick Pick.lnk.disabled
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52....apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O20 - Winlogon Notify: oczafztk - C:\WINDOWS\SYSTEM32\mtmuwhf.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Multimedia Server - Unknown owner - C:\PROGRA~1\NETGEAR\MEDIAS~1\ImmsService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 8881 bytes

Shaba · May 13, 2009

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code:

File::
c:\windows\system32\mtmuwhf.dll
c:\windows\system32\sekutteu.dll 
c:\windows\SYSTEM32\DRIVERS\efriartf.sys

Driver::
efriartf

DDS::
Trusted Zone: doginhispen.com
Trusted Zone: whataboutadog.com

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

luvmymgb · May 13, 2009

Thanks so much. Combo fix log is below. Note that it asked to update in the process, which I allowed.

ComboFix 09-05-12.06 - Bob XXXX 05/13/2009 7:27.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1099 [GMT -5:00]
Running from: c:\documents and settings\Bob XXXX\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bob XXXX\Desktop\CFScript.txt

FILE ::
c:\windows\SYSTEM32\DRIVERS\efriartf.sys
c:\windows\system32\mtmuwhf.dll
c:\windows\system32\sekutteu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SYSTEM32\DRIVERS\efriartf.sys . . . . failed to delete
c:\windows\system32\mtmuwhf.dll . . . . failed to delete
c:\windows\system32\sekutteu.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EFRIARTF
-------\Legacy_ZGQDXZOQ
-------\Service_efriartf
-------\Service_zgqdxzoq

((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-11 20:25 . 2009-05-11 20:25 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-11 18:56 . 2009-05-11 18:56 -------- d-----w c:\program files\Trend Micro
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\Sammsoft
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-11 16:25 . 2009-05-11 17:06 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-09 16:44 . 2009-05-09 16:45 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-09 16:44 . 2009-05-09 16:55 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Application Data\ipfjgcxa
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Local Settings\Application Data\ipfjgcxa
2009-04-22 08:00 . 2009-03-11 03:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-22 08:00 . 2009-04-22 08:00 -------- d-----w c:\windows\system32\KB905474
2009-04-22 08:00 . 2009-03-11 03:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-15 11:05 . 2009-03-06 14:44 283648 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 11:05 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-04-15 11:05 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 11:05 . 2009-02-06 17:14 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 11:05 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 11:05 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 11:05 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 11:05 . 2009-02-09 10:20 616960 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 11:05 . 2009-02-09 10:20 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 11:05 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:59 . 2007-09-02 21:08 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-11 20:25 . 2007-09-02 21:33 -------- d-----w c:\program files\Java
2009-04-25 15:55 . 2008-02-23 18:18 189072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-25 15:42 . 2008-02-23 18:18 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-21 13:43 . 2007-07-20 00:44 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-03-17 23:33 . 2009-03-17 23:33 -------- d-----w c:\program files\Stardock Games
2009-03-06 14:44 . 2002-08-29 11:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-27 22:09 . 2008-02-23 18:18 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-20 08:30 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 08:30 . 2004-02-06 23:05 659456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-12_23.16.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-13 12:31 . 2009-05-13 12:31 16384 c:\windows\Temp\Perflib_Perfdata_128.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-11-07 15:29 . 2006-11-07 15:29 50736 c:\program files\AIM6\bak\aim6.exe
2008-01-03 16:15 . 2008-01-03 16:15 50528 c:\program files\AIM6\aim6.exe

2004-03-18 15:46 . 2006-05-22 11:58 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2003-05-01 22:44 . 2003-05-01 22:44 65536 c:\program files\Common Files\Roxio Shared\System\bak\EngUtil.exe

2006-10-03 09:45 . 2007-01-10 03:59 115816 c:\program files\Common Files\Symantec Shared\bak\ccApp.exe

2004-03-18 15:45 . 2002-04-03 07:01 135264 c:\program files\Creative\SBLive\Diagnostics\bak\diagent.exe

2004-03-18 15:44 . 2003-08-27 01:47 204800 c:\program files\Dell\Media Experience\bak\PCMService.exe

2005-06-10 06:24 . 2004-07-19 12:51 306688 c:\program files\Dell Support\bak\DSAgnt.exe

2005-02-17 03:11 . 2005-02-17 03:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2004-03-18 15:43 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2006-10-30 14:36 . 2006-10-30 14:36 256576 c:\program files\iTunes\bak\iTunesHelper.exe
2008-09-10 22:40 . 2008-09-10 22:40 289576 c:\program files\iTunes\iTunesHelper.exe

2004-03-18 15:50 . 2005-03-12 12:25 110592 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

2006-10-25 23:58 . 2006-10-25 23:58 282624 c:\program files\QuickTime\bak\qttask.exe
2008-09-06 20:09 . 2008-09-06 20:09 413696 c:\program files\QuickTime\QTTask.exe

2003-07-15 16:36 . 2003-07-15 16:36 319488 c:\program files\Roxio\Easy CD Creator 6\AudioCentral\bak\RxMon.exe

2003-07-17 04:19 . 2003-07-17 04:19 868352 c:\program files\Roxio\Easy CD Creator 6\DragToDisc\bak\DrgToDsc.exe

2004-03-18 15:45 . 2000-05-11 07:00 90112 c:\windows\bak\UpdReg.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02030339-B27C-48F3-8BDC-E808C7EBE896}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038ACA2F-16F3-4B4A-B905-ED3F17C22C7c}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B0D8EED5-12DE-4837-8797-4847471A2014}]
2002-08-29 11:00 103424 ----a-w c:\windows\SYSTEM32\mtmuwhf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-29 68856]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2008-04-01 2084480]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"<NO NAME>"="c:\program files\Internet Explorer\iexplore.exe" [2004-08-04 93184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-30 4800512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR Media Server.lnk.disabled [2005-11-2 1727]
SoftStuff Wallpaper Changer.lnk - c:\program files\SoftStuff\softstrt.exe [2004-3-29 126976]
WinZip Quick Pick.lnk.disabled [2008-2-29 1669]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"wave2"= serwvdrv.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"=
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
"WinUpdater"="c:\program files\WinUpdater\update.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MimBoot"=c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"=
"c:\\Program Files\\EA SPORTS\\Madden NFL 2004\\Updater.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

R0 efriartf;efriartf;c:\windows\SYSTEM32\DRIVERS\efriartf.sys [8/29/2002 6:00 AM 23424]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 10:36 PM 24652]
S3 lac97inf;lac97inf;\??\c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys --> c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys [?]
S3 ldiskl;ldiskl;\??\c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys --> c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - EFRIARTF

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{114234ee-5c21-11dc-b601-000cf1d6a725}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4488563b-80f2-11d8-a368-806d6172696f}]
\Shell\AutoRun\command - D:\aoesetup.exe /autorun
\Shell\directx\command - d:\directx\dxsetup.exe
\Shell\dplay\command - d:\directx\dplay61a.exe
\Shell\dxdiag\command - d:\goodies\ar40eng.exe
\Shell\dxinfo\command - d:\goodies\DirectX\dxinfo.exe
\Shell\dxtest\command - d:\directx\dxdiag.exe
\Shell\dxtool\command - d:\goodies\DirectX\dxtool.exe
\Shell\log\command - d:\goodies\machine\machine.exe -l
\Shell\machine\command - d:\goodies\machine\machine.exe
\Shell\setup\command - D:\aoesetup.exe /autorun
\Shell\zone\command - d:\goodies\mszone\zoneA600.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-05-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 21:39]

2009-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 03:18]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.att.net
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: musicmatch.com\online
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]
"ImagePath"="-"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3400476394-1729520875-3007789828-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(2896)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\PnkBstrA.exe
c:\windows\SYSTEM32\PnkBstrB.exe
c:\windows\SYSTEM32\UAService7.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-13 7:36 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-13 12:36
ComboFix2.txt 2009-05-12 23:21

Pre-Run: 206,766,571,520 bytes free
Post-Run: 206,749,564,928 bytes free

254 --- E O F --- 2009-04-22 08:00

Shaba · May 13, 2009

Looks like it doesn't want to go away.

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

Code:

File::
c:\windows\system32\mtmuwhf.dll
c:\windows\system32\sekutteu.dll 
c:\windows\SYSTEM32\DRIVERS\efriartf.sys
c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys
c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys

Driver::
efriartf
lac97inf
ldiskl

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

luvmymgb · May 13, 2009

Thanks again for your efforts. Here's the latest log.

ComboFix 09-05-12.06 - Bob XXXX 05/13/2009 9:41.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1062 [GMT -5:00]
Running from: c:\documents and settings\Bob XXXX\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Bob XXXX\Desktop\CFScript.txt

FILE ::
c:\docume~1\BOBGOH~1\LOCALS~1\Temp\lac97inf.sys
c:\docume~1\BOBGOH~1\LOCALS~1\Temp\ldiskl.sys
c:\windows\SYSTEM32\DRIVERS\efriartf.sys
c:\windows\system32\mtmuwhf.dll
c:\windows\system32\sekutteu.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SYSTEM32\DRIVERS\efriartf.sys . . . . failed to delete
c:\windows\system32\mtmuwhf.dll . . . . failed to delete
c:\windows\system32\sekutteu.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EFRIARTF
-------\Legacy_LAC97INF
-------\Legacy_LDISKL
-------\Service_efriartf
-------\Service_lac97inf
-------\Service_ldiskl
-------\Service_zgqdxzoq

((((((((((((((((((((((((( Files Created from 2009-04-13 to 2009-05-13 )))))))))))))))))))))))))))))))
.

2009-05-11 20:25 . 2009-05-11 20:25 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-11 18:56 . 2009-05-11 18:56 -------- d-----w c:\program files\Trend Micro
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\Sammsoft
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-11 16:25 . 2009-05-11 17:06 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-09 16:44 . 2009-05-09 16:45 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-09 16:44 . 2009-05-09 16:55 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Application Data\ipfjgcxa
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Local Settings\Application Data\ipfjgcxa
2009-04-22 08:00 . 2009-03-11 03:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-22 08:00 . 2009-04-22 08:00 -------- d-----w c:\windows\system32\KB905474
2009-04-22 08:00 . 2009-03-11 03:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-15 11:05 . 2009-03-06 14:44 283648 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 11:05 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-04-15 11:05 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 11:05 . 2009-02-06 17:14 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 11:05 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 11:05 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 11:05 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 11:05 . 2009-02-09 10:20 616960 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 11:05 . 2009-02-09 10:20 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 11:05 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:59 . 2007-09-02 21:08 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-11 20:25 . 2007-09-02 21:33 -------- d-----w c:\program files\Java
2009-04-25 15:55 . 2008-02-23 18:18 189072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-25 15:42 . 2008-02-23 18:18 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-21 13:43 . 2007-07-20 00:44 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-03-17 23:33 . 2009-03-17 23:33 -------- d-----w c:\program files\Stardock Games
2009-03-06 14:44 . 2002-08-29 11:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-27 22:09 . 2008-02-23 18:18 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-20 08:30 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 08:30 . 2004-02-06 23:05 659456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-12_23.16.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-13 14:45 . 2009-05-13 14:45 16384 c:\windows\Temp\Perflib_Perfdata_180.dat
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-11-07 15:29 . 2006-11-07 15:29 50736 c:\program files\AIM6\bak\aim6.exe
2008-01-03 16:15 . 2008-01-03 16:15 50528 c:\program files\AIM6\aim6.exe

2004-03-18 15:46 . 2006-05-22 11:58 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2003-05-01 22:44 . 2003-05-01 22:44 65536 c:\program files\Common Files\Roxio Shared\System\bak\EngUtil.exe

2006-10-03 09:45 . 2007-01-10 03:59 115816 c:\program files\Common Files\Symantec Shared\bak\ccApp.exe

2004-03-18 15:45 . 2002-04-03 07:01 135264 c:\program files\Creative\SBLive\Diagnostics\bak\diagent.exe

2004-03-18 15:44 . 2003-08-27 01:47 204800 c:\program files\Dell\Media Experience\bak\PCMService.exe

2005-06-10 06:24 . 2004-07-19 12:51 306688 c:\program files\Dell Support\bak\DSAgnt.exe

2005-02-17 03:11 . 2005-02-17 03:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2004-03-18 15:43 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2006-10-30 14:36 . 2006-10-30 14:36 256576 c:\program files\iTunes\bak\iTunesHelper.exe
2008-09-10 22:40 . 2008-09-10 22:40 289576 c:\program files\iTunes\iTunesHelper.exe

2004-03-18 15:50 . 2005-03-12 12:25 110592 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

2006-10-25 23:58 . 2006-10-25 23:58 282624 c:\program files\QuickTime\bak\qttask.exe
2008-09-06 20:09 . 2008-09-06 20:09 413696 c:\program files\QuickTime\QTTask.exe

2003-07-15 16:36 . 2003-07-15 16:36 319488 c:\program files\Roxio\Easy CD Creator 6\AudioCentral\bak\RxMon.exe

2003-07-17 04:19 . 2003-07-17 04:19 868352 c:\program files\Roxio\Easy CD Creator 6\DragToDisc\bak\DrgToDsc.exe

2004-03-18 15:45 . 2000-05-11 07:00 90112 c:\windows\bak\UpdReg.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{01CFDA93-34D5-426C-8948-DD7217190C62}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{02030339-B27C-48F3-8BDC-E808C7EBE896}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{038ACA2F-16F3-4B4A-B905-ED3F17C22C7c}]
2002-08-29 11:00 143872 ----a-w c:\windows\SYSTEM32\sekutteu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B0D8EED5-12DE-4837-8797-4847471A2014}]
2002-08-29 11:00 103424 ----a-w c:\windows\SYSTEM32\mtmuwhf.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-29 68856]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2008-04-01 2084480]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"<NO NAME>"="c:\program files\Internet Explorer\iexplore.exe" [2004-08-04 93184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-30 4800512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR Media Server.lnk.disabled [2005-11-2 1727]
SoftStuff Wallpaper Changer.lnk - c:\program files\SoftStuff\softstrt.exe [2004-3-29 126976]
WinZip Quick Pick.lnk.disabled [2008-2-29 1669]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"wave2"= serwvdrv.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"=
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
"WinUpdater"="c:\program files\WinUpdater\update.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MimBoot"=c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"=
"c:\\Program Files\\EA SPORTS\\Madden NFL 2004\\Updater.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

R0 efriartf;efriartf;c:\windows\SYSTEM32\DRIVERS\efriartf.sys [8/29/2002 6:00 AM 23424]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 10:36 PM 24652]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - EFRIARTF

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{114234ee-5c21-11dc-b601-000cf1d6a725}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4488563b-80f2-11d8-a368-806d6172696f}]
\Shell\AutoRun\command - D:\aoesetup.exe /autorun
\Shell\directx\command - d:\directx\dxsetup.exe
\Shell\dplay\command - d:\directx\dplay61a.exe
\Shell\dxdiag\command - d:\goodies\ar40eng.exe
\Shell\dxinfo\command - d:\goodies\DirectX\dxinfo.exe
\Shell\dxtest\command - d:\directx\dxdiag.exe
\Shell\dxtool\command - d:\goodies\DirectX\dxtool.exe
\Shell\log\command - d:\goodies\machine\machine.exe -l
\Shell\machine\command - d:\goodies\machine\machine.exe
\Shell\setup\command - D:\aoesetup.exe /autorun
\Shell\zone\command - d:\goodies\mszone\zoneA600.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-05-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 21:39]

2009-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 03:18]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.att.net
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: musicmatch.com\online
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]
"ImagePath"="-"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3400476394-1729520875-3007789828-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(776)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(3344)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\ati2evxx.exe
c:\windows\SYSTEM32\ati2evxx.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\SYSTEM32\CTsvcCDA.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\SYSTEM32\HPZipm12.exe
c:\windows\SYSTEM32\PnkBstrA.exe
c:\windows\SYSTEM32\PnkBstrB.exe
c:\windows\SYSTEM32\UAService7.exe
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\windows\SYSTEM32\MsPMSPSv.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\SYSTEM32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-05-13 9:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-13 14:50
ComboFix2.txt 2009-05-13 12:36
ComboFix3.txt 2009-05-12 23:21

Pre-Run: 206,770,130,944 bytes free
Post-Run: 206,751,195,136 bytes free

260 --- E O F --- 2009-04-22 08:00

Shaba · May 13, 2009

Download Avenger by Swandog and unzip it to your Desktop.

Note: This programme must be run from an account with Administrator priviledges.

Open the Avenger folder and double click Avenger.exe to launch the programme.
Copy the text in the code box below and Paste it into the Input script here: box.

Code:

Files to delete:
c:\windows\SYSTEM32\DRIVERS\efriartf.sys
c:\windows\system32\mtmuwhf.dll
c:\windows\system32\sekutteu.dll

Drivers to delete:
efriartf

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

Ensure the following:
- Scan for Rootkits is checked.
- Automatically disable any rootkits found is Unchecked.
Press the Execute key.
Avenger will now process the script you've pasted (this may involve more than one re-boot), when finished it will produce a log file.
Post the log back here please. (it can also be found at C:\avenger.txt)

luvmymgb · May 14, 2009

Attached is the Avenger log, though it seems to have found nothing. Note that the reboot initiated by Avenger initially failed (blue screen with fatal logon error msg), so had to power-on reset, which resulted in log file below.

Note that there is only one user account on this machine, and that is where I'm running from. I believe this as admin priviledges. I've tried to log on as administrator (via safe mode) but sadly have lost the password (frankly, I don't remember ever setting one.....

Also note that IE continues to attempt to get redirected to various bad places after I try to close it....

(sigh) - and thanks again for the help. Here's the log:

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\SYSTEM32\DRIVERS\efriartf.sys" deleted successfully.
File "c:\windows\system32\mtmuwhf.dll" deleted successfully.
File "c:\windows\system32\sekutteu.dll" deleted successfully.
Driver "efriartf" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Shaba · May 14, 2009

OK, that looks better.

Please now rerun combofix and post back its log.

luvmymgb · May 14, 2009

OK - Here's the log (I assume you meant to run Combofix without a script...).
Thanks

ComboFix 09-05-13.02 - Bob XXXX 05/14/2009 10:22.4 - NTFSx86 NETWORK
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1535.1194 [GMT -5:00]
Running from: c:\documents and settings\Bob XXXX\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\mtmuwhf.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ZGQDXZOQ
-------\Service_zgqdxzoq

((((((((((((((((((((((((( Files Created from 2009-04-14 to 2009-05-14 )))))))))))))))))))))))))))))))
.

2009-05-11 20:25 . 2009-05-11 20:25 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-11 18:56 . 2009-05-11 18:56 -------- d-----w c:\program files\Trend Micro
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\Sammsoft
2009-05-11 18:53 . 2009-05-11 18:53 -------- d-----w c:\program files\Advanced Registry Optimizer
2009-05-11 16:25 . 2009-05-11 17:06 -------- d-----w c:\windows\system32\CatRoot_bak
2009-05-09 16:44 . 2009-05-09 16:45 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-09 16:44 . 2009-05-09 16:55 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Application Data\ipfjgcxa
2009-05-08 04:11 . 2009-05-08 04:11 -------- d-----w c:\documents and settings\NetworkService\Local Settings\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Application Data\ipfjgcxa
2009-05-08 03:57 . 2009-05-08 03:57 -------- d-----w c:\documents and settings\Bob XXXX\Local Settings\Application Data\ipfjgcxa
2009-04-22 08:00 . 2009-03-11 03:18 453512 ----a-w c:\windows\system32\KB905474\wgasetup.exe
2009-04-22 08:00 . 2009-04-22 08:00 -------- d-----w c:\windows\system32\KB905474
2009-04-22 08:00 . 2009-03-11 03:26 1403264 ----a-w c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-04-15 11:05 . 2009-03-06 14:44 283648 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-15 11:05 . 2005-07-26 04:39 60416 ------w c:\windows\system32\dllcache\colbact.dll
2009-04-15 11:05 . 2009-02-09 10:20 399360 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 11:05 . 2009-02-06 17:14 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-15 11:05 . 2009-02-09 10:20 473088 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 11:05 . 2009-02-06 16:39 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 11:05 . 2009-02-09 10:20 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 11:05 . 2009-02-09 10:20 616960 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 11:05 . 2009-02-09 10:20 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 11:05 . 2008-04-21 10:02 215552 ------w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-12 22:59 . 2007-09-02 21:08 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-11 20:25 . 2007-09-02 21:33 -------- d-----w c:\program files\Java
2009-04-25 15:55 . 2008-02-23 18:18 189072 ----a-w c:\windows\system32\PnkBstrB.exe
2009-04-25 15:42 . 2008-02-23 18:18 138920 ----a-w c:\windows\system32\drivers\PnkBstrK.sys
2009-03-21 13:43 . 2007-07-20 00:44 43520 ----a-w c:\windows\system32\CmdLineExt03.dll
2009-03-17 23:33 . 2009-03-17 23:33 -------- d-----w c:\program files\Stardock Games
2009-03-06 14:44 . 2002-08-29 11:00 283648 ----a-w c:\windows\system32\pdh.dll
2009-02-27 22:09 . 2008-02-23 18:18 75064 ----a-w c:\windows\system32\PnkBstrA.exe
2009-02-20 08:30 . 2004-08-04 07:56 81920 ----a-w c:\windows\system32\ieencode.dll
2009-02-20 08:30 . 2004-02-06 23:05 659456 ----a-w c:\windows\system32\wininet.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-12_23.16.40 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-11-01 04:13 . 2009-05-07 07:16 24699336 c:\windows\SYSTEM32\MRT.exe
.
((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2006-11-07 15:29 . 2006-11-07 15:29 50736 c:\program files\AIM6\bak\aim6.exe
2008-01-03 16:15 . 2008-01-03 16:15 50528 c:\program files\AIM6\aim6.exe

2004-03-18 15:46 . 2006-05-22 11:58 180269 c:\program files\Common Files\Real\Update_OB\bak\realsched.exe

2003-05-01 22:44 . 2003-05-01 22:44 65536 c:\program files\Common Files\Roxio Shared\System\bak\EngUtil.exe

2006-10-03 09:45 . 2007-01-10 03:59 115816 c:\program files\Common Files\Symantec Shared\bak\ccApp.exe

2004-03-18 15:45 . 2002-04-03 07:01 135264 c:\program files\Creative\SBLive\Diagnostics\bak\diagent.exe

2004-03-18 15:44 . 2003-08-27 01:47 204800 c:\program files\Dell\Media Experience\bak\PCMService.exe

2005-06-10 06:24 . 2004-07-19 12:51 306688 c:\program files\Dell Support\bak\DSAgnt.exe

2005-02-17 03:11 . 2005-02-17 03:11 49152 c:\program files\HP\HP Software Update\bak\HPWuSchd2.exe

2004-03-18 15:43 . 2003-09-04 02:12 221184 c:\program files\Intel\Modem Event Monitor\bak\IntelMEM.exe

2006-10-30 14:36 . 2006-10-30 14:36 256576 c:\program files\iTunes\bak\iTunesHelper.exe
2008-09-10 22:40 . 2008-09-10 22:40 289576 c:\program files\iTunes\iTunesHelper.exe

2004-03-18 15:50 . 2005-03-12 12:25 110592 c:\program files\MUSICMATCH\MUSICMATCH Jukebox\bak\mm_tray.exe

2006-10-25 23:58 . 2006-10-25 23:58 282624 c:\program files\QuickTime\bak\qttask.exe
2008-09-06 20:09 . 2008-09-06 20:09 413696 c:\program files\QuickTime\QTTask.exe

2003-07-15 16:36 . 2003-07-15 16:36 319488 c:\program files\Roxio\Easy CD Creator 6\AudioCentral\bak\RxMon.exe

2003-07-17 04:19 . 2003-07-17 04:19 868352 c:\program files\Roxio\Easy CD Creator 6\DragToDisc\bak\DrgToDsc.exe

2004-03-18 15:45 . 2000-05-11 07:00 90112 c:\windows\bak\UpdReg.EXE

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-29 68856]
"AROReminder"="c:\program files\Advanced Registry Optimizer\aro.exe" [2008-04-01 2084480]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"<NO NAME>"="c:\program files\Internet Explorer\iexplore.exe" [2004-08-04 93184]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-11 148888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-09-10 289576]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-30 4800512]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-4 53248]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office\OSA9.EXE [1999-2-17 65588]
NETGEAR Media Server.lnk.disabled [2005-11-2 1727]
SoftStuff Wallpaper Changer.lnk - c:\program files\SoftStuff\softstrt.exe [2004-3-29 126976]
WinZip Quick Pick.lnk.disabled [2008-2-29 1669]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave1"= serwvdrv.dll
"wave2"= serwvdrv.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Aim6"=
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
"WinUpdater"="c:\program files\WinUpdater\update.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"MimBoot"=c:\progra~1\MUSICM~1\MUSICM~2\mimboot.exe
"MMTray"="c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Activision\\Empires Dawn of the Modern World\\Empires_DMW.exe"=
"c:\\Program Files\\EA SPORTS\\Madden NFL 2004\\Updater.exe"=
"c:\\Program Files\\Electronic Arts\\The Battle for Middle-earth (tm) II\\game.dat"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrA.exe"=
"c:\\WINDOWS\\SYSTEM32\\PnkBstrB.exe"=
"c:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Stardock Games\\Sins of a Solar Empire\\Sins of a Solar Empire.exe"=

S2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [1/10/2007 10:36 PM 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{114234ee-5c21-11dc-b601-000cf1d6a725}]
\Shell\AutoRun\command - I:\LaunchU3.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4488563b-80f2-11d8-a368-806d6172696f}]
\Shell\AutoRun\command - D:\aoesetup.exe /autorun
\Shell\directx\command - d:\directx\dxsetup.exe
\Shell\dplay\command - d:\directx\dplay61a.exe
\Shell\dxdiag\command - d:\goodies\ar40eng.exe
\Shell\dxinfo\command - d:\goodies\DirectX\dxinfo.exe
\Shell\dxtest\command - d:\directx\dxdiag.exe
\Shell\dxtool\command - d:\goodies\DirectX\dxtool.exe
\Shell\log\command - d:\goodies\machine\machine.exe -l
\Shell\machine\command - d:\goodies\machine\machine.exe
\Shell\setup\command - D:\aoesetup.exe /autorun
\Shell\zone\command - d:\goodies\mszone\zoneA600.exe
.
Contents of the 'Scheduled Tasks' folder

2009-05-09 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 17:34]

2009-05-13 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-04 21:39]

2009-05-13 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-04-22 03:18]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]

2009-05-04 c:\windows\Tasks\wrSpySweeperTrialSweep.job
- c:\program files\Webroot\Spy Sweeper\SpySweeperUI.exe [2007-10-21 21:40]
.
- - - - ORPHANS REMOVED - - - -

BHO-{01023081-8E45-4B25-A4C4-B66BA7DC7EE3} - c:\windows\system32\sekutteu.dll
BHO-{01CFDA93-34D5-426C-8948-DD7217190C62} - c:\windows\system32\sekutteu.dll
BHO-{02030339-B27C-48F3-8BDC-E808C7EBE896} - c:\windows\system32\sekutteu.dll
BHO-{038ACA2F-16F3-4B4A-B905-ED3F17C22C7c} - c:\windows\system32\sekutteu.dll
BHO-{B0D8EED5-12DE-4837-8797-4847471A2014} - c:\windows\system32\mtmuwhf.dll

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mStart Page = hxxp://www.att.net
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: musicmatch.com\online
.
.
------- File Associations -------
.
inffile=c:\i386\NOTEPAD.EXE %1
inifile=c:\i386\NOTEPAD.EXE %1
txtfile=c:\i386\NOTEPAD.EXE %1
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SAVRT]
"ImagePath"="-"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\SNDSrvc]
"ImagePath"="-"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3400476394-1729520875-3007789828-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(780)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\WRLogonNTF.dll

- - - - - - - > 'explorer.exe'(1344)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Webroot\Spy Sweeper\SpySweeper.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
.
**************************************************************************
.
Completion time: 2009-05-14 10:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-14 15:31
ComboFix2.txt 2009-05-13 14:50
ComboFix3.txt 2009-05-13 12:36
ComboFix4.txt 2009-05-12 23:21

Pre-Run: 206,753,505,280 bytes free
Post-Run: 206,740,824,064 bytes free

236 --- E O F --- 2009-05-13 19:38

Shaba · May 14, 2009

OK that is gone now, good

Please go to Kaspersky website and perform an online antivirus scan.

Read through the requirements and privacy statement and click on Accept button.
It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
When the downloads have finished, click on Settings.
Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
- Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives
Click on My Computer under Scan.
Once the scan is complete, it will display the results. Click on View Scan Report.
You will see a list of infected items there. Click on Save Report As....
Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
Please post this log in your next reply along with a fresh HijackThis log.

luvmymgb · May 14, 2009

OK - took awhile....

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, May 14, 2009
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, May 14, 2009 16:37:21
Records in database: 2176884
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
H:\

Scan statistics:
Files scanned: 172346
Threat name: 4
Infected objects: 4
Suspicious objects: 56
Duration of the scan: 03:03:51

File name / Threat name / Threats count
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Identities\{2C7A8CD0-78FA-427F-BF86-AE333A20DC52}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Identities\{D784C3D2-8468-4E52-87E5-2F279596C1BC}\Microsoft\Outlook Express\Deleted Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Identities\{E788FB40-2A9F-481E-9E89-D7189670CCB4}\Microsoft\Outlook Express\6-2-06.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 11
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Identities\{E788FB40-2A9F-481E-9E89-D7189670CCB4}\Microsoft\Outlook Express\Inbox.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 14
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Identities\{E788FB40-2A9F-481E-9E89-D7189670CCB4}\Microsoft\Outlook Express\Sent Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 2
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Microsoft\Outlook\Outlook Express Inbox.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Bob XXXX\Local Settings\Application Data\Microsoft\Outlook\outlook.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 13
C:\Documents and Settings\Bob XXXX\My Documents\Dad\D-Port\Q1'04.pst Infected: Email-Worm.Win32.NetSky.d 1
C:\Documents and Settings\Bob XXXX\My Documents\Dad\D-Port\Q2'03.pst Infected: Email-Worm.Win32.Sobig.e 1
C:\Documents and Settings\Bob XXXX\My Documents\Dad\outlook express files\OE files 7-19-04 7-14-06 Suspicious: Trojan-Spy.HTML.Fraud.gen 12
C:\Documents and Settings\Bob XXXX\My Documents\Dad\outlook express files\Outlook Express Inbox.pst Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Program Files\MUSICMATCH\Common\ComponentMgr\HoldingArea\WebSys\WebSys.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1
C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\WebSys\offline.mmz Infected: not-a-virus:RiskTool.Win32.Deleter.f 1

The selected area was scanned.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:16:36 PM, on 5/14/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Bob Gohn\Local Settings\temp\jkos-Bob Gohn\binaries\ScanningProcess.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AROReminder] C:\Program Files\Advanced Registry Optimizer\aro.exe -rem
O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000049.000000b9
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR Media Server.lnk.disabled
O4 - Global Startup: SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe
O4 - Global Startup: WinZip Quick Pick.lnk.disabled
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52....apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Multimedia Server - Unknown owner - C:\PROGRA~1\NETGEAR\MEDIAS~1\ImmsService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 7708 bytes

Shaba · May 15, 2009

Empty Deleted Items in Outlook and delete all suspicious mails from Inbox.

Looking over your log, it seems you don't have any evidence of an anti-virus software.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

You should run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and results in program conflicts and false virus alerts.

Post back a fresh HijackThis log and tell me if you have any issues left?

luvmymgb · May 15, 2009

Looks like a screwed up....

Note there was no AV installed because I had to remove Norton IS along the way here (it had gotten rather hosed...). Just installed AVG, and it complained during installed about a Roxio driver (despite Roxio no longer being installed). But according to AVG FAQ, this could be ignored. However, when I try to run AVG, it thinks I'm in safe mode (but I'm not). Additionally, somewhere within the last fews steps we've done, I'm prompted to login as me or the administrator when XP boots, as if it were in Safe Mode, but everything else (screen resolution, etc.) is normal. Tried logging in and out of Safe Mode a could of times, but the normal boot always ends up in this state.

Then, like an idiot, I recalled that I had disabled a bunch of startup programs via spybot early in this process, so I re-enabled some of them to see if it would help. Instead, I seem, to have reinfected myself (browser redirections, etc.). I've disabled these again, but I'm afraid I've taken a few giants steps back.

Here's the current HJT log. Sorry to be such a bozo.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:23:32 PM, on 5/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.catholicexchange.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.att.net
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>
R3 - URLSearchHook: (no name) - _{707E6F76-9FFB-4920-A976-EA101271BC25} - (no file)
O2 - BHO: (no name) - {038ACA2F-16F3-4B4A-B905-ED3F17C22C7c} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - (no file)
O2 - BHO: (no name) - {21F0578D-EED7-4F18-A04D-901E866FD9DF} - (no file)
O2 - BHO: (no name) - {232D2677-68EE-4FA1-B988-279EBC8969ED} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: del.icio.us Toolbar Helper - {7AA07AE6-01EF-44EC-93CA-9D7CD41CCDB6} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O2 - BHO: (no name) - {96403BCF-73C3-40C1-8867-AECB77078B25} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {AB9C44D8-4752-4BFC-97E0-612B61A878B3} - (no file)
O2 - BHO: (no name) - {B0D8EED5-12DE-4837-8797-4847471A2014} - (no file)
O2 - BHO: (no name) - {C0B3DCB7-925D-46F4-9BAA-7A7420FDE186} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: del.icio.us - {981FE6A8-260C-4930-960F-C3BC82746CB0} - C:\Program Files\del.icio.us\Internet Explorer Buttons\dlcsIE.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O3 - Toolbar: (no name) - {90222687-F593-4738-B738-FBEE9C7B26DF} - (no file)
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WinUpdater] "C:\Program Files\WinUpdater\update.exe" /background
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: NETGEAR Media Server.lnk = C:\Program Files\NETGEAR\Media Server\MediaServer.exe
O4 - Global Startup: SoftStuff Wallpaper Changer.lnk = C:\Program Files\SoftStuff\softstrt.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab
O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab
O16 - DPF: {5C6698D9-7BE4-4122-8EC5-291D84DBD4A0} (Facebook Photo Uploader 4 Control) - http://upload.facebook.com/controls/FacebookPhotoUploader3.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52....apple.com/saba/us/win/QuickTimeInstaller.exe
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://cdn.messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {D6E7CFB5-C074-4D1C-B647-663D1A8D96BF} (Facebook Photo Uploader 4) - http://upload.facebook.com/controls/FacebookPhotoUploader4_5.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: khfcayw - khfcayw.dll (file missing)
O20 - Winlogon Notify: oczafztk - C:\WINDOWS\
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Integrated Multimedia Server - Unknown owner - C:\PROGRA~1\NETGEAR\MEDIAS~1\ImmsService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 9242 bytes

Here's t

Shaba · May 15, 2009

Download & extract this file to it's own folder - Registry Search

Launch Registry Search
In the search box, enter (on separate lines)

OptionValue
SAFEBOOT_OPTION

Under "Search", make sure only the "Value" box is checked in the first row of checkboxes. All other checkboxes should be checked.

& click "Ok".
Notepad will open with some text in it (the file will also be saved in the program's folder as well).
Post this text in your next reply.

luvmymgb · May 15, 2009

Here you go.....

Windows Registry Editor Version 5.00

; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.6.0

; Results at 5/15/2009 1:41:06 PM for strings:
; 'optionvalue'
; 'safeboot_option'
; Strings excluded from search:
; (None)
; Search in:
; Registry Values
; HKEY_LOCAL_MACHINE HKEY_USERS

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Option]
"OptionValue"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\Environment]
"SAFEBOOT_OPTION"="NETWORK"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Option]
"OptionValue"=dword:00000002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"SAFEBOOT_OPTION"="NETWORK"

; End Of The Log...

Shaba · May 15, 2009

Yes, registry settings cause that.

Please use the following link to download ERUNT
Use the setup program to install ERUNT on your computer

Click Erunt.exe to backup your registry to the folder of your choice.

Note:to restore your registry, go to the folder and start ERDNT.exe

Open Notepad and copy the contents of the following box to a new file.

Code:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Option]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Environment]
"SAFEBOOT_OPTION"=-

Save it as fix.reg (save type: "All files" (*.*)) to your desktop.

It should look like this ->

Go to Desktop, double-click fix.reg and merge the infomation with the registry.

Reboot and let me know how it works now.

luvmymgb · May 15, 2009

Great - that did the trick re: psuedo-safe-mode. BUt I do think I still reinfected myself when I re-enabled some startup programs.

If it helps, here's a snapshot from the spybot "system startup" screen presumabling showing all the installed startup progs.

Thanks so much....

--- Spybot - Search & Destroy version: 1.6.2 (build: 20090126) ---

2009-01-26 blindman.exe (1.0.0.8)
2009-01-26 SDFiles.exe (1.6.1.7)
2009-01-26 SDMain.exe (1.0.0.6)
2009-01-26 SDShred.exe (1.0.2.5)
2009-01-26 SDUpdate.exe (1.6.0.12)
2009-01-26 SpybotSD.exe (1.6.2.46)
2009-01-26 TeaTimer.exe (1.6.4.26)
2009-05-09 unins000.exe (51.49.0.0)
2009-01-26 Update.exe (1.6.0.7)
2009-01-26 advcheck.dll (1.6.2.15)
2007-04-02 aports.dll (2.1.0.0)
2008-06-14 DelZip179.dll (1.79.11.1)
2009-01-26 SDHelper.dll (1.6.2.14)
2008-06-19 sqlite3.dll
2009-01-26 Tools.dll (2.1.6.10)
2009-01-16 UninsSrv.dll (1.0.0.0)
2009-03-25 Includes\Adware.sbi
2009-05-05 Includes\AdwareC.sbi
2009-01-22 Includes\Cookies.sbi
2009-03-31 Includes\Dialer.sbi
2009-05-05 Includes\DialerC.sbi
2009-01-22 Includes\HeavyDuty.sbi
2009-04-21 Includes\Hijackers.sbi
2009-05-05 Includes\HijackersC.sbi
2009-05-06 Includes\Keyloggers.sbi
2009-05-06 Includes\KeyloggersC.sbi
2004-11-29 Includes\LSP.sbi
2009-05-05 Includes\Malware.sbi
2009-05-05 Includes\MalwareC.sbi
2009-03-25 Includes\PUPS.sbi
2009-05-05 Includes\PUPSC.sbi
2009-01-22 Includes\Revision.sbi
2009-01-13 Includes\Security.sbi
2009-05-05 Includes\SecurityC.sbi
2008-06-03 Includes\Spybots.sbi
2008-06-03 Includes\SpybotsC.sbi
2009-04-07 Includes\Spyware.sbi
2009-05-05 Includes\SpywareC.sbi
2009-04-07 Includes\Tracks.uti
2009-04-29 Includes\Trojans.sbi
2009-05-06 Includes\TrojansC.sbi
2008-03-04 Plugins\Chai.dll
2008-03-05 Plugins\Fennel.dll
2008-02-26 Plugins\Mate.dll
2007-12-24 Plugins\TCPIPAddress.dll

Located: HK_LM:Run, AVG8_TRAY
command: C:\PROGRA~1\AVG\AVG8\avgtray.exe
file: C:\PROGRA~1\AVG\AVG8\avgtray.exe
size: 1947928
MD5: 74966D40F38C4E4A4DC712AB353E8634

Located: HK_LM:Run, iTunesHelper
command: "C:\Program Files\iTunes\iTunesHelper.exe"
file: C:\Program Files\iTunes\iTunesHelper.exe
size: 289576
MD5: A7FA648719063B234A434A089FC0F49D

Located: HK_LM:Run, NeroFilterCheck
command: "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe"
file: C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
size: 155648
MD5: C93AB037A8C792D5F8A1A9FC88A7C7C5

Located: HK_LM:Run, QuickTime Task
command: "C:\Program Files\QuickTime\qttask.exe" -atboottime
file: C:\Program Files\QuickTime\qttask.exe
size: 413696
MD5: 6CD5C3276C83F72677D647F27EE14ABD

Located: HK_LM:Run, StartCCC
command: "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
file: C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
size: 90112
MD5: 033FF248550305ED52ED2D2844A8A11B

Located: HK_LM:Run, SunJavaUpdateSched
command: "C:\Program Files\Java\jre6\bin\jusched.exe"
file: C:\Program Files\Java\jre6\bin\jusched.exe
size: 148888
MD5: A2D390F1F2408B94EF34BFE3A00C29D3

Located: HK_LM:Run, ccApp (DISABLED)
command: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
file: C:\Program Files\Common Files\Symantec Shared\ccApp.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, MimBoot (DISABLED)
command: C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
file: C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, MMTray (DISABLED)
command: "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"
file: C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_LM:Run, Symantec PIF AlertEng (DISABLED)
command: "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
file: C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_CU:Run, Aim6
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command:
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: HK_CU:Run, SpybotSD TeaTimer
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
file: C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
size: 2144088
MD5: 896A1DB9A972AD2339C2E8569EC926D1

Located: HK_CU:Run, swg
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
file: C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
size: 68856
MD5: E616A6A6E91B0A86F2F6217CDE835FFE

Located: HK_CU:Run, WinUpdater
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: "C:\Program Files\WinUpdater\update.exe" /background
file: C:\Program Files\WinUpdater\update.exe
size: 62812
MD5: A548124A2408A33CFC574F8ABFCBCE6A

Located: HK_CU:Run, AROReminder (DISABLED)
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: C:\Program Files\Advanced Registry Optimizer\ARO.exe -rem
file: C:\Program Files\Advanced Registry Optimizer\ARO.exe
size: 2084480
MD5: 19E8065F7447E537E8A0CEA130647E13

Located: HK_CU:Run, updateMgr (DISABLED)
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
file: C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
size: 313472
MD5: 43F3F6D33C793089A7C32B45DA16094B

Located: HK_CU:RunOnce, (DISABLED)
where: S-1-5-21-3400476394-1729520875-3007789828-1006...
command: "C:\Program Files\Internet Explorer\iexplore.exe" http://www.symantec.com/techsupp/se...000001f.0000004b&c=00000082.00000049.000000b9
file:
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: Startup (common), Adobe Reader Speed Launch.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
file: C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
size: 29696
MD5: 43362B96870CE8649F4F2EC893DA93F0

Located: Startup (common), HP Digital Imaging Monitor.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
file: C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
size: 258048
MD5: C519CEC624CF9BCBA3059F32266C8FFF

Located: Startup (common), HP Image Zone Fast Start.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
file: C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
size: 53248
MD5: 8C53463A3E28454D74F48BF87A9CF7BA

Located: Startup (common), Microsoft Office.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\Microsoft Office\Office\OSA9.EXE
file: C:\Program Files\Microsoft Office\Office\OSA9.EXE
size: 65588
MD5: 57CB86B1CDD77EB5138BA05D1F193463

Located: Startup (common), NETGEAR Media Server.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\NETGEAR\Media Server\MediaServer.exe
file: C:\Program Files\NETGEAR\Media Server\MediaServer.exe
size: 2027520
MD5: 943CBB82A205A127718117B407CAFECE

Located: Startup (common), SoftStuff Wallpaper Changer.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\SoftStuff\softstrt.exe
file: C:\Program Files\SoftStuff\softstrt.exe
size: 126976
MD5: 14081222BDB6BC7811E42F0C258874C3

Located: Startup (common), WinZip Quick Pick.lnk
where: C:\Documents and Settings\All Users\Start Menu\Programs\Startup...
command: C:\Program Files\WinZip\WZQKPICK.EXE
file: C:\Program Files\WinZip\WZQKPICK.EXE
size: 394856
MD5: 8593C90A433B27553F8A090A65F09A0A

Located: WinLogon, AtiExtEvent
command: Ati2evxx.dll
file: Ati2evxx.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, avgrsstarter
command: avgrsstx.dll
file: avgrsstx.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, crypt32chain
command: crypt32.dll
file: crypt32.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cryptnet
command: cryptnet.dll
file: cryptnet.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, cscdll
command: cscdll.dll
file: cscdll.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, khfcayw
command: khfcayw.dll
file: khfcayw.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, ScCertProp
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, Schedule
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, sclgntfy
command: sclgntfy.dll
file: sclgntfy.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, SensLogn
command: WlNotify.dll
file: WlNotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, termsrv
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, WgaLogon
command: WgaLogon.dll
file: WgaLogon.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, wlballoon
command: wlnotify.dll
file: wlnotify.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Located: WinLogon, WRNotifier
command: WRLogonNTF.dll
file: WRLogonNTF.dll
size: 0
MD5: D41D8CD98F00B204E9800998ECF8427E
Warning: if the file is actually larger than 0 bytes,
the checksum could not be properly calculated!

Shaba · May 15, 2009

TeaTimer might be the reason.

Please post a fresh HijackThis log next.

Almost removed Virtumonde (I think...)

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus

New member

Security Expert: Emeritus