Desktop Infected with TR/cryp.xpack.gen and Others

Blade81 · Nov 17, 2008

Hi

Could you see if there's any kind of log created in c:\ComboFix.txt file? Does any ComboFix?.txt file (? = some number) exist in c:\ComboFix (or c:\ComboFxx) folder?

Rjhem · Nov 17, 2008

Combofix log

This is the last attempt.

Thanks

08-11-12.02 - Mitch 2008-11-15 1:47:28.11 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.319 [GMT -6:00]
Running from: C:\Documents and Settings\Mitch\desktop\combofxx.exe
Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
ComboFix encountered a terminal error!! Please upload this file - C:\ComboFix_error.dat
to: http://www.bleepingcomputer.com/submit-malware.php?channel=4
ComboFix encountered a terminal error!! Please upload this file - C:\ComboFix_error.dat
to: http://www.bleepingcomputer.com/submit-malware.php?channel=4
ComboFix encountered a terminal error!! Please upload this file - C:\ComboFix_error.dat
to: http://www.bleepingcomputer.com/submit-malware.php?channel=4
/wow section - STAGE 50
Access is denied.
Access is denied.
Access is denied.
Access is denied.
Access is denied.
SED: file run.sed line 1: unknown command: `"'
[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

[vfind, 5.2 2002-11-15]

Access is denied.

ComboFix encountered a terminal error!! Please upload this file - C:\ComboFix_error.dat
to: http://www.bleepingcomputer.com/submit-malware.php?channel=4
/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

/wow section - STAGE 50
Access is denied.

ComboFix encountered a terminal error!! Please upload this file - C:\ComboFix_error.dat
to: http://www.bleepingcomputer.com/submit-malware.php?channel=4
/wow section - STAGE 50
Access is denied.

Blade81 · Nov 17, 2008

Hi

Please go to http://www.bleepingcomputer.com/submit-malware.php?channel=4 address.

Fill 'Link to topic where this file was requested' -field with http://forums.spybot.info/showthread.php?t=36288

Then before clicking 'send file' -button browse to C:\ComboFix_error.dat file.

Click 'send file' and let me know when you've done it.

Rjhem · Nov 17, 2008

Submitted .Dat file

Blade81

the file is submitted

Thanks

Blade81 · Nov 17, 2008

Thanks. I'll get back to you asap

Blade81 · Nov 18, 2008

Hi

Delete following folders and then try running ComboFix again:
C:\32788R22FWJFW
C:\QooBox\LastRun

Rjhem · Nov 25, 2008

Scan Log

Hi, Sorry for the delay have been away from the desktop. I finally got this to run after deleting the files or folders, then changing the permissions after the file started running in safe mode. I was still getting denied access for permission.

But any how here is the log file.

ComboFix 08-11-24.01 - Administrator 2008-11-24 23:37:51.14 - NTFSx86 MINIMAL
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.407 [GMT -6:00]
Running from: c:\documents and settings\Mitch\My Documents\Zip Programs\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV.SYS

((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.

2008-11-24 23:41 . 08-11-24 23:41 281 --a------ C:\temp00.dat
2008-11-24 23:36 . 08-11-24 23:36 <DIR> d-a------ C:\ComboFix
2008-11-24 23:36 . 08-11-24 23:36 0 --a------ C:\__tmp_rar_sfx_access_check_455044
2008-11-24 23:04 . 08-11-24 23:04 0 --a------ C:\__tmp_rar_sfx_access_check_333409
2008-11-24 22:48 . 08-11-24 22:48 0 --a------ C:\__tmp_rar_sfx_access_check_45026434
2008-11-24 22:44 . 08-11-24 22:44 0 --a------ C:\__tmp_rar_sfx_access_check_44826627
2008-11-20 09:27 . 08-11-20 09:27 <DIR> d-------- C:\MSI9da38.tmp
2008-11-18 09:12 . 08-11-18 09:12 <DIR> d-------- C:\MSIdeefa.tmp
2008-11-16 12:50 . 08-11-16 12:50 0 --a------ C:\25B.tmp
2008-11-16 12:50 . 08-11-16 12:50 0 --a------ C:\258.tmp
2008-11-16 12:50 . 08-11-16 12:50 0 --a------ C:\255.tmp
2008-11-16 12:38 . 08-11-16 12:41 0 --a------ C:\21D.tmp
2008-11-16 12:08 . 08-11-16 12:08 0 --a------ C:\7F.tmp
2008-11-16 11:49 . 08-11-17 20:51 <DIR> d-------- c:\winnt\system32\ActiveScan
2008-11-16 11:49 . 08-11-16 11:49 30,590 --a------ c:\winnt\system32\pavas.ico
2008-11-15 22:39 . 08-11-15 22:39 <DIR> d-------- c:\program files\Avira
2008-11-15 22:39 . 08-11-15 22:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-15 06:23 . 08-11-15 06:23 <DIR> d-------- c:\program files\Avira GmbH
2008-11-15 04:35 . 08-11-15 04:35 <DIR> d-------- C:\MSI1d880.tmp
2008-11-15 01:46 . 08-11-15 01:46 0 --a------ C:\__tmp_rar_sfx_access_check_298849
2008-11-15 01:44 . 08-11-15 01:44 0 --a------ C:\__tmp_rar_sfx_access_check_178907
2008-11-15 01:19 . 08-11-15 01:19 0 --a------ C:\__tmp_rar_sfx_access_check_498226
2008-11-15 01:17 . 08-11-15 01:17 0 --a------ C:\__tmp_rar_sfx_access_check_360278
2008-11-15 01:03 . 08-11-15 01:03 0 --a------ C:\__tmp_rar_sfx_access_check_483905
2008-11-15 00:45 . 08-11-15 00:45 0 --a------ C:\__tmp_rar_sfx_access_check_699065
2008-11-15 00:43 . 08-11-15 00:43 0 --a------ C:\__tmp_rar_sfx_access_check_624357
2008-11-15 00:23 . 08-11-15 00:23 0 --a------ C:\__tmp_rar_sfx_access_check_677914
2008-11-14 22:09 . 08-11-14 22:09 250 --a------ c:\winnt\gmer.ini
2008-11-14 17:58 . 08-11-14 17:58 0 --a------ C:\__tmp_rar_sfx_access_check_296306
2008-11-14 17:52 . 08-11-14 17:52 0 --a------ C:\__tmp_rar_sfx_access_check_944508
2008-11-14 17:52 . 08-11-14 17:52 0 --a------ C:\__tmp_rar_sfx_access_check_910288
2008-11-14 17:49 . 08-11-14 17:49 0 --a------ C:\__tmp_rar_sfx_access_check_724421
2008-11-14 17:45 . 08-11-14 17:45 0 --a------ C:\__tmp_rar_sfx_access_check_517454
2008-11-14 17:40 . 08-11-14 17:40 0 --a------ C:\__tmp_rar_sfx_access_check_201359
2008-11-14 17:21 . 08-11-24 23:16 59,760 --a------ C:\ComboFix_error.dat
2008-11-14 17:18 . 08-11-24 23:37 0 --a------ C:\test0123
2008-11-14 17:16 . 08-11-14 17:16 0 --a------ C:\__tmp_rar_sfx_access_check_1931357
2008-11-14 16:49 . 08-11-14 16:49 0 --a------ C:\__tmp_rar_sfx_access_check_293792
2008-11-14 16:43 . 08-11-24 22:52 1,199,212 ---h----- c:\winnt\ShellIconCache
2008-11-14 16:34 . 08-11-14 16:34 0 --a------ C:\__tmp_rar_sfx_access_check_326819
2008-11-14 11:52 . 08-11-14 11:52 0 --a------ C:\__tmp_rar_sfx_access_check_582547
2008-11-14 11:37 . 08-11-14 11:37 0 --a------ C:\__tmp_rar_sfx_access_check_842651
2008-11-14 11:33 . 08-11-14 11:33 0 --a------ C:\__tmp_rar_sfx_access_check_650956
2008-11-14 10:56 . 08-11-14 10:56 0 --a------ C:\__tmp_rar_sfx_access_check_9993409
2008-11-14 10:55 . 08-11-14 10:55 0 --a------ C:\__tmp_rar_sfx_access_check_9936457
2008-11-14 10:41 . 08-11-24 23:36 194 --a------ C:\Start_.cmd
2008-11-14 07:04 . 08-11-14 07:04 0 --a------ C:\__tmp_rar_sfx_access_check_282746
2008-11-14 07:03 . 08-11-14 07:03 0 --a------ C:\__tmp_rar_sfx_access_check_222129
2008-11-14 06:00 . 08-11-14 06:00 0 --a------ C:\__tmp_rar_sfx_access_check_400305
2008-11-14 05:59 . 08-11-14 05:59 0 --a------ C:\__tmp_rar_sfx_access_check_371053
2008-11-11 08:01 . 08-11-11 08:00 410,976 --a------ c:\winnt\system32\deploytk.dll
2008-11-11 08:00 . 08-11-11 08:00 <DIR> d-------- C:\MSI9f2aa.tmp
2008-11-11 08:00 . 08-11-11 08:00 <DIR> d-------- C:\MSI355dc.tmp
2008-11-11 07:57 . 08-11-11 08:00 73,728 --a------ c:\winnt\system32\javacpl.cpl
2008-11-11 07:52 . 08-11-11 07:52 <DIR> d-------- C:\MSI2ad4e.tmp
2008-11-10 19:56 . 08-11-10 19:56 <DIR> d-------- c:\documents and settings\Mitch\Application Data\Malwarebytes
2008-11-10 19:56 . 08-10-22 16:10 38,496 --a------ c:\winnt\system32\drivers\mbamswissarmy.sys
2008-11-10 19:56 . 08-10-22 16:10 15,504 --a------ c:\winnt\system32\drivers\mbam.sys
2008-11-10 19:55 . 08-11-16 13:01 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-10 19:55 . 08-11-10 19:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-10 10:10 . 08-11-10 10:10 <DIR> d-------- c:\program files\Black List Software
2008-11-10 09:53 . 01-05-08 06:00 4,080 --a--c--- c:\winnt\system32\dllcache\beep.sys.vir
2008-11-09 22:56 . 08-11-10 20:08 81,984 --a------ c:\winnt\system32\bdod.bin
2008-11-09 22:48 . 08-11-24 23:47 335 --a------ c:\winnt\system32\vsconfig.xml
2008-11-09 22:22 . 08-11-16 08:31 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-09 19:23 . 08-11-10 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\BitDefender
2008-11-09 19:22 . 08-11-10 21:06 <DIR> d-------- c:\program files\Common Files\Softwin
2008-11-09 18:38 . 08-11-09 18:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-09 16:02 . 08-11-09 16:02 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-08 22:31 . 08-11-16 13:22 <DIR> d-------- c:\program files\Trojan Remover
2008-11-08 16:48 . 08-11-10 11:01 527 --a------ c:\winnt\system32\TDSSupoj.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 01:50 --------- d---a-w c:\documents and settings\Mitch\Application Data\WeatherBug
2008-11-24 23:53 --------- d-----w c:\documents and settings\Darlene\Application Data\WeatherBug
2008-11-24 16:11 --------- d-----w c:\program files\palmOne
2008-11-20 15:32 --------- d-----w c:\program files\EarthLink TotalAccess
2008-11-20 15:27 --------- d-----w c:\program files\Common Files\EarthLink
2008-11-17 05:26 --------- d-----w c:\program files\Viewpoint
2008-11-17 05:26 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-16 19:21 --------- d-----w c:\program files\TomTom HOME 2
2008-11-16 19:01 --------- d-----w c:\program files\Lexmark 1200 Series
2008-11-16 18:54 --------- d-----w c:\program files\Google
2008-11-16 18:50 --------- d-----w c:\program files\Common Files\Command Software
2008-11-16 18:41 --------- d-----w c:\program files\7-Zip
2008-11-16 18:18 --------- d---a-w c:\documents and settings\All Users\Application Data\MailFrontier
2008-11-16 18:08 --------- d-----w c:\program files\Common Files\DataViz
2008-11-16 18:07 --------- d-----w c:\program files\Active Ports
2008-11-15 12:54 470,528 ----a-w c:\winnt\Internet Logs\xDB4.tmp
2008-11-15 12:23 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-15 07:55 1,556,288 ----a-w c:\winnt\Internet Logs\tvDebug.zip
2008-11-14 22:41 --------- d---a-w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-12 21:40 --------- d-----w c:\documents and settings\Jimmy\Application Data\WeatherBug
2008-11-12 14:49 --------- d-----w c:\program files\Documents To Go
2008-11-12 03:52 1,367,552 ----a-w c:\winnt\Internet Logs\xDB3.tmp
2008-11-11 16:12 1,373,696 ----a-w c:\winnt\Internet Logs\xDB2.tmp
2008-11-11 14:00 --------- d-----w c:\program files\Java
2008-11-11 01:56 --------- d-----w c:\program files\Trend Micro
2008-11-11 01:35 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-09 22:10 45,056 ----a-w c:\winnt\Internet Logs\xDB1.tmp
2008-11-09 22:06 --------- d-----w c:\program files\Lavasoft
2008-11-09 04:31 --------- d-----w c:\documents and settings\Mitch\Application Data\Simply Super Software
2008-10-16 20:13 202,776 ----a-w c:\winnt\system32\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\winnt\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\winnt\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\winnt\system32\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\winnt\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\winnt\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\winnt\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\winnt\system32\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\winnt\system32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\winnt\system32\muweb.dll
2008-10-10 15:23 --------- d-----w c:\documents and settings\Default User\Application Data\Intuit
2008-10-09 00:23 --------- d-----w c:\program files\hp deskjet 950c series
2008-10-07 23:04 --------- d-----w c:\program files\OpenOffice.org 3
2008-10-07 18:04 1,901 ----a-w c:\winnt\panose.bin
2008-10-07 11:57 --------- d-----w c:\documents and settings\Mitch\Application Data\OpenOffice.org
2008-10-07 03:18 34,816 ----a-w c:\winnt\system32\Dlportio.dll
2008-10-07 03:18 3,584 ----a-w c:\winnt\Dlportio.sys
2008-10-07 03:18 27,460 ----a-w c:\winnt\system32\loaddrv.exe
2008-10-01 00:22 --------- d-----w c:\program files\Windows Live Safety Center
2008-09-30 23:58 --------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2008-09-30 22:43 1,286,152 ----a-w c:\winnt\system32\msxml4.dll
2008-09-30 21:48 20,623 ----a-w c:\winnt\system32\drivers\USB.INF
2008-09-30 21:16 93,360 ----a-w c:\winnt\system32\drivers\ndiswan.sys
2008-09-15 05:13 1,644,432 ----a-w c:\winnt\system32\WIN32K.SYS
2008-09-08 08:14 1,121,280 ----a-w c:\winnt\system32\msxml3.dll
2008-09-03 15:19 124 ----a-w c:\documents and settings\Mitch\Application Data\ftpfile.dat
2007-05-30 03:12 92,064 ----a-w c:\documents and settings\Mitch\mqdmmdm.sys
2007-05-30 03:12 9,232 ----a-w c:\documents and settings\Mitch\mqdmmdfl.sys
2007-05-30 03:12 79,328 ----a-w c:\documents and settings\Mitch\mqdmserd.sys
2007-05-30 03:12 66,656 ----a-w c:\documents and settings\Mitch\mqdmbus.sys
2007-05-30 03:12 6,208 ----a-w c:\documents and settings\Mitch\mqdmcmnt.sys
2007-05-30 03:12 5,936 ----a-w c:\documents and settings\Mitch\mqdmwhnt.sys
2007-05-30 03:12 4,048 ----a-w c:\documents and settings\Mitch\mqdmcr.sys
2007-05-30 03:12 25,600 ----a-w c:\documents and settings\Mitch\usbsermptxp.sys
2007-05-30 03:12 22,768 ----a-w c:\documents and settings\Mitch\usbsermpt.sys
2006-12-22 03:59 271 ---h--w c:\program files\desktop.ini
2006-12-22 03:59 21,952 ---h--w c:\program files\folder.htt
2001-05-08 12:00 32,528 ----a-w c:\winnt\inf\wbfirdma.sys
2006-12-21 21:33 1,894 --sha-w c:\winnt\rreg32.dll
2006-12-21 21:33 5,482 --sha-w c:\winnt\utapi32.dll
2008-02-16 04:59 88 --sh--r c:\winnt\system32\8F2E2DE3A7.sys
2008-02-16 04:59 2,672 --sha-w c:\winnt\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

c:\documents and settings\Mitch\Start Menu\Programs\Startup\
LifeDriveT Manager.lnk - c:\program files\palmOne\LifeDriveMgrTray.exe [2005-04-21 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2006-12-24 28672]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-06-09 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"VIDC.JPEG"= jpegCode.dll
"VIDC.MJPG"= jpegCode.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\winnt\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"IPInSightLAN 01"="c:\program files\EarthLink TotalAccess\FastLane2\IPClient.exe" -l
"IPInSightMonitor 01"="c:\program files\EarthLink TotalAccess\FastLane2\IPMon32.exe"

.
Contents of the 'Scheduled Tasks' folder

2008-11-10 c:\winnt\Tasks\SyncBack Darlene Sync.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-13 c:\winnt\Tasks\SyncBack Mitch Backup.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-12 c:\winnt\Tasks\SyncBack Palm Documents.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-08 c:\winnt\Tasks\SyncBack PeachTree Backup.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.drudgereport.com/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: Send to &Bluetooth Device... - c:\program files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
LSP: c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
LSP: %SystemRoot%\system32\msafd.dll

O16 -: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
c:\winnt\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
c:\winnt\Downloaded Program Files\Microsoft XML Parser for Java.osd

c:\winnt\Downloaded Program Files\oscan81.ocx_x - c:\winnt\bdoscandellang.ini
c:\winnt\bdoscandel.exe
c:\winnt\Downloaded Program Files\live.ini
c:\winnt\Downloaded Program Files\scanoptions.tsi
c:\winnt\Downloaded Program Files\lang.ini
c:\winnt\Downloaded Program Files\ipsupd.dll
c:\winnt\Downloaded Program Files\bdupd.dll
c:\winnt\Downloaded Program Files\libfn.dll
c:\winnt\Downloaded Program Files\bdcore.dll
c:\winnt\Downloaded Program Files\oscan8.ocx
c:\winnt\Downloaded Program Files\CONFLICT.1\oscan81.ocx_x
c:\winnt\Downloaded Program Files\CONFLICT.1\live.ini
c:\winnt\Downloaded Program Files\CONFLICT.1\scanoptions.tsi
c:\winnt\Downloaded Program Files\CONFLICT.1\lang.ini
c:\winnt\Downloaded Program Files\CONFLICT.1\ipsupd.dll
c:\winnt\Downloaded Program Files\CONFLICT.1\bdupd.dll
c:\winnt\Downloaded Program Files\CONFLICT.1\libfn.dll
c:\winnt\Downloaded Program Files\CONFLICT.1\bdcore.dll
c:\winnt\Downloaded Program Files\CONFLICT.1\oscan8.ocx
O16 -: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}
c:\winnt\Downloaded Program Files\CONFLICT.1\oscan8.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 07:25:39
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(220)
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL

- - - - - - - > 'lsass.exe'(260)
c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
.
Completion time: 2008-11-25 7:33:22 - machine was rebooted [Mitch]
ComboFix-quarantined-files.txt 2008-11-25 13:33:12

Pre-Run: 2,165,829,632 bytes free
Post-Run: 2,084,270,080 bytes free

258 --- E O F --- 2008-11-09 09:00:48

Blade81 · Nov 25, 2008

Hi

Please do following in normal mode if possible.

Open notepad and copy/paste the text in the quotebox below into it:

Code:

File::
C:\temp00.dat
C:\__tmp_rar_sfx_access_check_455044
C:\__tmp_rar_sfx_access_check_333409
C:\__tmp_rar_sfx_access_check_45026434
C:\__tmp_rar_sfx_access_check_44826627
C:\25B.tmp
C:\258.tmp
C:\255.tmp
C:\21D.tmp
C:\7F.tmp
C:\__tmp_rar_sfx_access_check_298849
C:\__tmp_rar_sfx_access_check_178907
C:\__tmp_rar_sfx_access_check_498226
C:\__tmp_rar_sfx_access_check_360278
C:\__tmp_rar_sfx_access_check_483905
C:\__tmp_rar_sfx_access_check_699065
C:\__tmp_rar_sfx_access_check_624357
C:\__tmp_rar_sfx_access_check_677914
C:\__tmp_rar_sfx_access_check_296306
C:\__tmp_rar_sfx_access_check_944508
C:\__tmp_rar_sfx_access_check_910288
C:\__tmp_rar_sfx_access_check_724421
C:\__tmp_rar_sfx_access_check_517454
C:\__tmp_rar_sfx_access_check_201359
C:\test0123
C:\__tmp_rar_sfx_access_check_1931357
C:\__tmp_rar_sfx_access_check_293792
C:\__tmp_rar_sfx_access_check_326819
C:\__tmp_rar_sfx_access_check_582547
C:\__tmp_rar_sfx_access_check_842651
C:\__tmp_rar_sfx_access_check_650956
C:\__tmp_rar_sfx_access_check_9993409
C:\__tmp_rar_sfx_access_check_9936457
C:\Start_.cmd
C:\__tmp_rar_sfx_access_check_282746
C:\__tmp_rar_sfx_access_check_222129
C:\__tmp_rar_sfx_access_check_400305
C:\__tmp_rar_sfx_access_check_371053
c:\winnt\system32\dllcache\beep.sys.vir
c:\winnt\system32\TDSSupoj.dat

Folder::
C:\MSI9da38.tmp
C:\MSIdeefa.tmp
C:\MSI1d880.tmp
C:\MSI9f2aa.tmp
C:\MSI355dc.tmp
C:\MSI2ad4e.tmp

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.

Refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.

Please run an online scan with Kaspersky Online Scanner as instructed in the screenshot here.

Post back its report, a fresh hjt log and above mentioned ComboFix resultant log.

Rjhem · Nov 26, 2008

Scan results and log files

Ok, It would not run in normal mode still, had to run in safe mode same procedure I used last time. When in normal mode it pings and address 208.43.120.24 and then want to do a update at address 209.85.176.99 to download combofix.download.exe. then if you run that it shuts down and does nothing. If I allow the ping but not the update it runs up to the 50 line and hangs at the same place. When in safe mode it will run. ?

Kapersky scan ran clean ,

Thanks

Following the logs

combofix.

ComboFix 08-11-24.03 - Administrator 2008-11-25 11:56:40.18 - NTFSx86 MINIMAL
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.386 [GMT -6:00]
Running from: c:\documents and settings\Administrator\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\__tmp_rar_sfx_access_check_178907
C:\__tmp_rar_sfx_access_check_1931357
C:\__tmp_rar_sfx_access_check_201359
C:\__tmp_rar_sfx_access_check_222129
C:\__tmp_rar_sfx_access_check_282746
C:\__tmp_rar_sfx_access_check_293792
C:\__tmp_rar_sfx_access_check_296306
C:\__tmp_rar_sfx_access_check_298849
C:\__tmp_rar_sfx_access_check_326819
C:\__tmp_rar_sfx_access_check_333409
C:\__tmp_rar_sfx_access_check_360278
C:\__tmp_rar_sfx_access_check_371053
C:\__tmp_rar_sfx_access_check_400305
C:\__tmp_rar_sfx_access_check_44826627
C:\__tmp_rar_sfx_access_check_45026434
C:\__tmp_rar_sfx_access_check_455044
C:\__tmp_rar_sfx_access_check_483905
C:\__tmp_rar_sfx_access_check_498226
C:\__tmp_rar_sfx_access_check_517454
C:\__tmp_rar_sfx_access_check_582547
C:\__tmp_rar_sfx_access_check_624357
C:\__tmp_rar_sfx_access_check_650956
C:\__tmp_rar_sfx_access_check_677914
C:\__tmp_rar_sfx_access_check_699065
C:\__tmp_rar_sfx_access_check_724421
C:\__tmp_rar_sfx_access_check_842651
C:\__tmp_rar_sfx_access_check_910288
C:\__tmp_rar_sfx_access_check_944508
C:\__tmp_rar_sfx_access_check_9936457
C:\__tmp_rar_sfx_access_check_9993409
C:\21D.tmp
C:\255.tmp
C:\258.tmp
C:\25B.tmp
C:\7F.tmp
C:\Start_.cmd
C:\temp00.dat
C:\test0123
c:\winnt\system32\dllcache\beep.sys.vir
c:\winnt\system32\TDSSupoj.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Start_.cmd
C:\test0123
C:\MSI1d880.tmp . . . . failed to delete
C:\MSI9f2aa.tmp . . . . failed to delete
C:\MSIdeefa.tmp . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.

2008-11-25 11:58 . 08-11-25 11:58 267 --a------ C:\temp00.dat
2008-11-25 11:55 . 08-11-25 11:55 <DIR> d-a------ C:\ComboFix
2008-11-25 11:55 . 08-11-25 11:55 0 --a------ C:\__tmp_rar_sfx_access_check_1503692
2008-11-25 11:41 . 08-11-25 11:41 0 --a------ C:\__tmp_rar_sfx_access_check_668541
2008-11-25 11:16 . 08-11-25 11:16 0 --a------ C:\__tmp_rar_sfx_access_check_1288042
2008-11-25 10:37 . 08-11-25 10:37 0 --a------ C:\__tmp_rar_sfx_access_check_39215899
2008-11-25 10:36 . 08-11-25 10:36 0 --a------ C:\__tmp_rar_sfx_access_check_39128203
2008-11-25 10:32 . 08-11-25 10:32 0 --a------ C:\__tmp_rar_sfx_access_check_38891793
2008-11-25 10:23 . 08-11-25 10:23 0 --a------ C:\__tmp_rar_sfx_access_check_38395449
2008-11-25 10:23 . 08-11-25 10:23 0 --a------ C:\__tmp_rar_sfx_access_check_38349914
2008-11-25 10:19 . 08-11-25 10:19 0 --a------ C:\__tmp_rar_sfx_access_check_38135736
2008-11-18 09:12 . 08-11-18 09:12 <DIR> d-------- C:\MSIdeefa.tmp
2008-11-16 11:49 . 08-11-17 20:51 <DIR> d-------- c:\winnt\system32\ActiveScan
2008-11-16 11:49 . 08-11-16 11:49 30,590 --a------ c:\winnt\system32\pavas.ico
2008-11-15 22:39 . 08-11-15 22:39 <DIR> d-------- c:\program files\Avira
2008-11-15 22:39 . 08-11-15 22:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-15 06:23 . 08-11-15 06:23 <DIR> d-------- c:\program files\Avira GmbH
2008-11-15 04:35 . 08-11-15 04:35 <DIR> d-------- C:\MSI1d880.tmp
2008-11-14 22:09 . 08-11-14 22:09 250 --a------ c:\winnt\gmer.ini
2008-11-14 17:21 . 08-11-25 11:49 63,912 --a------ C:\ComboFix_error.dat
2008-11-14 16:43 . 08-11-25 11:06 1,195,100 ---h----- c:\winnt\ShellIconCache
2008-11-11 08:01 . 08-11-11 08:00 410,976 --a------ c:\winnt\system32\deploytk.dll
2008-11-11 08:00 . 08-11-11 08:00 <DIR> d-------- C:\MSI9f2aa.tmp
2008-11-11 07:57 . 08-11-11 08:00 73,728 --a------ c:\winnt\system32\javacpl.cpl
2008-11-10 19:56 . 08-11-10 19:56 <DIR> d-------- c:\documents and settings\Mitch\Application Data\Malwarebytes
2008-11-10 19:56 . 08-10-22 16:10 38,496 --a------ c:\winnt\system32\drivers\mbamswissarmy.sys
2008-11-10 19:56 . 08-10-22 16:10 15,504 --a------ c:\winnt\system32\drivers\mbam.sys
2008-11-10 19:55 . 08-11-16 13:01 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-10 19:55 . 08-11-10 19:55 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-10 10:10 . 08-11-10 10:10 <DIR> d-------- c:\program files\Black List Software
2008-11-09 22:56 . 08-11-10 20:08 81,984 --a------ c:\winnt\system32\bdod.bin
2008-11-09 22:48 . 08-11-25 12:03 335 --a------ c:\winnt\system32\vsconfig.xml
2008-11-09 22:22 . 08-11-16 08:31 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-09 19:23 . 08-11-10 21:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\BitDefender
2008-11-09 19:22 . 08-11-10 21:06 <DIR> d-------- c:\program files\Common Files\Softwin
2008-11-09 18:38 . 08-11-09 18:38 <DIR> d-------- c:\documents and settings\All Users\Application Data\Kaspersky Lab Setup Files
2008-11-09 16:02 . 08-11-09 16:02 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-08 22:31 . 08-11-16 13:22 <DIR> d-------- c:\program files\Trojan Remover

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 16:56 2,966,771 ----a-w c:\winnt\Internet Logs\tvDebug.zip
2008-11-25 15:47 --------- d-----w c:\program files\Quicken Legal Business Pro 2007
2008-11-25 01:50 --------- d---a-w c:\documents and settings\Mitch\Application Data\WeatherBug
2008-11-24 23:53 --------- d-----w c:\documents and settings\Darlene\Application Data\WeatherBug
2008-11-24 16:11 --------- d-----w c:\program files\palmOne
2008-11-20 15:32 --------- d-----w c:\program files\EarthLink TotalAccess
2008-11-20 15:27 --------- d-----w c:\program files\Common Files\EarthLink
2008-11-17 05:26 --------- d-----w c:\program files\Viewpoint
2008-11-17 05:26 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-16 19:21 --------- d-----w c:\program files\TomTom HOME 2
2008-11-16 19:01 --------- d-----w c:\program files\Lexmark 1200 Series
2008-11-16 18:54 --------- d-----w c:\program files\Google
2008-11-16 18:50 --------- d-----w c:\program files\Common Files\Command Software
2008-11-16 18:41 --------- d-----w c:\program files\7-Zip
2008-11-16 18:18 --------- d---a-w c:\documents and settings\All Users\Application Data\MailFrontier
2008-11-16 18:08 --------- d-----w c:\program files\Common Files\DataViz
2008-11-16 18:07 --------- d-----w c:\program files\Active Ports
2008-11-15 12:54 470,528 ----a-w c:\winnt\Internet Logs\xDB4.tmp
2008-11-15 12:23 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-14 22:41 --------- d---a-w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-12 21:40 --------- d-----w c:\documents and settings\Jimmy\Application Data\WeatherBug
2008-11-12 14:49 --------- d-----w c:\program files\Documents To Go
2008-11-12 03:52 1,367,552 ----a-w c:\winnt\Internet Logs\xDB3.tmp
2008-11-11 16:12 1,373,696 ----a-w c:\winnt\Internet Logs\xDB2.tmp
2008-11-11 14:00 --------- d-----w c:\program files\Java
2008-11-11 01:56 --------- d-----w c:\program files\Trend Micro
2008-11-11 01:35 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-09 22:10 45,056 ----a-w c:\winnt\Internet Logs\xDB1.tmp
2008-11-09 22:06 --------- d-----w c:\program files\Lavasoft
2008-11-09 04:31 --------- d-----w c:\documents and settings\Mitch\Application Data\Simply Super Software
2008-10-16 20:13 202,776 ----a-w c:\winnt\system32\wuweb.dll
2008-10-16 20:13 1,809,944 ----a-w c:\winnt\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\winnt\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\winnt\system32\wucltui.dll
2008-10-16 20:09 92,696 ----a-w c:\winnt\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\winnt\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\winnt\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\winnt\system32\wups.dll
2008-10-16 20:06 268,648 ----a-w c:\winnt\system32\mucltui.dll
2008-10-16 20:06 208,744 ----a-w c:\winnt\system32\muweb.dll
2008-10-10 15:23 --------- d-----w c:\documents and settings\Default User\Application Data\Intuit
2008-10-09 00:23 --------- d-----w c:\program files\hp deskjet 950c series
2008-10-07 23:04 --------- d-----w c:\program files\OpenOffice.org 3
2008-10-07 18:04 1,901 ----a-w c:\winnt\panose.bin
2008-10-07 11:57 --------- d-----w c:\documents and settings\Mitch\Application Data\OpenOffice.org
2008-10-07 03:18 34,816 ----a-w c:\winnt\system32\Dlportio.dll
2008-10-07 03:18 3,584 ----a-w c:\winnt\Dlportio.sys
2008-10-07 03:18 27,460 ----a-w c:\winnt\system32\loaddrv.exe
2008-10-01 00:22 --------- d-----w c:\program files\Windows Live Safety Center
2008-09-30 23:58 --------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2008-09-30 22:43 1,286,152 ----a-w c:\winnt\system32\msxml4.dll
2008-09-30 21:48 20,623 ----a-w c:\winnt\system32\drivers\USB.INF
2008-09-30 21:16 93,360 ----a-w c:\winnt\system32\drivers\ndiswan.sys
2008-09-15 05:13 1,644,432 ----a-w c:\winnt\system32\WIN32K.SYS
2008-09-08 08:14 1,121,280 ----a-w c:\winnt\system32\msxml3.dll
2008-09-03 15:19 124 ----a-w c:\documents and settings\Mitch\Application Data\ftpfile.dat
2007-05-30 03:12 92,064 ----a-w c:\documents and settings\Mitch\mqdmmdm.sys
2007-05-30 03:12 9,232 ----a-w c:\documents and settings\Mitch\mqdmmdfl.sys
2007-05-30 03:12 79,328 ----a-w c:\documents and settings\Mitch\mqdmserd.sys
2007-05-30 03:12 66,656 ----a-w c:\documents and settings\Mitch\mqdmbus.sys
2007-05-30 03:12 6,208 ----a-w c:\documents and settings\Mitch\mqdmcmnt.sys
2007-05-30 03:12 5,936 ----a-w c:\documents and settings\Mitch\mqdmwhnt.sys
2007-05-30 03:12 4,048 ----a-w c:\documents and settings\Mitch\mqdmcr.sys
2007-05-30 03:12 25,600 ----a-w c:\documents and settings\Mitch\usbsermptxp.sys
2007-05-30 03:12 22,768 ----a-w c:\documents and settings\Mitch\usbsermpt.sys
2006-12-22 03:59 271 ---h--w c:\program files\desktop.ini
2006-12-22 03:59 21,952 ---h--w c:\program files\folder.htt
2001-05-08 12:00 32,528 ----a-w c:\winnt\inf\wbfirdma.sys
2006-12-21 21:33 1,894 --sha-w c:\winnt\rreg32.dll
2006-12-21 21:33 5,482 --sha-w c:\winnt\utapi32.dll
2008-02-16 04:59 88 --sh--r c:\winnt\system32\8F2E2DE3A7.sys
2008-02-16 04:59 2,672 --sha-w c:\winnt\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="c:\program files\CCleaner\ccleaner.exe" [08-10-23 12:34 1336560]
"TomTomHOME.exe"="c:\program files\TomTom HOME 2\HOMERunner.exe" [08-09-26 07:50 206184]
"Weather"="c:\program files\AWS\WeatherBug\Weather.exe" [06-04-07 15:02 1343488]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [07-08-17 20:10 68856]
"E6TaskPanel"="c:\program files\EarthLink TotalAccess\TaskPanl.exe" [05-09-01 16:24 942080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [07-10-10 18:51 39792]
"HPDJ Taskbar Utility"="c:\winnt\system32\spool\drivers\w32x86\3\hpztsb04.exe" [01-11-07 10:45 196608]
"Lexmark 1200 Series"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [06-07-12 23:22 57344]
"TrojanScanner"="c:\program files\Trojan Remover\Trjscan.exe" [08-11-08 22:32 968072]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [08-07-09 08:05 919016]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [08-06-12 14:28 266497]
"Synchronization Manager"="mobsync.exe" [03-06-19 13:05 111376 c:\winnt\system32\mobsync.exe]

c:\documents and settings\Mitch\Start Menu\Programs\Startup\
LifeDriveT Manager.lnk - c:\program files\palmOne\LifeDriveMgrTray.exe [2005-04-21 86016]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
DataViz Inc Messenger.lnk - c:\program files\Common Files\DataViz\DvzIncMsgr.exe [2006-12-24 28672]
HotSync Manager.lnk - c:\program files\palmOne\Hotsync.exe [2004-06-09 471040]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"= mmdrv.dll
"VIDC.JPEG"= jpegCode.dll
"VIDC.MJPG"= jpegCode.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\winnt\pss\Bluetooth.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\winnt\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeachtreePrefetcher.exe]
-ra------ 07-05-16 11:12 32768 c:\progra~1\SAGESO~1\PEACHT~1\PeachtreePrefetcher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
--a------ 03-06-19 13:05 111376 c:\winnt\system32\mobsync.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"IPInSightLAN 01"="c:\program files\EarthLink TotalAccess\FastLane2\IPClient.exe" -l
"IPInSightMonitor 01"="c:\program files\EarthLink TotalAccess\FastLane2\IPMon32.exe"

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);c:\winnt\system32\DRIVERS\SONYPVM1.SYS [2006-12-27 28224]
R2 DLPORTIO;DLPORTIO;\??\c:\winnt\DLPORTIO.sys [2008-10-06 3584]
R2 EarthLinkMonitor;EarthLink Monitor Service;"c:\program files\EarthLink TotalAccess\WENGINE\wmonitor.exe" [2005-01-26 65604]
R2 Pervasive.SQL Workgroup Engine;Pervasive.SQL Workgroup Engine;c:\winnt\system32\srvany.exe [2007-07-27 13864]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\DRIVERS\el90xbc5.sys [2006-12-21 61712]
S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;c:\winnt\system32\drivers\CoachCap.sys [2002-03-03 93068]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\winnt\system32\DRIVERS\ADSFilter.sys []
S3 BT2KNDFL;Bluetooth LAN Access Server Driver - Filter;c:\winnt\system32\DRIVERS\bt2kndfl.sys [2007-05-29 3879]
S3 BW2NDIS5;BW2NDIS5;c:\winnt\system32\Drivers\BW2NDIS5.sys [2004-11-01 17536]
S3 ITFYXQFNUTBQRQ;ITFYXQFNUTBQRQ;c:\docume~1\Mitch\LOCALS~1\Temp\ITFYXQFNUTBQRQ.exe []
S3 KGHLVNHB;KGHLVNHB;c:\docume~1\Mitch\LOCALS~1\Temp\KGHLVNHB.exe []
S3 LKMQYXVEFVO;LKMQYXVEFVO;c:\docume~1\Mitch\LOCALS~1\Temp\LKMQYXVEFVO.exe []
S3 OTPSFGQGFAP;OTPSFGQGFAP;c:\docume~1\Mitch\LOCALS~1\Temp\OTPSFGQGFAP.exe []
S3 SetupSys;Conexant Setup API;c:\winnt\system32\drivers\SetupSys.sys [2006-12-29 8811]
S3 TRUQPOC;TRUQPOC;c:\docume~1\Mitch\LOCALS~1\Temp\TRUQPOC.exe []
S3 VHXZWYH;VHXZWYH;c:\docume~1\Mitch\LOCALS~1\Temp\VHXZWYH.exe []
S3 VXLKSF;VXLKSF;c:\docume~1\Mitch\LOCALS~1\Temp\VXLKSF.exe []
S3 YJVZM;YJVZM;c:\docume~1\Mitch\LOCALS~1\Temp\YJVZM.exe []
S4 BOFHWEDNJ;BOFHWEDNJ;c:\docume~1\Mitch\LOCALS~1\Temp\BOFHWEDNJ.exe []
S4 JEHTM;JEHTM;c:\docume~1\Mitch\LOCALS~1\Temp\JEHTM.exe []
.
Contents of the 'Scheduled Tasks' folder

2008-11-10 c:\winnt\Tasks\SyncBack Darlene Sync.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-13 c:\winnt\Tasks\SyncBack Mitch Backup.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-12 c:\winnt\Tasks\SyncBack Palm Documents.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]

2008-11-08 c:\winnt\Tasks\SyncBack PeachTree Backup.job
- c:\program files\2BrightSparks\SyncBack\SyncBack.exe [08-08-12 11:00 ]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 12:03:55
Windows 5.0.2195 Service Pack 4 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Iomega Activity Disk2]
"ImagePath"="\"\""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(220)
c:\winnt\system32\wzcdlg.dll
c:\winnt\system32\WZCSAPI.DLL

- - - - - - - > 'lsass.exe'(260)
c:\program files\EarthLink TotalAccess\Accelerator\prplsf.dll
.
Completion time: 2008-11-25 12:11:35 - machine was rebooted [Mitch]
ComboFix-quarantined-files.txt 2008-11-25 18:11:21

Pre-Run: 2,073,460,736 bytes free
Post-Run: 2,065,510,400 bytes free

267 --- E O F --- 2008-11-09 09:00:48

HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:25:31 PM, on 11/25/2008
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\LEXPPS.EXE
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\PROGRA~1\Iomega\System32\AppServices.exe
C:\WINNT\system32\srvany.exe
C:\pvsw\bin\w3dbsmgr.exe
C:\WINNT\system32\PSIService.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINNT\system32\faxsvc.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\WINNT\explorer.exe
C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie/button/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.drudgereport.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [Lexmark 1200 Series] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [TomTomHOME.exe] "C:\Program Files\TomTom HOME 2\HOMERunner.exe"
O4 - HKCU\..\Run: [Weather] C:\Program Files\AWS\WeatherBug\Weather.exe 1
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [E6TaskPanel] "C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" -winstart
O4 - Startup: LifeDrive™ Manager.lnk = C:\Program Files\palmOne\LifeDriveMgrTray.exe
O4 - Global Startup: DataViz Inc Messenger.lnk = C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
O4 - Global Startup: HotSync Manager.lnk = C:\Program Files\palmOne\Hotsync.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\IOGEAR\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} (ScrabbleCubes Control) - http://www.worldwinner.com/games/v46/scrabblecubes/scrabblecubes.cab
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/us/kavwebscan_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} (FunGamesLoader Object) - http://gsn.worldwinner.com/games/v47/shared/FunGamesLoader.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) -
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/download/scanner/wlscbase5036.cab
O16 - DPF: {615F158E-D5CA-422F-A8E7-F6A5EED7063B} (Bejeweled Control) - http://www.worldwinner.com/games/v46/bejeweled/bejeweled.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1166762007824
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1167023014377
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CF969D51-F764-4FBF-9E90-475248601C8A} (FamilyFeud Control) - http://www.worldwinner.com/games/v47/familyfeud/familyfeud.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: DvpApi (dvpapi) - Command Software Systems, Inc. - C:\Program Files\Common Files\Command Software\dvpapi.exe
O23 - Service: EarthLink Monitor Service (EarthLinkMonitor) - Boingo Wireless, Inc. - C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe
O23 - Service: ITFYXQFNUTBQRQ - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\ITFYXQFNUTBQRQ.exe (file missing)
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe (file missing)
O23 - Service: KGHLVNHB - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\KGHLVNHB.exe (file missing)
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINNT\system32\LEXBCES.EXE
O23 - Service: LKMQYXVEFVO - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\LKMQYXVEFVO.exe (file missing)
O23 - Service: OTPSFGQGFAP - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\OTPSFGQGFAP.exe (file missing)
O23 - Service: Pervasive.SQL Workgroup Engine - Unknown owner - C:\WINNT\system32\srvany.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINNT\system32\PSIService.exe
O23 - Service: TRUQPOC - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\TRUQPOC.exe (file missing)
O23 - Service: VHXZWYH - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\VHXZWYH.exe (file missing)
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINNT\system32\ZoneLabs\vsmon.exe
O23 - Service: VXLKSF - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\VXLKSF.exe (file missing)
O23 - Service: YJVZM - Unknown owner - C:\DOCUME~1\Mitch\LOCALS~1\Temp\YJVZM.exe (file missing)
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

--
End of file - 11012 bytes

Blade81 · Nov 26, 2008

Hi

Rename ComboFix.exe -> ComboFxx.exe and try running it again.

Have you run Rootkit Revealer or any other tool not meantioned in my previous reply?

Rjhem · Nov 30, 2008

Results

Hi,

Combofix will still not run in regular mode.

I had used or ran avira rootkit tool but i dont think i fixed any thing with it. I believe it was before trying this route.

Thanks

Blade81 · Nov 30, 2008

Hi

Locate if present the following file & delete it:

C:\windows\ntbtlog.txt

Restart the computer
Just before the OS loading screen starts hit F8 as if going to safe mode.
From the advanced boot menu choose "enable boot logging" then hit enter.
Post the following file:

C:\windows\ntbtlog.txt

Rjhem · Nov 30, 2008

Log File

Service Pack 411 30 2008 14:11:05.500
Loaded driver \WINNT\System32\ntoskrnl.exe
Loaded driver \WINNT\System32\hal.dll
Loaded driver \WINNT\System32\BOOTVID.dll
Loaded driver ACPI.sys
Loaded driver \WINNT\System32\DRIVERS\WMILIB.SYS
Loaded driver pci.sys
Loaded driver isapnp.sys
Loaded driver pciide.sys
Loaded driver \WINNT\System32\DRIVERS\PCIIDEX.SYS
Loaded driver intelide.sys
Loaded driver MountMgr.sys
Loaded driver ftdisk.sys
Loaded driver Diskperf.sys
Loaded driver dmload.sys
Loaded driver dmio.sys
Loaded driver PartMgr.sys
Loaded driver atapi.sys
Loaded driver disk.sys
Loaded driver \WINNT\System32\DRIVERS\CLASSPNP.SYS
Loaded driver fltmgr.sys
Loaded driver KSecDD.sys
Loaded driver Ntfs.sys
Loaded driver NDIS.sys
Loaded driver srescan.sys
Loaded driver SONYPVM1.SYS
Loaded driver Mup.sys
Loaded driver iomdisk.sys
Loaded driver \SystemRoot\system32\DRIVERS\i81xnt5.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSFHWBS2.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSF_DP.sys
Loaded driver \SystemRoot\system32\DRIVERS\HSF_CNXT.sys
Loaded driver \SystemRoot\System32\Drivers\Modem.SYS
Loaded driver \SystemRoot\System32\DRIVERS\el90xbc5.sys
Loaded driver \SystemRoot\System32\DRIVERS\fdc.sys
Loaded driver \SystemRoot\System32\DRIVERS\i8042prt.sys
Loaded driver \SystemRoot\System32\DRIVERS\kbdclass.sys
Loaded driver \SystemRoot\System32\DRIVERS\mouclass.sys
Loaded driver \SystemRoot\System32\DRIVERS\serial.sys
Loaded driver \SystemRoot\System32\DRIVERS\serenum.sys
Loaded driver \SystemRoot\System32\DRIVERS\parport.sys
Loaded driver \SystemRoot\System32\Drivers\Cdr4_2K.SYS
Loaded driver \SystemRoot\System32\DRIVERS\cdrom.sys
Loaded driver \SystemRoot\System32\Drivers\Cdralw2k.SYS
Loaded driver \SystemRoot\System32\DRIVERS\uhcd.sys
Loaded driver \SystemRoot\system32\drivers\smwdm.sys
Loaded driver \SystemRoot\system32\DRIVERS\btkrnl.sys
Loaded driver \SystemRoot\System32\DRIVERS\audstub.sys
Loaded driver \SystemRoot\System32\DRIVERS\rasl2tp.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndistapi.sys
Loaded driver \SystemRoot\System32\DRIVERS\ndiswan.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspptp.sys
Loaded driver \SystemRoot\System32\DRIVERS\ptilink.sys
Loaded driver \SystemRoot\System32\DRIVERS\raspti.sys
Loaded driver \SystemRoot\System32\DRIVERS\parallel.sys
Loaded driver \SystemRoot\System32\DRIVERS\swenum.sys
Loaded driver \SystemRoot\System32\DRIVERS\update.sys
Loaded driver \SystemRoot\System32\DRIVERS\flpydisk.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbhub.sys
Loaded driver \SystemRoot\system32\drivers\btaudio.sys
Loaded driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\System32\Drivers\EFS.SYS
Did not load driver \SystemRoot\System32\Drivers\NDProxy.SYS
Loaded driver \SystemRoot\System32\DRIVERS\usbscan.sys
Loaded driver \SystemRoot\System32\DRIVERS\usbprint.sys
Loaded driver \SystemRoot\System32\DRIVERS\USBSTOR.SYS
Did not load driver \SystemRoot\System32\Drivers\lbrtfdc.SYS
Did not load driver \SystemRoot\System32\Drivers\Sfloppy.SYS
Did not load driver \SystemRoot\System32\Drivers\Changer.SYS
Did not load driver \SystemRoot\System32\Drivers\Cdaudio.SYS
Loaded driver \SystemRoot\System32\Drivers\Fs_Rec.SYS
Loaded driver \SystemRoot\System32\Drivers\Null.SYS
Did not load driver \SystemRoot\System32\Drivers\Beep.SYS
Loaded driver \SystemRoot\System32\DRIVERS\AvgAsCln.sys
Did not load driver \SystemRoot\System32\DRIVERS\kbdhid.sys
Did not load driver \SystemRoot\System32\Drivers\sglfb.SYS
Did not load driver \SystemRoot\System32\Drivers\tga.SYS
Loaded driver \SystemRoot\System32\drivers\vga.sys
Loaded driver \SystemRoot\System32\Drivers\mnmdd.SYS
Loaded driver \SystemRoot\System32\Drivers\Msfs.SYS
Loaded driver \SystemRoot\System32\Drivers\Npfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\rasacd.sys
Loaded driver \SystemRoot\System32\DRIVERS\msgpc.sys
Loaded driver \SystemRoot\System32\DRIVERS\tcpip.sys
Loaded driver \SystemRoot\System32\DRIVERS\wanarp.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbt.sys
Loaded driver \SystemRoot\System32\vsdatant.sys
Loaded driver \SystemRoot\System32\DRIVERS\netbios.sys
Did not load driver \SystemRoot\System32\Drivers\PCIDump.SYS
Loaded driver \SystemRoot\system32\DRIVERS\ssmdrv.sys
Did not load driver \SystemRoot\System32\DRIVERS\redbook.sys
Loaded driver \SystemRoot\System32\DRIVERS\rdbss.sys
Loaded driver \SystemRoot\SYSTEM32\DRIVERS\OMCI.SYS
Loaded driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\system32\DRIVERS\avipbb.sys
Loaded driver \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys
Loaded driver \??\C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.sys
Loaded driver \SystemRoot\System32\drivers\ws2ifsl.sys
Loaded driver \SystemRoot\System32\drivers\afd.sys
Loaded driver \SystemRoot\System32\Drivers\ParVdm.SYS
Loaded driver \SystemRoot\system32\drivers\wdmaud.sys
Loaded driver \SystemRoot\system32\drivers\sysaudio.sys
Loaded driver \SystemRoot\system32\drivers\swmidi.sys
Loaded driver \SystemRoot\system32\drivers\DMusic.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys
Loaded driver \??\C:\WINNT\system32\drivers\btserial.sys
Did not load driver \SystemRoot\system32\drivers\CoachCap.sys
Loaded driver \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys
Loaded driver \SystemRoot\System32\Drivers\Fastfat.SYS
Loaded driver \SystemRoot\system32\DRIVERS\css-dvp.sys
Loaded driver \??\C:\WINNT\DLPORTIO.sys
Loaded driver \SystemRoot\System32\Drivers\Fips.SYS
Loaded driver \SystemRoot\system32\DRIVERS\mdmxsdk.sys
Did not load driver \SystemRoot\System32\DRIVERS\rdbss.sys
Did not load driver \SystemRoot\System32\DRIVERS\mrxsmb.sys
Loaded driver \SystemRoot\System32\DRIVERS\srv.sys
Did not load driver \SystemRoot\System32\Drivers\Fastfat.SYS
Loaded driver \SystemRoot\System32\Drivers\Cdfs.SYS
Loaded driver \SystemRoot\System32\DRIVERS\ipnat.sys
Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys
Did not load driver \SystemRoot\System32\DRIVERS\ipnat.sys
Loaded driver \SystemRoot\System32\DRIVERS\ipsec.sys
Loaded driver \SystemRoot\system32\drivers\kmixer.sys

Blade81 · Nov 30, 2008

Hi again,

Download DDS and save it to your desktop.

Disable any script blocker, and then double click dds.scr to run the tool.

* When done, DDS.txt will open.
* Click Yes at the next prompt for Optional Scan.
* Save both reports to your desktop.

Post back the contents of DDS.txt and Attach.txt

Rjhem · Dec 1, 2008

Logs

DDS (Version 1.0) - NTFSx86
Run by Mitch at 22:14:09.81 on Sun 2008-11-30
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.510.247 [GMT -6:00]

============== Running Processes ===============

C:\WINNT\system32\ZoneLabs\vsmon.exe
C:\WINNT\system32\LEXBCES.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\IOGEAR\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\Command Software\dvpapi.exe
C:\Program Files\EarthLink TotalAccess\WENGINE\wmonitor.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\srvany.exe
C:\pvsw\bin\w3dbsmgr.exe
C:\WINNT\system32\PSIService.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\snmp.exe
C:\WINNT\system32\stisvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\mspmspsv.exe
C:\Program Files\Iomega\AutoDisk\ADService.exe
C:\WINNT\system32\faxsvc.exe
C:\WINNT\Explorer.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\WINNT\system32\spool\drivers\w32x86\3\hpztsb04.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINNT\system32\lexpps.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\CCleaner\ccleaner.exe
C:\Program Files\TomTom HOME 2\HOMERunner.exe
C:\Program Files\AWS\WeatherBug\Weather.exe
C:\Program Files\EarthLink TotalAccess\TaskPanl.exe
C:\Program Files\IOGEAR\Bluetooth Software\BTTray.exe
C:\Program Files\Common Files\DataViz\DvzIncMsgr.exe
C:\Program Files\palmOne\Hotsync.exe
C:\Program Files\palmOne\LifeDriveMgrTray.exe
C:\PROGRA~1\MICROS~3\Office\OUTLOOK.EXE
C:\Program Files\palmOne\PalmOneLiveConnect.exe
C:\Documents and Settings\Mitch\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.drudgereport.com/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.earthlink.net/partner/more/msie/button/search.html
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - c:\program files\earthlink totalaccess\ElnIE.dll
BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll
BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
TB: {8E718888-423F-11D2-876E-00A0C9082467} - c:\winnt\system32\msdxm.ocx
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
TB: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ccleaner] "c:\program files\ccleaner\ccleaner.exe" /AUTO
uRun: [TomTomHOME.exe] "c:\program files\tomtom home 2\HOMERunner.exe"
uRun: [Weather] c:\program files\aws\weatherbug\Weather.exe 1
uRun: [E6TaskPanel] "c:\program files\earthlink totalaccess\TaskPanl.exe" -winstart
mRun: [Synchronization Manager] mobsync.exe /logon
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [HPDJ Taskbar Utility] c:\winnt\system32\spool\drivers\w32x86\3\hpztsb04.exe
mRun: [Lexmark 1200 Series] "c:\program files\lexmark 1200 series\lxczbmgr.exe"
mRun: [TrojanScanner] c:\program files\trojan remover\Trjscan.exe /boot
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [PeachtreePrefetcher.exe] "c:\progra~1\sageso~1\peacht~1\PeachtreePrefetcher.exe" /configfile

eachtreeprefetcher.winstart.config
StartupFolder: c:\docume~1\mitch\startm~1\programs\startup\lifedr~1.lnk - c:\program files\palmone\LifeDriveMgrTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\iogear\bluetooth software\BTTray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\datavi~1.lnk - c:\program files\common files\dataviz\DvzIncMsgr.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hotsyn~1.lnk - c:\program files\palmone\Hotsync.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: Send to &Bluetooth Device... - c:\program files\iogear\bluetooth software\btsendto_ie_ctx.htm
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: c:\program files\earthlink totalaccess\accelerator\prplsf.dll
LSP: %SystemRoot%\system32\msafd.dll
Handler: vnd.ms.radio - {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - c:\winnt\system32\msdxm.ocx
SSODL: Network.ConnectionTray - {7007ACCF-3202-11D1-AAD2-00805FC1270E} - c:\winnt\system32\NETSHELL.dll
SEH: {57B86673-276A-48B2-BAE7-C6DBB3020EB8} - c:\program files\grisoft\avg anti-spyware 7.5\shellexecutehook.dll

============= SERVICES / DRIVERS ===============

R0 SONYPVM1;Sony Memory Stick Driver(SONYPVM1);c:\winnt\system32\drivers\SONYPVM1.SYS [2006-12-27 28224]
R2 DLPORTIO;DLPORTIO;\??\c:\winnt\DLPORTIO.sys [2008-10-6 3584]
R2 EarthLinkMonitor;EarthLink Monitor Service;"c:\program files\earthlink totalaccess\wengine\wmonitor.exe" [2005-1-26 65604]
R2 Iprip;RIP Listener;c:\winnt\system32\svchost.exe -k netsvcs [2001-5-8 7952]
R2 Pervasive.SQL Workgroup Engine;Pervasive.SQL Workgroup Engine;c:\winnt\system32\srvany.exe [2007-7-27 13864]
R3 EL90BC;3Com EtherLink XL B/C Adapter Driver;c:\winnt\system32\drivers\el90xbc5.sys [2006-12-21 61712]
S1 sglfb;sglfb; []
S1 tga;tga; []
S2 CoachCap;Concord EyeQ Duo 2000 USB Video Capture V1.00;c:\winnt\system32\drivers\CoachCap.sys [2002-3-3 93068]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);c:\winnt\system32\drivers\ADSFilter.sys []
S3 BT2KNDFL;Bluetooth LAN Access Server Driver - Filter;c:\winnt\system32\drivers\bt2kndfl.sys [2007-5-29 3879]
S3 BW2NDIS5;BW2NDIS5;c:\winnt\system32\drivers\BW2NDIS5.sys [2004-11-1 17536]
S3 ITFYXQFNUTBQRQ;ITFYXQFNUTBQRQ;c:\docume~1\mitch\locals~1\temp\ITFYXQFNUTBQRQ.exe []
S3 KGHLVNHB;KGHLVNHB;c:\docume~1\mitch\locals~1\temp\KGHLVNHB.exe []
S3 LKMQYXVEFVO;LKMQYXVEFVO;c:\docume~1\mitch\locals~1\temp\LKMQYXVEFVO.exe []
S3 OTPSFGQGFAP;OTPSFGQGFAP;c:\docume~1\mitch\locals~1\temp\OTPSFGQGFAP.exe []
S3 SetupSys;Conexant Setup API;c:\winnt\system32\drivers\SetupSys.sys [2006-12-29 8811]
S3 TRUQPOC;TRUQPOC;c:\docume~1\mitch\locals~1\temp\TRUQPOC.exe []
S3 VHXZWYH;VHXZWYH;c:\docume~1\mitch\locals~1\temp\VHXZWYH.exe []
S3 VXLKSF;VXLKSF;c:\docume~1\mitch\locals~1\temp\VXLKSF.exe []
S3 YJVZM;YJVZM;c:\docume~1\mitch\locals~1\temp\YJVZM.exe []
S4 aic116x;aic116x; []
S4 ami0nt;ami0nt; []
S4 BOFHWEDNJ;BOFHWEDNJ;c:\docume~1\mitch\locals~1\temp\BOFHWEDNJ.exe []
S4 cpqarry2;cpqarry2; []
S4 cpqfcalm;cpqfcalm; []
S4 cpqfws2e;cpqfws2e; []
S4 deckzpsx;deckzpsx; []
S4 Fd16_700;Fd16_700; []
S4 fireport;fireport; []
S4 flashpnt;flashpnt; []
S4 ipsraidn;ipsraidn; []
S4 JEHTM;JEHTM;c:\docume~1\mitch\locals~1\temp\JEHTM.exe []
S4 lp6nds35;lp6nds35; []
S4 Ncrc710;Ncrc710; []
S4 ql2100;ql2100; []
S4 ultra66;ultra66; []

=============== Created Last 30 ================

2008-11-30 22:14 16,384 a------t c:\winnt\system32\Perflib_Perfdata_4d8.dat
2008-11-30 22:10 <DIR> --d-h--- c:\winnt\PIF
2008-11-28 20:49 16,384 a------t c:\winnt\system32\Perflib_Perfdata_450.dat
2008-11-28 10:45 16,384 a------t c:\winnt\system32\Perflib_Perfdata_43c.dat
2008-11-28 10:27 16,384 a------t c:\winnt\system32\Perflib_Perfdata_974.dat
2008-11-27 10:01 75,248 a------- c:\winnt\zllsputility.exe
2008-11-27 09:59 1,086,952 a------- c:\winnt\system32\zpeng24.dll
2008-11-27 09:59 <DIR> --d----- c:\winnt\system32\ZoneLabs
2008-11-27 09:59 <DIR> --d----- c:\program files\Zone Labs
2008-11-27 09:59 352,918 a------- c:\winnt\system32\vsconfig.xml
2008-11-26 21:31 <DIR> --d----- c:\program files\Avira
2008-11-26 21:31 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2008-11-26 19:58 452 a------- C:\temp00.dat
2008-11-26 19:54 236,816 a------- c:\winnt\system32\CF21814.exe
2008-11-26 19:54 <DIR> --d----- C:\ComboFxx
2008-11-26 19:53 0 a------- C:\__tmp_rar_sfx_access_check_3969177
2008-11-26 19:50 0 a------- C:\test0123
2008-11-26 19:49 194 a------- C:\Start_.cmd
2008-11-26 19:49 0 a------- C:\__tmp_rar_sfx_access_check_3702784
2008-11-26 19:47 0 a------- C:\__tmp_rar_sfx_access_check_3595960
2008-11-26 19:46 0 a------- C:\__tmp_rar_sfx_access_check_3532629
2008-11-26 10:22 0 a------- C:\__tmp_rar_sfx_access_check_248136
2008-11-26 09:46 0 a------- C:\__tmp_rar_sfx_access_check_1275143
2008-11-26 09:38 0 a------- C:\__tmp_rar_sfx_access_check_790025
2008-11-26 09:37 0 a------- C:\__tmp_rar_sfx_access_check_739152
2008-11-26 09:33 0 a------- C:\__tmp_rar_sfx_access_check_477486
2008-11-26 09:32 0 a------- C:\__tmp_rar_sfx_access_check_436087
2008-11-26 09:31 0 a------- C:\__tmp_rar_sfx_access_check_372345
2008-11-26 09:22 0 a------- C:\~GLHTTP1.TMP
2008-11-26 09:19 197,976 a----r-- c:\winnt\cpnprt2.cid
2008-11-25 11:55 0 a------- C:\__tmp_rar_sfx_access_check_1503692
2008-11-25 11:41 0 a------- C:\__tmp_rar_sfx_access_check_668541
2008-11-25 11:16 0 a------- C:\__tmp_rar_sfx_access_check_1288042
2008-11-25 10:38 161,792 a------- c:\winnt\SWREG.exe
2008-11-25 10:38 98,816 a------- c:\winnt\sed.exe
2008-11-25 10:37 0 a------- C:\__tmp_rar_sfx_access_check_39215899
2008-11-25 10:36 0 a------- C:\__tmp_rar_sfx_access_check_39128203
2008-11-25 10:32 0 a------- C:\__tmp_rar_sfx_access_check_38891793
2008-11-25 10:23 0 a------- C:\__tmp_rar_sfx_access_check_38395449
2008-11-25 10:23 0 a------- C:\__tmp_rar_sfx_access_check_38349914
2008-11-25 10:19 0 a------- C:\__tmp_rar_sfx_access_check_38135736
2008-11-18 09:12 <DIR> --d----- C:\MSIdeefa.tmp
2008-11-16 11:49 30,590 a------- c:\winnt\system32\pavas.ico
2008-11-16 11:49 <DIR> --d----- c:\winnt\system32\ActiveScan
2008-11-15 06:23 <DIR> --d----- c:\program files\Avira GmbH
2008-11-15 04:35 <DIR> --d----- C:\MSI1d880.tmp
2008-11-14 22:09 250 a------- c:\winnt\gmer.ini
2008-11-14 17:21 105,738 a------- C:\ComboFix_error.dat
2008-11-14 16:43 1,196,468 ----h--- c:\winnt\ShellIconCache
2008-11-11 08:01 410,976 a------- c:\winnt\system32\deploytk.dll
2008-11-11 08:00 <DIR> --d----- C:\MSI9f2aa.tmp
2008-11-11 07:57 73,728 a------- c:\winnt\system32\javacpl.cpl
2008-11-10 19:56 <DIR> --d----- c:\docume~1\mitch\applic~1\Malwarebytes
2008-11-10 19:56 15,504 a------- c:\winnt\system32\drivers\mbam.sys
2008-11-10 19:56 38,496 a------- c:\winnt\system32\drivers\mbamswissarmy.sys
2008-11-10 19:55 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2008-11-10 19:55 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2008-11-10 10:10 <DIR> --d----- c:\program files\Black List Software
2008-11-09 22:56 81,984 a------- c:\winnt\system32\bdod.bin
2008-11-09 19:23 <DIR> --d----- c:\docume~1\alluse~1\applic~1\BitDefender
2008-11-09 19:22 <DIR> --d----- c:\program files\common files\Softwin
2008-11-09 18:38 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab Setup Files
2008-11-09 16:02 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2008-11-08 22:31 <DIR> --d----- c:\program files\Trojan Remover

==================== Find3M ====================

2008-11-30 22:07 <DIR> a-d----- c:\docume~1\mitch\applic~1\WeatherBug
2008-11-27 10:32 4,212 ----h--- c:\winnt\system32\zllictbl.dat
2008-11-26 09:22 <DIR> --d----- c:\program files\Yahoo!
2008-11-26 09:19 <DIR> --d----- c:\program files\Coupons
2008-11-25 09:47 <DIR> --d----- c:\program files\Quicken Legal Business Pro 2007
2008-11-24 10:11 <DIR> --d----- c:\program files\palmOne
2008-11-20 09:32 <DIR> --d----- c:\program files\EarthLink TotalAccess
2008-11-20 09:27 <DIR> --d----- c:\program files\common files\EarthLink
2008-11-16 23:26 <DIR> --d----- c:\program files\Viewpoint
2008-11-16 23:26 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Viewpoint
2008-11-16 13:21 <DIR> --d----- c:\program files\TomTom HOME 2
2008-11-16 13:01 <DIR> --d----- c:\program files\Lexmark 1200 Series
2008-11-16 12:50 <DIR> --d----- c:\program files\common files\Command Software
2008-11-16 12:08 <DIR> --d----- c:\program files\common files\DataViz
2008-11-16 12:07 <DIR> --d----- c:\program files\Active Ports
2008-11-14 16:41 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2008-11-12 08:49 <DIR> --d----- c:\program files\Documents To Go
2008-11-10 19:56 <DIR> --d----- c:\program files\Trend Micro
2008-11-10 19:35 <DIR> --d----- c:\program files\Spybot - Search & Destroy
2008-11-10 08:46 <DIR> a-d-h--- c:\program files\WindowsUpdate
2008-11-09 16:06 <DIR> --d----- c:\program files\Lavasoft
2008-11-08 22:31 <DIR> --d----- c:\docume~1\mitch\applic~1\Simply Super Software
2008-10-16 14:06 268,648 a------- c:\winnt\system32\mucltui.dll
2008-10-16 14:06 208,744 a------- c:\winnt\system32\muweb.dll
2008-10-08 18:23 <DIR> --d----- c:\program files\hp deskjet 950c series
2008-10-07 17:04 <DIR> --d----- c:\program files\OpenOffice.org 3
2008-10-07 12:04 1,901 a------- c:\winnt\panose.bin
2008-10-07 06:01 1,636 a------- c:\winnt\system32\d3d9caps.dat
2008-10-07 05:57 <DIR> --d----- c:\docume~1\mitch\applic~1\OpenOffice.org
2008-10-06 21:18 34,816 a------- c:\winnt\system32\Dlportio.dll
2008-10-06 21:18 27,460 a------- c:\winnt\system32\loaddrv.exe
2008-10-06 21:18 3,584 a------- c:\winnt\Dlportio.sys
2008-09-30 17:58 <DIR> --d----- c:\docume~1\alluse~1\applic~1\PC Drivers HeadQuarters
2008-09-30 16:43 1,286,152 a------- c:\winnt\system32\msxml4.dll
2008-09-14 23:13 1,644,432 a------- c:\winnt\system32\WIN32K.SYS
2008-09-08 02:14 1,121,280 a------- c:\winnt\system32\msxml3.dll
2008-09-02 10:34 <DIR> --d----- c:\docume~1\mitch\applic~1\CoffeeCup Software
2008-07-10 20:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Lavasoft
2008-06-25 16:29 <DIR> --d----- c:\docume~1\mitch\applic~1\LimeWire
2008-04-21 07:22 <DIR> --d----- c:\docume~1\mitch\applic~1\MySpace
2008-02-19 19:22 <DIR> --d----- c:\docume~1\alluse~1\applic~1\TomTom
2008-02-19 19:22 <DIR> --d----- c:\docume~1\mitch\applic~1\TomTom
2007-12-15 13:39 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Corel
2007-10-05 14:45 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\Simply Super Software
2007-10-02 21:51 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Kaspersky Lab
2007-09-27 22:53 <DIR> --d----- c:\docume~1\mitch\applic~1\Viewpoint
2007-08-26 15:17 <DIR> --d----- c:\docume~1\mitch\applic~1\Nvu
2007-08-16 20:36 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\BVRP Software
2007-07-31 20:17 <DIR> --d----- c:\docume~1\mitch\applic~1\Peachtree
2007-06-14 21:59 <DIR> a-d----- c:\docume~1\mitch\applic~1\Earthlink
2007-05-29 20:35 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avanquest Software
2007-02-02 13:52 <DIR> a-d----- c:\docume~1\mitch\applic~1\RecordPad
2007-02-02 13:52 <DIR> a-d----- c:\docume~1\mitch\applic~1\NCH Swift Sound
2007-02-02 13:52 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\NCH Swift Sound
2007-01-10 13:06 <DIR> a-d----- c:\docume~1\mitch\applic~1\Nova Development
2007-01-10 13:05 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\Nova Development
2007-01-05 09:28 <DIR> a-d----- c:\docume~1\mitch\applic~1\TrojanHunter
2006-12-27 13:01 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\Intuit
2006-12-27 13:00 <DIR> a-d----- c:\docume~1\mitch\applic~1\Intuit
2006-12-25 01:54 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\Visual Networks
2006-12-24 18:47 <DIR> a-d----- c:\docume~1\alluse~1\applic~1\DataViz
2006-12-24 16:10 <DIR> a-d----- c:\docume~1\mitch\applic~1\ScamBlocker
2006-12-24 14:11 <DIR> a-d----- c:\docume~1\mitch\applic~1\HotSync
2006-12-21 15:33 1,894 a--sh--- c:\winnt\rreg32.dll
2006-12-21 15:33 5,482 a--sh--- c:\winnt\utapi32.dll
2002-07-31 18:55 104 ---sh--- c:\winnt\WSYS049.SYS
2008-02-15 22:59 88 ---shr-- c:\winnt\system32\8F2E2DE3A7.sys
2008-02-15 22:59 2,672 a--sh--- c:\winnt\system32\KGyGaAvL.sys

============= FINISH: 22:15:51.86 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Version 1.0)

Microsoft Windows 2000 Professional
Boot Device: \Device\Harddisk0\Partition1
Install Date:
System Uptime: 2008-11-30 8:11:05 AM (14 hours ago)

Motherboard: Dell Computer Corporation | | OptiPlex GX150
Processor: Intel Celeron processor | Microprocessor | 1096/100mhz
BIOS: Default System BIOS | Phoenix ROM BIOS PLUS Version 1.10 A09 | A09 |

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 19 GiB total, 1.904 GiB free.
D: is CDROM ()
F: is FIXED (NTFS) - 186 GiB total, 172.932 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

No restore point in system.

==== Installed Programs ======================

7-Zip 4.57
ABBYY FineReader 5.0 Sprint
Access Drivers
Active Disk
Active Ports
Ad-Aware
Adobe Acrobat 6.0.1 Professional - English, Français, Deutsch
Adobe Acrobat and Reader 6.0.3 Update
Adobe Acrobat and Reader 6.0.4 Update
Adobe Acrobat and Reader 6.0.5 Update
Adobe Acrobat and Reader 6.0.6 Update
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player ActiveX
Adobe PageMaker 7.0
Adobe Reader 7.0.5
Adobe Reader 8.1.1
Adobe Reader 8.1.2
Adobe Reader 8.1.2 Security Update 1 (KB403742)
Adobe Reader for Palm OS, 3.05
Adobe Shockwave Player
AnswerWorks 5.0 English Runtime
ArcSoft Camera Suite
Assassin SE
Authentium
Avanquest update
AVG Anti-Spyware 7.5
Avira AntiVir Personal - Free Antivirus
Avira RootKit Detection
CCleaner (remove only)
CoffeeCup HTML Editor 2008
CoffeeCup Visual Site Designer Software
CoffeeCup Web Form Builder - Registered
Concord EyeQ Duo 2000 Digital Camera
Concord EyeQ Duo 2000 Memory Browser TWAIN Driver V1.00
Coupon Printer for Windows
Deal Info
Dell ResourceCD
Documents To Go
DSound GT Player Express
DTCLookup
EarthLink Accelerator
EarthLink Common Authentication
EarthLink FastLane
EarthLink MailBox
EarthLink Software
EarthLink Wireless High Speed
Easy MP3 Sound Recorder 2.01
Express Burn
Express Rip
HijackThis 2.0.2
Hotfix for MDAC 2.80 (KB911562)
Hotfix for MDAC 2.80 (KB927779)
Hotfix for Microsoft .NET Framework 2.0 Service Pack 1 (KB947748)
hp deskjet 950c series
hp deskjet 950c series (Remove only)
IOGEAR Bluetooth Software
IomegaWare 4.0.2
IrfanView (remove only)
J2SE Runtime Environment 5.0 Update 10
Java(TM) 6 Update 10
Java(TM) 6 Update 7
Kaspersky Online Scanner
Lernout & Hauspie TruVoice for Microsoft Agent
Lexmark 1200 Series
Malwarebytes' Anti-Malware
MGI PhotoSuite 8.1 (Remove Only)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 1.1 Hotfix (KB947742)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft MapPoint North America 2004
Microsoft Office 2000 SR-1 Professional
Microsoft XML Parser
Motorola Driver Installation 3.4.0
Motorola Phone Tools
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Nvu 1.0
palmOne
Panda ActiveScan
Peachtree Accounting 2008
Peachtree Pro Accounting 2008
PeachTree Signature Ready Forms
Pervasive Software PSQL v9.1 Client
Pervasive System Analyzer v9.1
Photo Explosion Special Edition
Quicken 2008
Quicken Legal Business Pro 2007
Quicken WillMaker Plus 2005
RecordPad Sound Recorder
Remington Shoot!
Security Update for DirectX 9 (KB941568)
Security Update for DirectX 9 (KB951698)
Security Update for Windows 2000 (KB904706)
Security Update for Windows 2000 (KB923689)
Security Update for Windows 2000 (KB941569)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 7.1 (KB917734)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
SoftV92 Data Fax Modem
Sony USB Driver
SoundMAXWDM
Spybot - Search & Destroy
SyncBack
TomTom HOME
TotalAccess Core Applications
Trojan Remover 6.7.3
Update Rollup 1 for Windows 2000 SP4
VC_MergeModuleToMSI
WavePad Uninstall
WeatherBug
WebFldrs
Windows 2000 Hotfix - KB818801
Windows 2000 Hotfix - KB842773
Windows 2000 Hotfix - KB893756
Windows 2000 Hotfix - KB896358
Windows 2000 Hotfix - KB896422
Windows 2000 Hotfix - KB896423
Windows 2000 Hotfix - KB896424
Windows 2000 Hotfix - KB899587
Windows 2000 Hotfix - KB899589
Windows 2000 Hotfix - KB900725
Windows 2000 Hotfix - KB901017
Windows 2000 Hotfix - KB901214
Windows 2000 Hotfix - KB905414
Windows 2000 Hotfix - KB905495
Windows 2000 Hotfix - KB905749
Windows 2000 Hotfix - KB908519
Windows 2000 Hotfix - KB908531
Windows 2000 Hotfix - KB911280
Windows 2000 Hotfix - KB912919
Windows 2000 Hotfix - KB913580
Windows 2000 Hotfix - KB914388
Windows 2000 Hotfix - KB914389
Windows 2000 Hotfix - KB917008
Windows 2000 Hotfix - KB917422
Windows 2000 Hotfix - KB917537
Windows 2000 Hotfix - KB917736
Windows 2000 Hotfix - KB917953
Windows 2000 Hotfix - KB918118
Windows 2000 Hotfix - KB920213
Windows 2000 Hotfix - KB920670
Windows 2000 Hotfix - KB920683
Windows 2000 Hotfix - KB920685
Windows 2000 Hotfix - KB920958
Windows 2000 Hotfix - KB921398
Windows 2000 Hotfix - KB921503
Windows 2000 Hotfix - KB922582
Windows 2000 Hotfix - KB922616
Windows 2000 Hotfix - KB923191
Windows 2000 Hotfix - KB923414
Windows 2000 Hotfix - KB923694
Windows 2000 Hotfix - KB923810
Windows 2000 Hotfix - KB923980
Windows 2000 Hotfix - KB924191
Windows 2000 Hotfix - KB924270
Windows 2000 Hotfix - KB924667
Windows 2000 Hotfix - KB925454
Windows 2000 Hotfix - KB925486
Windows 2000 Hotfix - KB925902
Windows 2000 Hotfix - KB926122
Windows 2000 Hotfix - KB926247
Windows 2000 Hotfix - KB926436
Windows 2000 Hotfix - KB927891
Windows 2000 Hotfix - KB928090
Windows 2000 Hotfix - KB928843
Windows 2000 Hotfix - KB929969
Windows 2000 Hotfix - KB930178
Windows 2000 Hotfix - KB931768
Windows 2000 Hotfix - KB931784
Windows 2000 Hotfix - KB932168
Windows 2000 Hotfix - KB933566
Windows 2000 Hotfix - KB933729
Windows 2000 Hotfix - KB935839
Windows 2000 Hotfix - KB935840
Windows 2000 Hotfix - KB936021
Windows 2000 Hotfix - KB937143
Windows 2000 Hotfix - KB937894
Windows 2000 Hotfix - KB938127
Windows 2000 Hotfix - KB938464
Windows 2000 Hotfix - KB938827
Windows 2000 Hotfix - KB938829
Windows 2000 Hotfix - KB939653
Windows 2000 Hotfix - KB941202
Windows 2000 Hotfix - KB941644
Windows 2000 Hotfix - KB941693
Windows 2000 Hotfix - KB942615
Windows 2000 Hotfix - KB943055
Windows 2000 Hotfix - KB943485
Windows 2000 Hotfix - KB944338
Windows 2000 Hotfix - KB944533
Windows 2000 Hotfix - KB945553
Windows 2000 Hotfix - KB947864
Windows 2000 Hotfix - KB948590
Windows 2000 Hotfix - KB948881
Windows 2000 Hotfix - KB950749
Windows 2000 Hotfix - KB950759
Windows 2000 Hotfix - KB950760
Windows 2000 Hotfix - KB950974
Windows 2000 Hotfix - KB951066
Windows 2000 Hotfix - KB951748
Windows 2000 Hotfix - KB952954
Windows 2000 Hotfix - KB953838
Windows 2000 Hotfix - KB953839
Windows 2000 Hotfix - KB954211
Windows 2000 Hotfix - KB955069
Windows 2000 Hotfix - KB956390
Windows 2000 Hotfix - KB956391
Windows 2000 Hotfix - KB957095
Windows 2000 Hotfix - KB957097
Windows 2000 Hotfix - KB958644
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Live OneCare safety scanner
Windows Media Player Hotfix [See Q828026 for more information]
Windows Media Player system update (9 Series)
ZoneAlarm
ZoneAlarm Spy Blocker

==== Event Viewer Messages ===================

==== End Of File ===========================

Blade81 · Dec 1, 2008

Hi

Since ComboFix works ok in safe mode but not in normal mode I want to make sure you have disabled all protection software before you've tried to run ComboFix. If that's the case and you're logged in with administrator privileges defrag harddrive and run scandisk (instructions ) to make sure hard drive is ok.

Blade81 · Dec 8, 2008

Due to inactivity, this thread will now be closed.

Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.

Desktop Infected with TR/cryp.xpack.gen and Others

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Rjhem

New member

Blade81

Security Expert: Emeritus

Blade81

Security Expert: Emeritus