emusica and virtumonde removal

[cricket5012000]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:08:12 PM, on 1/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Darin\Local Settings\Temporary Internet Files\Content.IE5\B72T2SUF\HiJackThis[1].exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/?page=1&refresh=2#14345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.velocitymicro.com/
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {9ee802e8-c931-47ab-b570-aa8f791598ca} - (no file)
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0989.0\msneshellx.dll
O3 - Toolbar: (no name) - {9ee802e8-c931-47ab-b570-aa8f791598ca} - (no file)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135016683871
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198427060296
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15034/CTPID.cab
O20 - AppInit_DLLs: yyfykg.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 13220 bytes




thank you for any help ..... i am a novice at all of this so have patience

thank you

Darin

 

[pskelley]

Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.

Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
The junk can be tough to remove, so do not expect fast or easy.

I apologize for the wait, volunteers are swamped at all forums with infected computers. If you have resolved your issues, please post to let me know so I can close this topic.

Darin, my first question (unless you know something here) as important as security is, and I run AVG 8 free myself, why are you runnning an out of date antivirus program? (do not try to update until I tell you to)

C:\Documents and Settings\Darin\Local Settings\Temporary Internet Files\Content.IE5\B72T2SUF\HiJackThis[1].exe <<< delete this copy

1) Please DO NOT ENABLE Spybot S&D TeaTimer while we work together.

2) A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
• See this Link for programs that need to be disabled and instruction on how to disable them.
• Remember to re-enable them when we're done.
  
  
• Double click on ComboFix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

*If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

Tutorial if needed
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

3) Post also an uninstall list: Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your reply.
Image: http://img.bleepingcomputer.com/tutorials/hijackthis/uninstall-man.jpg

Thanks...Phil

 

[cricket5012000]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:03:43 PM, on 1/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\mHotkey.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\imapi.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/?page=1&refresh=2#14345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.velocitymicro.com/
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0989.0\msneshellx.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135016683871
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198427060296
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15034/CTPID.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 12650 bytes




ComboFix 09-01-07.01 - Darin 2009-01-07 18:49:36.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3039.2533 [GMT -5:00]
Running from: c:\documents and settings\Darin\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
c:\docume~1\Darin\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\Darin\LOCALS~1\Temp\tmp2.tmp
c:\documents and settings\Darin\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\GetModule
c:\windows\system32\~.exe
c:\windows\system32\alatizuh.ini
c:\windows\system32\awefulit.ini
c:\windows\system32\behunnja.dll
c:\windows\system32\digeste.dll
c:\windows\system32\dohlyovn.dll
c:\windows\system32\eberutum.ini
c:\windows\system32\efcBrqop.dll
c:\windows\system32\EKQsrqru.ini
c:\windows\system32\EKQsrqru.ini2
c:\windows\system32\fuspib.dll
c:\windows\system32\gcunxd.dll
c:\windows\system32\ggneqr.dll
c:\windows\system32\hjtxsmiq.ini
c:\windows\system32\hyjkfbps.dll
c:\windows\system32\igikbutf.dll
c:\windows\system32\ilaguhik.ini
c:\windows\system32\johabuji.dll
c:\windows\system32\kebikagu.dll
c:\windows\system32\kihugali.dll
c:\windows\system32\kojoyapi.dll
c:\windows\system32\koloetdk.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\muturebe.dll
c:\windows\system32\nigitnvy.ini
c:\windows\system32\nllruhxt.ini
c:\windows\system32\nqftlfof.dll
c:\windows\system32\ribegaja.dll
c:\windows\system32\shyuxasp.ini
c:\windows\system32\tilufewa.dll
c:\windows\system32\txhurlln.dll
c:\windows\system32\urqrsQKE.dll
c:\windows\system32\wpv531229907513.cpx
c:\windows\system32\yyfykg.dll
c:\windows\system32\zvwijj.dll
c:\windows\Temp\tmp3.tmp
c:\windows\wiaserviv.log

.
((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
.

2009-01-07 18:44 . 2009-01-07 18:45 <DIR> d-------- C:\32788R22FWJFW.0.tmp
2009-01-05 18:26 . 2009-01-05 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg7
2009-01-03 17:07 . 2009-01-03 17:07 <DIR> d-------- c:\program files\Trend Micro
2009-01-03 11:55 . 2009-01-03 16:51 207 --a------ c:\windows\wininit.ini
2009-01-03 11:24 . 2009-01-03 11:24 72,192 --a------ c:\windows\system32\tuvSifeb.dll
2009-01-03 11:24 . 2009-01-03 11:24 22,016 --a------ c:\documents and settings\Darin\f.exe
2009-01-01 17:31 . 2009-01-01 17:31 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-01 08:56 . 2006-11-14 07:28 86,016 --a------ c:\windows\system32\cttele.dll
2008-12-31 20:11 . 1999-12-13 01:01 44,032 --a------ c:\windows\system32\CTSVCCDA.EXE
2008-12-31 20:11 . 1999-11-18 01:00 25,088 --a------ c:\windows\system32\CTSVCCTL.EXE
2008-12-31 17:42 . 2009-01-03 16:19 <DIR> d-------- c:\program files\eMusic Download Manager
2008-12-31 17:42 . 2009-01-03 11:55 <DIR> d-------- c:\program files\eMusic
2008-12-31 17:42 . 2008-12-31 17:42 <DIR> d-------- c:\program files\Conduit
2008-12-31 17:42 . 2009-01-03 16:19 <DIR> d-------- c:\documents and settings\Darin\Application Data\eMusic
2008-12-31 17:40 . 2008-12-31 19:18 <DIR> d-------- c:\program files\USB Disk Win98 Driver
2008-12-14 11:50 . 2008-12-14 11:50 <DIR> d-------- c:\documents and settings\Darin\Application Data\InstallShield
2008-12-14 10:49 . 2008-12-14 10:49 754 --a------ c:\windows\WORDPAD.INI
2008-12-11 21:36 . 2008-12-11 21:36 <DIR> d-------- c:\documents and settings\Darin\Application Data\Logitech
2008-12-11 21:36 . 2008-12-11 21:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\LogiShrd
2008-12-11 21:36 . 2008-09-26 09:52 10,384 --a------ c:\windows\system32\drivers\LBeepKE.sys
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2008-12-11 21:35 . 2008-12-11 21:35 <DIR> d-------- c:\program files\Common Files\Logishrd
2008-12-11 21:35 . 2008-11-07 16:37 301,656 --a------ c:\windows\system32\BtCoreIf.dll
2008-12-11 21:35 . 2008-11-07 16:38 170,512 --a------ c:\windows\system32\kemutb.dll
2008-12-11 21:35 . 2008-11-07 16:38 145,936 --a------ c:\windows\system32\KemUtil.dll
2008-12-11 21:35 . 2008-11-07 16:38 117,264 --a------ c:\windows\system32\KemWnd.dll
2008-12-11 21:35 . 2008-11-07 16:38 84,496 --a------ c:\windows\system32\KemXML.dll
2008-12-11 19:45 . 2008-12-11 19:45 410,984 --a------ c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 22:49 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-03 21:19 --------- d-----w c:\program files\Winamp
2009-01-03 03:54 --------- d-----w c:\program files\Google
2009-01-01 14:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-01 14:53 --------- d--h--w c:\program files\Creative Installation Information
2009-01-01 13:56 409,600 ----a-w c:\windows\system32\wrap_oal.dll
2009-01-01 13:56 114,688 ----a-w c:\windows\system32\OpenAL32.dll
2009-01-01 02:41 --------- d-----w c:\program files\Yahoo!
2009-01-01 02:41 --------- d-----w c:\program files\QuickTime
2009-01-01 02:41 --------- d-----w c:\program files\Futuremark
2009-01-01 02:41 --------- d-----w c:\program files\Ahead
2008-12-20 05:10 --------- d-----w c:\program files\Paltalk Messenger
2008-12-17 00:23 952 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-12-12 02:35 --------- d-----w c:\program files\Logitech
2008-12-12 00:45 --------- d-----w c:\program files\Java
2008-11-29 03:45 --------- d-----w c:\documents and settings\Darin\Application Data\gtk-2.0
2008-11-28 19:43 --------- d-----w c:\documents and settings\All Users\Application Data\kds_kodak
2008-11-28 19:38 --------- d-----w c:\documents and settings\All Users\Application Data\Eastman Kodak Company
2008-11-28 19:35 --------- d-----w c:\documents and settings\All Users\Application Data\Kodak
2008-11-28 19:32 --------- d-----w c:\program files\Kodak
2008-11-28 19:20 --------- d-----w c:\program files\Common Files\Kodak
2008-11-23 21:22 --------- d-----w c:\program files\Curse
2008-11-23 19:25 2,996 ----a-w c:\windows\system32\ealregsnapshot1.reg
2008-11-23 18:42 --------- d-----w c:\program files\Electronic Arts
2008-11-18 11:08 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-16 22:47 --------- d-----w c:\documents and settings\Darin\Application Data\Corel
2008-11-16 22:42 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2008-11-16 22:41 --------- d-----w c:\program files\Common Files\Corel
2008-11-16 22:40 --------- d-----w c:\program files\Corel
2008-11-16 22:40 --------- d-----w c:\program files\Common Files\Protexis
2008-11-16 20:14 --------- d-----w c:\documents and settings\Darin\Application Data\Ahead
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-10 19:46 69,632 ----a-w c:\windows\KHALMNPR.Exe
2008-04-13 22:04 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-09-27 13:06 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092720080928\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [2004-11-11 212992]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-02 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2008-08-01 1103216]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-25 1397760]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 32768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-17 2094352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-11 136600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2008-08-08 532808]
"Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-08 16712]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-08-21 1306624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"CHotkey"="mHotkey.exe" [2004-06-11 c:\windows\mHotkey.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 c:\windows\KHALMNPR.Exe]
"CTHelper"="CTHELPER.EXE" [2007-04-09 c:\windows\system32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 c:\windows\system32\Ctxfihlp.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-07-07 282624]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-11 809488]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-11-14 11376640]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 16:41 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R4 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [2008-02-28 18944]
R4 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2008-12-11 10384]

--- Other Services/Drivers In Memory ---

*Deregistered* - InCDrec

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{887017f7-70bb-11da-8737-e6bbe11f7d49}]
\Shell\AutoRun\command - e:\autorun\Demo32.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-07 c:\windows\Tasks\allvokfn.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]

2009-01-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-12-15 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-{9ee802e8-c931-47ab-b570-aa8f791598ca} - (no file)
BHO-{18f46af9-e542-4c96-883f-3a3677bf3f44} - c:\windows\system32\kojoyapi.dll
BHO-{1EDC3C44-0E41-4FBA-A5B1-365522C1BCB3} - c:\windows\system32\urqrsQKE.dll
BHO-{8d1998e5-b0ca-4353-9427-0721a6847729} - c:\windows\system32\fuspib.dll
BHO-{CC143ED8-2489-4981-8904-AD8A303F8B4A} - (no file)
Toolbar-{9ee802e8-c931-47ab-b570-aa8f791598ca} - (no file)
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
WebBrowser-{9EE802E8-C931-47AB-B570-AA8F791598CA} - (no file)


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.velocitymicro.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

c:\windows\Downloaded Program Files\CTSUEng.ocx - c:\windows\Downloaded Program Files\CTSUEngn.ocx
O16 -: {6C269571-C6D7-4818-BCA4-32A035E8C884}
hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
c:\windows\Downloaded Program Files\CTSUEng.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-07 18:55:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-882822723-3580622033-3468076957-1005\Software\SecuROM\License information*NULL*]
"datasecu"=hex:8f,3d,cf,5a,18,e2,da,bb,46,85,74,b4,6f,78,08,54,43,df,77,0f,15,\
97,83,58,0e,05,ed,67,7a,f3,ca,4c,b7,7f,2c,58,e8,39,4a,a9,ea,6b,3c,b1,28,3d,\
ff,91,89,8a,ce,de,f5,c9,64,a8,78,66,5b,19,da,8a,93,17,1c,5b,8a,d0,ff,6e,46,\
1e,14,fe,23,1d,08,05,55,72,ca,bf,39,16,3b,1a,96,81,4c,40,f4,7c,ae,29,24,c8,\
81,68,c2,b4,8e,57,c1,d5,41,8d,18,9b,36,99,f9,c9,b7,86,3f,14,f0,55,7d,02,2b,\
cc,d7,7b,28,39,36,5e,16,b0,a6,1d,8c,53,10,3c,ce,83,52,ee,5f,1b,42,3f,dd,df,\
7d,db,2a,7e,ae,96,fc,fb,e0,d8,05,18,c4,03,20,c4,55,83,b4,c0,a3,04,f0,a5,a4,\
87,bf,6f,44,fc,77,01,06,4f,f2,2d,73,6d,33,d5,9f,2b,9f,0f,81,77,2c,d1,b4,31,\
35,52,8a,d3,92,46,89,1d,e3,82,87,ed,91,e9,24,58,81,64,66,fe,e2,7a,2b,7c,8b,\
b8,83,11,5f,19,20,81,d4,a1,43,15,ae,da,bf,d2,8e,d9,19,d4,d6,b2,d5,2f,29,6a,\
d7,91,43,0b,5f,ba,b8,9a,94,91,8d,d3,57,6b,d2,ae,e5,4d,9a,95,c1,0d,5b,d6,87,\
dc,e7,89,2d,a7,7f,d8,f1,f2,35,75,21,3b,80,5f,5c,36,97,fa,a1,58,5d,73,ac,54,\
58,9a,19,aa,18,9b,53,a7,33,52,78,cc,f0,bd,90,57,d8,e9,1b,22,8f,b2,c0,24,ad,\
41,ce,cc,d2,bc,9c,14,61,0d,25,66,5c,79,4e,57,ed,5c,a8,0f,52,e8,d3,bd,45,46,\
54,b7,ea,bc,48,e4,71,c9,98,33,60,9e,86,16,f2,a6,5a,36,d2,dc,35,a5,0f,2b,09,\
b4,14,e8,78,61,ae,51,7b,97,1d,25,16,97,44,af,02,9b,01,7a,68,04,e7,3a,64,30,\
14,86,0d,e8,cb,55,3c,e3,37,fe,3b,99,9c,ba,ff,76,b2,1b,b8,93,87,5c,b3,d4,3c,\
ed,b7,f3,52,b4,d5,30,46,7e,0a,56,72,7d,be,c8,6c,fc,f0,a2,bb,3a,9f,55,60,b2,\
30,76,a5,81,51,78,65,5c,ad,e6,fe,e6,65,12,74,ec,7b,db,55,ee,4e,06,d5,e2,f8,\
e6,ef,a1,d2,3c,14,d0,ac,2a,bc,97,3c,53,90,5c,1b,9f,85,0e,fa,a0,c4,07,45,4c,\
0f,06,1f,1b,6f,f9,c2,3c,72,ea,4d,74,15,5f,cc,97,19,b0,d1,5d,9a,a1,0d,f1,35,\
a6,8f,8d,d1,6b,b7,6f,ee,00,ed,b5,34,0b,32,e1,98,c3,68,51,a9,90,a7,f3,66,73,\
b1,d2,fe,22,63,13,e6,39,1f,0b,c9,70,31,4a,b9,b3,f0,91,1c,34,19,b6,5c,bd,83,\
3f,41,1a,26,63,9e,bd,c0,46,89,49,4e,c7,00,eb,db,fb,f5,28,d5,53,59,8f,30,d6,\
36,49,72,f8,9d,ce,f2,55,86,04,09,c7,59,5f,b0,61,41,77,a4,42,66,62,da,ff,65,\
6e,69,ab,5b,06,80,e0,e5,64,82,11,f1,e8,ab,96,bd,be,3f,27,0f,cb,f4,62,58,d1,\
c4,3d,bd,b7,87,86,76,bd,b0,8d,27,dd,3d,92,4f,82,21,a5,85,23,bb,f1,8b,66,d9,\
aa,78,e5,e5,89,4b,67,3d,52,5c,78,4a,6b,ec,85,1e,47,44,98,66,6d,ac,cf,cf,73,\
41,57,de,43,bf,cd,f5,9b,0a,b4,e8,d2,f2,8d,61,66,55,c8,69,2b,4d,a8,01,be,65,\
d4,47,66,52,f9,b9,22,b4,47,7c,04,19,da,05,12,10,7d,18,91,8b,30,b7,d1,4d,39,\
5c,74,dc,4e,bf,7d,41,1e,ff,fe,9b,3c,8b,cf,37,88,2e,91,18,79,2d,c0,71,42,81,\
05,86,73,2c,07,7a,81,f4,44,87,1c,2c,0f,37,b5,d6,25,3f,0c,59,e7,40,70,18,18,\
45,d9,cb,57,6f,67,bd,cb,4f,15,c9,fb,e3,19,2f,6f,95,c2,af,69,dc,75,09,ce,09,\
fe,db,8e,ed,82,8d,6f,69,f2,d4,39,41,48,64,ac,33,0c,21,8b,69,f5,50,c0,72,23,\
61,cf,92,d6,a4,c9,5c,ff,7e,8b,4b,f2,27,7b,74,f1,52,5b,1e,31,45,89,7b,13,35,\
60,a4,38,9f,40,90,1a,9b,db,96,11,43,e3,0d,f3,22,67,2d,0f,80,39,fb,0d,ad,d4,\
c7,84,fa,c9,cb,e7,a6,21,c3,74,9b,d1,f0,78,47,59,d2,c1,5d,fb,7c,37,64,a1,ca,\
ef,e1,7e,90,ad,89,1c,cc,8a,28,2a,97,91,e8,16,88,8d,78,3c,2b,00,af,dd,9b,28,\
36,6c,06,05,85,8c,bb,06,a0,56,08,3a,64,4d,f0,d8,20,f4,4f,68,26,80,ab,05,4b,\
f5,19,00,41,64,33,ea,6c,81,7b,24,86,7e,99,57,5b,27,4e,6e,e6,1b,77,ab,40,47,\
a3,2a,3c,e4,c8,45,bd,78,bb,fa,1e,05,44,96,1d,48,92,6e,51,6f,df,cc,b8,58,dc,\
0a,84,19,ff,ed,e2,df,fd,5d,d1,bf,79,24,77,55,13,50,e1,01,ff,ee,5a,bb,5b,35,\
40,50,7e,7a,4f,76,7c,fd,b7,0a,4d,00,2d,09,1c,14,6d,77,6b,9d,9a,b2,f5,03,b4,\
67,12,52,99,cf,63,4d,07,f0,cc,da,23,8c,b6,6d,90,26,8b,7e,19,cf,e7,ff,3a,48,\
e5,d7,de,d5,08,7d,f9,e7,10,76,e4,4e,de,93,29,09,4c,04,68,ae,46,1b,48,4e,33,\
64,38,c9,9f,be,71,3e,93,29,21,fa,2d,b7,58,9a,38,56,a0,c8,36,9a,76,19,b6,4e,\
0a,e0,cd,a2,de,9c,1f,a3,0d,f9,85,d7,bd,63,67,91,80,7d,a8,2e,81,da,f7,76,9e,\
f3,0d,ac,73,8b,b7,e5,2c,b7,bf,37,e7,0e,2f,5c,17,3f,f7,dd,b6,fc,c4,e8,84,7d,\
58,32,e3,42,80,fb,04,58,96,51,04,ec,68,56,63,a8,74,08,77,98,58,17,3b,42,33,\
e0,46,8b,a9,2e,a7,4d,07,fb,ae,3e,61,ab,1e,a2,1f,56,53,71,00,80,12,5a,75,6a,\
5b,91,fa,71,f7,08,c5,85,4b,93,1e,ca,49,1b,18,5f,65,ac,48,69,a7,95,72,d7,e5,\
16,b7,48,b2,f6,8a,0a,e7,9a,8e,c1,99,9a,da,3b,83,79,43,99,c2,13,5b,fa,94,51,\
0c,a2,ab,b7,49,d2,41,39,6a,f1,df,b7,e0,d8,c9,f1,f7,5c,7b,be,63,23,cc,f9,ac,\
9f,11,46,47,08,ab,4e,aa,f3,e4,6c,6e,e3,4d,22,87,e6,1a,99,7c,30,4b,70,7c,48,\
70,64,1a,7e,f5,f1,73,11,b6,66,35,67,30,8f,ca,92,77,48,df,31,29,d2,d4,3b,3e,\
ff,c8,c9,e0,7c,db,5d,26,57,fe,6a,02,0f,29,bf,83,de,bd,0a,96,ae,04,c3,11,37,\
7e,f1,c1,2c,ba,34,f1,9d,c3,56,41,58,11,cf,84,32,10,e7,63,e8,7f,82,e9,5f,d8,\
c5,be,c4,bd,9b,a0,df,1a,5a,50,da,39,69,70,c5,03,b9,3a,e1,f9,45,7d,1a,00,06,\
7b,f6,54,25,42,42,2d,68,96,10,38,a3,7e,b9,40,10,5d,4e,28,d0,1b,35,32,99,42,\
bb,4e,b5,94,db,93,fd,5a,19,a5,28,32,66,dc,71,dc,5b,51,13,75,ed,54,84,67,02,\
08,71,a3,7f,7b,71,7d,41,94,db,87,0a,84,52,c9,fa,0e,72,0d,97,cd,e2,11,3c,6f,\
5c,88,de,bd,eb,23,44,57,a3,14,f9,58,c7,99,f9,bd,d4,15,5f,17,d5,71,13,a2,79,\
ef,bc,02,70,fc,eb,9c,1f,09,12,3e,5a,d5,47,28,4c,22,ff,cd,cf,d4,92,96,11,60,\
ff,55,fb,4d,3b,95,ce,5b,f9,6d,d9,9c,86,8b,59,68,fc,6f,3b,f6,a2,e5,d6,71,cd,\
b5,9b,1c,d6,f1,bf,88,b2,08,41,f6,e2,59,a7,e0,f3,2a,26,b6,43,46,90,15,7d,24,\
77,7a,c9,89,f3,95,c7,0d,67,a1,b3,5f,2a,2b,d3,8a,3c,a2,9e,78,d2,ad,b4,68,a1,\
2f,22,b7,5c,1d,9d,5f,52,b9,a8,5d,31,ad,a7,e7,44,b1,c3,3d,2b,1a,c7,fd,10,78,\
ac,c7,3a,d6,cd,2b,65,33,26,c7,8f,19,64,d3,1f,26,79,52,6e,ff,c2,89,94,db,ad,\
0e,28,dd,ea,90,3d,18,4b,87,b5,c6,dc,4f,eb,c9,b1,da,d4,4d,d7,a8,10,f1,6a,b9,\
8b,7c,b4,f3,4d,2d,10,14,46,9b,fa,88,a5,8e,92,55,25,f3,61,78,c1,2c,10,27,29,\
87,1f,53,7d,0b,98,14,e5,ec,9a,c7,42,a5,85,40,ff,62,46,72,e7,e2,fd,de,3d,34,\
23,ba,27,61,d1,4d,a7,64,7d,62,57,9c,08,e6,de,da,da,41,dc,e3,51,e0,f7,13,af,\
8e,70,32,16,da,74,12,7a,5a,ee,cf,06,20,4b,6f,9e,d0,76,cc,ce,84,bd,bb,04,cb,\
59,7b,bd,4a,87,74,88,45,8e,15,40,fc,64,b4,31,bf,eb,ca,9f,57,69,46,b0,7a,fc,\
4d,3f,22,46,7f,3b,ac,d6,f4,11,14,2b,34,04,cc,32,9b,10,32,48,ab,29,53,87,c5,\
a7,fa,f0,e6,0e,3f,7b,8b,5a,18,a3,28,53,47,2a,e5,1d,9e,20,ba,8d,61,4d,8b,a8,\
06,20,56,a3,f3,37,ae,94,a4,ef,03,a4,95,97,0c,19,79,b8,f2,81,8f,b7,2f,2e,28,\
31,54,07,31,58,d2,46,9c,24,4f,cc,bd,ee,e3,32,09,e0,49,ca,bd,83,23,b9,4a,b6,\
7d,e9,c0,99,c5,c6,79,f2,56,47,72,1c,61,e9,e0,1a,85,f8,62,35,9b,91,52,c0,36,\
fa,52,c0,2e,ea,52
"rkeysecu"=hex:44,5e,dc,72,2e,73,69,a2,58,05,bf,c1,d9,24,b9,0e
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
Completion time: 2009-01-07 18:59:06
ComboFix-quarantined-files.txt 2009-01-07 23:58:32

Pre-Run: 19,285,524,480 bytes free
Post-Run: 19,262,390,272 bytes free

338 --- E O F --- 2009-01-07 23:46:42

 

[pskelley]

my first question (unless you know something here) as important as security is, and I run AVG 8 free myself, why are you runnning an out of date antivirus program?

If I ask a question, please provide and answer, there may be a valid reason for this?

Please read the directions carefully, the instruction #3 was not followed, provide that uninstall list.

Paltalk <<< I suggest you uninstall this program, see this information.
http://research.sunbelt-software.com/threatdisplay.aspx?name=Paltalk&threatid=9494

Please follow the directions carefully and in the numbered order.

1) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.

2) Open notepad and copy/paste the text in the codebox below into it:

File::
C:\32788R22FWJFW.0.tmp
c:\windows\system32\tuvSifeb.dll
c:\documents and settings\Darin\f.exe
c:\windows\Tasks\allvokfn.job

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{887017f7-70bb-11da-8737-e6bbe11f7d49}]

Save this as CFScript

Referring to the picture above, drag CFScript into ComboFix.exe.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

3) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.

*Cleaning Prefetch may result in a few slow starts until the folder is repopulated:
http://www.windowsnetworking.com/articles_tutorials/Gaining-Speed-Empty-Prefetch-XP.html

4) Download Malwarebytes' Anti-Malware to your Desktop
http://www.malwarebytes.org/

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post the log from CFScript and the log from MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Tutorial if needed:
http://www.techsupportteam.org/forum/tutorials/2282-malwarebytes-anti-malware-mbam.html

How is the computer running now?

Thanks

 

[cricket5012000]

Sorry about not giving you and answer to your question about the out dated antivirus. Only reason is it seemed to be doing the job. I guess I should keep up on these things. Can you make a recomondation on some good antivirus and malware software and any other suggestions.

I will reboot and see how the system preforms over the next couple of days.



Malwarebytes' Anti-Malware 1.32
Database version: 1632
Windows 5.1.2600 Service Pack 3

1/8/2009 8:03:39 PM
mbam-log-2009-01-08 (20-03-39).txt

Scan type: Full Scan (C:\|)
Objects scanned: 142703
Time elapsed: 1 hour(s), 37 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 52

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{5b4c3b43-49b6-42a7-a602-f7acdca0d409} (Adware.OneStepSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\Documents and Settings\Darin\f.exe.vir (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\behunnja.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\digeste.dll.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dohlyovn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\efcBrqop.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fuspib.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\gcunxd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ggneqr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\hyjkfbps.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\igikbutf.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kihugali.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\muturebe.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nqftlfof.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tilufewa.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tuvSifeb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\txhurlln.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\urqrsQKE.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wpv531229907513.cpx.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yyfykg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\zvwijj.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\~.exe.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP323\A0042664.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP323\A0042662.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP324\A0042760.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0043986.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045008.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045023.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045024.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045025.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045028.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045029.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP328\A0045009.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045056.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045074.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045046.dll (Trojan.Agent) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045047.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045050.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045051.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045053.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045054.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045055.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045058.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045059.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045063.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045066.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045069.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045072.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045073.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045075.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP329\A0045076.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP334\A0045286.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{A7948050-5ED4-4F85-963F-7AFA490A5F27}\RP334\A0045287.dll (Trojan.Vundo) -> Quarantined and deleted successfully.





ComboFix 09-01-08.01 - Darin 2009-01-08 17:54:46.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3039.2541 [GMT -5:00]
Running from: c:\documents and settings\Darin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Darin\Desktop\cfscript.txt
* Created a new restore point

FILE ::
C:\32788R22FWJFW.0.tmp
c:\documents and settings\Darin\f.exe
c:\windows\system32\tuvSifeb.dll
c:\windows\Tasks\allvokfn.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Darin\f.exe
c:\windows\system32\tuvSifeb.dll
c:\windows\Tasks\allvokfn.job

.
((((((((((((((((((((((((( Files Created from 2008-12-08 to 2009-01-08 )))))))))))))))))))))))))))))))
.

2009-01-08 18:00 . 2009-01-08 18:00 <DIR> d-------- C:\b6f0c96d0697f2c0653311ef4ba396
2009-01-07 18:44 . 2009-01-07 18:45 <DIR> d-------- C:\32788R22FWJFW.0.tmp
2009-01-05 18:26 . 2009-01-05 18:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg7
2009-01-03 17:07 . 2009-01-03 17:07 <DIR> d-------- c:\program files\Trend Micro
2009-01-03 11:55 . 2009-01-03 16:51 207 --a------ c:\windows\wininit.ini
2009-01-01 17:31 . 2009-01-01 17:31 <DIR> d-------- c:\program files\MSXML 4.0
2009-01-01 08:56 . 2006-11-14 07:28 86,016 --a------ c:\windows\system32\cttele.dll
2008-12-31 20:11 . 1999-12-13 01:01 44,032 --a------ c:\windows\system32\CTSVCCDA.EXE
2008-12-31 20:11 . 1999-11-18 01:00 25,088 --a------ c:\windows\system32\CTSVCCTL.EXE
2008-12-31 17:42 . 2009-01-03 16:19 <DIR> d-------- c:\program files\eMusic Download Manager
2008-12-31 17:42 . 2009-01-03 11:55 <DIR> d-------- c:\program files\eMusic
2008-12-31 17:42 . 2008-12-31 17:42 <DIR> d-------- c:\program files\Conduit
2008-12-31 17:42 . 2009-01-03 16:19 <DIR> d-------- c:\documents and settings\Darin\Application Data\eMusic
2008-12-31 17:40 . 2008-12-31 19:18 <DIR> d-------- c:\program files\USB Disk Win98 Driver
2008-12-14 11:50 . 2008-12-14 11:50 <DIR> d-------- c:\documents and settings\Darin\Application Data\InstallShield
2008-12-14 10:49 . 2008-12-14 10:49 754 --a------ c:\windows\WORDPAD.INI
2008-12-11 21:36 . 2008-12-11 21:36 <DIR> d-------- c:\documents and settings\Darin\Application Data\Logitech
2008-12-11 21:36 . 2008-12-11 21:36 <DIR> d-------- c:\documents and settings\All Users\Application Data\LogiShrd
2008-12-11 21:36 . 2008-09-26 09:52 10,384 --a------ c:\windows\system32\drivers\LBeepKE.sys
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
2008-12-11 21:36 . 2008-12-11 21:36 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_LHidFilt_01005.Wdf
2008-12-11 21:35 . 2008-12-11 21:35 <DIR> d-------- c:\program files\Common Files\Logishrd
2008-12-11 21:35 . 2008-11-07 16:37 301,656 --a------ c:\windows\system32\BtCoreIf.dll
2008-12-11 21:35 . 2008-11-07 16:38 170,512 --a------ c:\windows\system32\kemutb.dll
2008-12-11 21:35 . 2008-11-07 16:38 145,936 --a------ c:\windows\system32\KemUtil.dll
2008-12-11 21:35 . 2008-11-07 16:38 117,264 --a------ c:\windows\system32\KemWnd.dll
2008-12-11 21:35 . 2008-11-07 16:38 84,496 --a------ c:\windows\system32\KemXML.dll
2008-12-11 19:45 . 2008-12-11 19:45 410,984 --a------ c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-07 23:59 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-01-03 21:19 --------- d-----w c:\program files\Winamp
2009-01-03 03:54 --------- d-----w c:\program files\Google
2009-01-01 14:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-01 14:53 --------- d--h--w c:\program files\Creative Installation Information
2009-01-01 13:56 409,600 ----a-w c:\windows\system32\wrap_oal.dll
2009-01-01 13:56 114,688 ----a-w c:\windows\system32\OpenAL32.dll
2009-01-01 02:41 --------- d-----w c:\program files\Yahoo!
2009-01-01 02:41 --------- d-----w c:\program files\QuickTime
2009-01-01 02:41 --------- d-----w c:\program files\Futuremark
2009-01-01 02:41 --------- d-----w c:\program files\Ahead
2008-12-20 05:10 --------- d-----w c:\program files\Paltalk Messenger
2008-12-17 00:23 952 --sha-w c:\documents and settings\All Users\Application Data\KGyGaAvL.sys
2008-12-12 02:35 --------- d-----w c:\program files\Logitech
2008-12-12 00:45 --------- d-----w c:\program files\Java
2008-11-29 03:45 --------- d-----w c:\documents and settings\Darin\Application Data\gtk-2.0
2008-11-28 19:43 --------- d-----w c:\documents and settings\All Users\Application Data\kds_kodak
2008-11-28 19:38 --------- d-----w c:\documents and settings\All Users\Application Data\Eastman Kodak Company
2008-11-28 19:35 --------- d-----w c:\documents and settings\All Users\Application Data\Kodak
2008-11-28 19:32 --------- d-----w c:\program files\Kodak
2008-11-28 19:20 --------- d-----w c:\program files\Common Files\Kodak
2008-11-23 21:22 --------- d-----w c:\program files\Curse
2008-11-23 19:25 2,996 ----a-w c:\windows\system32\ealregsnapshot1.reg
2008-11-23 18:42 --------- d-----w c:\program files\Electronic Arts
2008-11-18 11:08 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-16 22:47 --------- d-----w c:\documents and settings\Darin\Application Data\Corel
2008-11-16 22:42 --------- d-----w c:\documents and settings\All Users\Application Data\Corel
2008-11-16 22:41 --------- d-----w c:\program files\Common Files\Corel
2008-11-16 22:40 --------- d-----w c:\program files\Corel
2008-11-16 22:40 --------- d-----w c:\program files\Common Files\Protexis
2008-11-16 20:14 --------- d-----w c:\documents and settings\Darin\Application Data\Ahead
2008-10-23 12:36 286,720 ----a-w c:\windows\system32\gdi32.dll
2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-16 19:06 268,648 ----a-w c:\windows\system32\mucltui.dll
2008-10-16 19:06 208,744 ----a-w c:\windows\system32\muweb.dll
2008-10-10 19:46 69,632 ----a-w c:\windows\KHALMNPR.Exe
2008-04-13 22:04 774,144 ----a-w c:\program files\RngInterstitial.dll
2008-09-27 13:06 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008092720080928\index.dat
.

((((((((((((((((((((((((((((( snapshot@2009-01-07_18.56.47.23 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-01-08 22:46:30 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_a5c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe" [2004-11-11 212992]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-12-02 68856]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"CTSyncU.exe"="c:\program files\Creative\Sync Manager Unicode\CTSyncU.exe" [2007-07-17 868352]
"igndlm.exe"="c:\program files\Download Manager\DLM.exe" [2008-08-01 1103216]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"InCD"="c:\program files\Ahead\InCD\InCD.exe" [2005-07-25 1397760]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2004-07-15 32768]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"Launch LCDMon"="c:\program files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe" [2007-07-17 1687824]
"Launch LGDCore"="c:\program files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" [2007-07-17 2094352]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-11 136600]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-03-28 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-03-30 267048]
"Corel Photo Downloader"="c:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" [2008-08-08 532808]
"Corel File Shell Monitor"="c:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe" [2008-08-08 16712]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2008-08-21 1306624]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"USB Storage Toolbox"="c:\program files\USB Disk Win98 Driver\Res.EXE" [2005-09-14 65536]
"CHotkey"="mHotkey.exe" [2004-06-11 c:\windows\mHotkey.exe]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2008-10-10 c:\windows\KHALMNPR.Exe]
"CTHelper"="CTHELPER.EXE" [2007-04-09 c:\windows\system32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 c:\windows\system32\Ctxfihlp.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2008-07-07 282624]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2008-12-11 809488]
PalTalk.lnk - c:\program files\Paltalk Messenger\paltalk.exe [2008-11-14 11376640]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2008-11-07 16:41 72208 c:\program files\Common Files\Logishrd\Bluetooth\LBTWLgn.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Sony\\Station\\LaunchPad\\LaunchPad.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Paltalk Messenger\\paltalk.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Curse\\CurseClient.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=

R4 KodakSvc;Kodak AiO Device Service;c:\program files\Kodak\Printer\Center\KodakSvc.exe [2008-02-28 18944]
R4 LBeepKE;LBeepKE;c:\windows\system32\drivers\LBeepKE.sys [2008-12-11 10384]

--- Other Services/Drivers In Memory ---

*Deregistered* - InCDrec
.
Contents of the 'Scheduled Tasks' folder

2009-01-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

2008-12-15 c:\windows\Tasks\EasyShare Registration Task.job
- c:\windows\system32\rundll32.exe [2008-04-13 19:12]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.velocitymicro.com/
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

c:\windows\Downloaded Program Files\CTSUEng.ocx - c:\windows\Downloaded Program Files\CTSUEngn.ocx
O16 -: {6C269571-C6D7-4818-BCA4-32A035E8C884}
hxxp://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
c:\windows\Downloaded Program Files\CTSUEng.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-08 18:00:41
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-882822723-3580622033-3468076957-1005\Software\SecuROM\License information*NULL*]
"datasecu"=hex:8f,3d,cf,5a,18,e2,da,bb,46,85,74,b4,6f,78,08,54,43,df,77,0f,15,\
97,83,58,0e,05,ed,67,7a,f3,ca,4c,b7,7f,2c,58,e8,39,4a,a9,ea,6b,3c,b1,28,3d,\
ff,91,89,8a,ce,de,f5,c9,64,a8,78,66,5b,19,da,8a,93,17,1c,5b,8a,d0,ff,6e,46,\
1e,14,fe,23,1d,08,05,55,72,ca,bf,39,16,3b,1a,96,81,4c,40,f4,7c,ae,29,24,c8,\
81,68,c2,b4,8e,57,c1,d5,41,8d,18,9b,36,99,f9,c9,b7,86,3f,14,f0,55,7d,02,2b,\
cc,d7,7b,28,39,36,5e,16,b0,a6,1d,8c,53,10,3c,ce,83,52,ee,5f,1b,42,3f,dd,df,\
7d,db,2a,7e,ae,96,fc,fb,e0,d8,05,18,c4,03,20,c4,55,83,b4,c0,a3,04,f0,a5,a4,\
87,bf,6f,44,fc,77,01,06,4f,f2,2d,73,6d,33,d5,9f,2b,9f,0f,81,77,2c,d1,b4,31,\
35,52,8a,d3,92,46,89,1d,e3,82,87,ed,91,e9,24,58,81,64,66,fe,e2,7a,2b,7c,8b,\
b8,83,11,5f,19,20,81,d4,a1,43,15,ae,da,bf,d2,8e,d9,19,d4,d6,b2,d5,2f,29,6a,\
d7,91,43,0b,5f,ba,b8,9a,94,91,8d,d3,57,6b,d2,ae,e5,4d,9a,95,c1,0d,5b,d6,87,\
dc,e7,89,2d,a7,7f,d8,f1,f2,35,75,21,3b,80,5f,5c,36,97,fa,a1,58,5d,73,ac,54,\
58,9a,19,aa,18,9b,53,a7,33,52,78,cc,f0,bd,90,57,d8,e9,1b,22,8f,b2,c0,24,ad,\
41,ce,cc,d2,bc,9c,14,61,0d,25,66,5c,79,4e,57,ed,5c,a8,0f,52,e8,d3,bd,45,46,\
54,b7,ea,bc,48,e4,71,c9,98,33,60,9e,86,16,f2,a6,5a,36,d2,dc,35,a5,0f,2b,09,\
b4,14,e8,78,61,ae,51,7b,97,1d,25,16,97,44,af,02,9b,01,7a,68,04,e7,3a,64,30,\
14,86,0d,e8,cb,55,3c,e3,37,fe,3b,99,9c,ba,ff,76,b2,1b,b8,93,87,5c,b3,d4,3c,\
ed,b7,f3,52,b4,d5,30,46,7e,0a,56,72,7d,be,c8,6c,fc,f0,a2,bb,3a,9f,55,60,b2,\
30,76,a5,81,51,78,65,5c,ad,e6,fe,e6,65,12,74,ec,7b,db,55,ee,4e,06,d5,e2,f8,\
e6,ef,a1,d2,3c,14,d0,ac,2a,bc,97,3c,53,90,5c,1b,9f,85,0e,fa,a0,c4,07,45,4c,\
0f,06,1f,1b,6f,f9,c2,3c,72,ea,4d,74,15,5f,cc,97,19,b0,d1,5d,9a,a1,0d,f1,35,\
a6,8f,8d,d1,6b,b7,6f,ee,00,ed,b5,34,0b,32,e1,98,c3,68,51,a9,90,a7,f3,66,73,\
b1,d2,fe,22,63,13,e6,39,1f,0b,c9,70,31,4a,b9,b3,f0,91,1c,34,19,b6,5c,bd,83,\
3f,41,1a,26,63,9e,bd,c0,46,89,49,4e,c7,00,eb,db,fb,f5,28,d5,53,59,8f,30,d6,\
36,49,72,f8,9d,ce,f2,55,86,04,09,c7,59,5f,b0,61,41,77,a4,42,66,62,da,ff,65,\
6e,69,ab,5b,06,80,e0,e5,64,82,11,f1,e8,ab,96,bd,be,3f,27,0f,cb,f4,62,58,d1,\
c4,3d,bd,b7,87,86,76,bd,b0,8d,27,dd,3d,92,4f,82,21,a5,85,23,bb,f1,8b,66,d9,\
aa,78,e5,e5,89,4b,67,3d,52,5c,78,4a,6b,ec,85,1e,47,44,98,66,6d,ac,cf,cf,73,\
41,57,de,43,bf,cd,f5,9b,0a,b4,e8,d2,f2,8d,61,66,55,c8,69,2b,4d,a8,01,be,65,\
d4,47,66,52,f9,b9,22,b4,47,7c,04,19,da,05,12,10,7d,18,91,8b,30,b7,d1,4d,39,\
5c,74,dc,4e,bf,7d,41,1e,ff,fe,9b,3c,8b,cf,37,88,2e,91,18,79,2d,c0,71,42,81,\
05,86,73,2c,07,7a,81,f4,44,87,1c,2c,0f,37,b5,d6,25,3f,0c,59,e7,40,70,18,18,\
45,d9,cb,57,6f,67,bd,cb,4f,15,c9,fb,e3,19,2f,6f,95,c2,af,69,dc,75,09,ce,09,\
fe,db,8e,ed,82,8d,6f,69,f2,d4,39,41,48,64,ac,33,0c,21,8b,69,f5,50,c0,72,23,\
61,cf,92,d6,a4,c9,5c,ff,7e,8b,4b,f2,27,7b,74,f1,52,5b,1e,31,45,89,7b,13,35,\
60,a4,38,9f,40,90,1a,9b,db,96,11,43,e3,0d,f3,22,67,2d,0f,80,39,fb,0d,ad,d4,\
c7,84,fa,c9,cb,e7,a6,21,c3,74,9b,d1,f0,78,47,59,d2,c1,5d,fb,7c,37,64,a1,ca,\
ef,e1,7e,90,ad,89,1c,cc,8a,28,2a,97,91,e8,16,88,8d,78,3c,2b,00,af,dd,9b,28,\
36,6c,06,05,85,8c,bb,06,a0,56,08,3a,64,4d,f0,d8,20,f4,4f,68,26,80,ab,05,4b,\
f5,19,00,41,64,33,ea,6c,81,7b,24,86,7e,99,57,5b,27,4e,6e,e6,1b,77,ab,40,47,\
a3,2a,3c,e4,c8,45,bd,78,bb,fa,1e,05,44,96,1d,48,92,6e,51,6f,df,cc,b8,58,dc,\
0a,84,19,ff,ed,e2,df,fd,5d,d1,bf,79,24,77,55,13,50,e1,01,ff,ee,5a,bb,5b,35,\
40,50,7e,7a,4f,76,7c,fd,b7,0a,4d,00,2d,09,1c,14,6d,77,6b,9d,9a,b2,f5,03,b4,\
67,12,52,99,cf,63,4d,07,f0,cc,da,23,8c,b6,6d,90,26,8b,7e,19,cf,e7,ff,3a,48,\
e5,d7,de,d5,08,7d,f9,e7,10,76,e4,4e,de,93,29,09,4c,04,68,ae,46,1b,48,4e,33,\
64,38,c9,9f,be,71,3e,93,29,21,fa,2d,b7,58,9a,38,56,a0,c8,36,9a,76,19,b6,4e,\
0a,e0,cd,a2,de,9c,1f,a3,0d,f9,85,d7,bd,63,67,91,80,7d,a8,2e,81,da,f7,76,9e,\
f3,0d,ac,73,8b,b7,e5,2c,b7,bf,37,e7,0e,2f,5c,17,3f,f7,dd,b6,fc,c4,e8,84,7d,\
58,32,e3,42,80,fb,04,58,96,51,04,ec,68,56,63,a8,74,08,77,98,58,17,3b,42,33,\
e0,46,8b,a9,2e,a7,4d,07,fb,ae,3e,61,ab,1e,a2,1f,56,53,71,00,80,12,5a,75,6a,\
5b,91,fa,71,f7,08,c5,85,4b,93,1e,ca,49,1b,18,5f,65,ac,48,69,a7,95,72,d7,e5,\
16,b7,48,b2,f6,8a,0a,e7,9a,8e,c1,99,9a,da,3b,83,79,43,99,c2,13,5b,fa,94,51,\
0c,a2,ab,b7,49,d2,41,39,6a,f1,df,b7,e0,d8,c9,f1,f7,5c,7b,be,63,23,cc,f9,ac,\
9f,11,46,47,08,ab,4e,aa,f3,e4,6c,6e,e3,4d,22,87,e6,1a,99,7c,30,4b,70,7c,48,\
70,64,1a,7e,f5,f1,73,11,b6,66,35,67,30,8f,ca,92,77,48,df,31,29,d2,d4,3b,3e,\
ff,c8,c9,e0,7c,db,5d,26,57,fe,6a,02,0f,29,bf,83,de,bd,0a,96,ae,04,c3,11,37,\
7e,f1,c1,2c,ba,34,f1,9d,c3,56,41,58,11,cf,84,32,10,e7,63,e8,7f,82,e9,5f,d8,\
c5,be,c4,bd,9b,a0,df,1a,5a,50,da,39,69,70,c5,03,b9,3a,e1,f9,45,7d,1a,00,06,\
7b,f6,54,25,42,42,2d,68,96,10,38,a3,7e,b9,40,10,5d,4e,28,d0,1b,35,32,99,42,\
bb,4e,b5,94,db,93,fd,5a,19,a5,28,32,66,dc,71,dc,5b,51,13,75,ed,54,84,67,02,\
08,71,a3,7f,7b,71,7d,41,94,db,87,0a,84,52,c9,fa,0e,72,0d,97,cd,e2,11,3c,6f,\
5c,88,de,bd,eb,23,44,57,a3,14,f9,58,c7,99,f9,bd,d4,15,5f,17,d5,71,13,a2,79,\
ef,bc,02,70,fc,eb,9c,1f,09,12,3e,5a,d5,47,28,4c,22,ff,cd,cf,d4,92,96,11,60,\
ff,55,fb,4d,3b,95,ce,5b,f9,6d,d9,9c,86,8b,59,68,fc,6f,3b,f6,a2,e5,d6,71,cd,\
b5,9b,1c,d6,f1,bf,88,b2,08,41,f6,e2,59,a7,e0,f3,2a,26,b6,43,46,90,15,7d,24,\
77,7a,c9,89,f3,95,c7,0d,67,a1,b3,5f,2a,2b,d3,8a,3c,a2,9e,78,d2,ad,b4,68,a1,\
2f,22,b7,5c,1d,9d,5f,52,b9,a8,5d,31,ad,a7,e7,44,b1,c3,3d,2b,1a,c7,fd,10,78,\
ac,c7,3a,d6,cd,2b,65,33,26,c7,8f,19,64,d3,1f,26,79,52,6e,ff,c2,89,94,db,ad,\
0e,28,dd,ea,90,3d,18,4b,87,b5,c6,dc,4f,eb,c9,b1,da,d4,4d,d7,a8,10,f1,6a,b9,\
8b,7c,b4,f3,4d,2d,10,14,46,9b,fa,88,a5,8e,92,55,25,f3,61,78,c1,2c,10,27,29,\
87,1f,53,7d,0b,98,14,e5,ec,9a,c7,42,a5,85,40,ff,62,46,72,e7,e2,fd,de,3d,34,\
23,ba,27,61,d1,4d,a7,64,7d,62,57,9c,08,e6,de,da,da,41,dc,e3,51,e0,f7,13,af,\
8e,70,32,16,da,74,12,7a,5a,ee,cf,06,20,4b,6f,9e,d0,76,cc,ce,84,bd,bb,04,cb,\
59,7b,bd,4a,87,74,88,45,8e,15,40,fc,64,b4,31,bf,eb,ca,9f,57,69,46,b0,7a,fc,\
4d,3f,22,46,7f,3b,ac,d6,f4,11,14,2b,34,04,cc,32,9b,10,32,48,ab,29,53,87,c5,\
a7,fa,f0,e6,0e,3f,7b,8b,5a,18,a3,28,53,47,2a,e5,1d,9e,20,ba,8d,61,4d,8b,a8,\
06,20,56,a3,f3,37,ae,94,a4,ef,03,a4,95,97,0c,19,79,b8,f2,81,8f,b7,2f,2e,28,\
31,54,07,31,58,d2,46,9c,24,4f,cc,bd,ee,e3,32,09,e0,49,ca,bd,83,23,b9,4a,b6,\
7d,e9,c0,99,c5,c6,79,f2,56,47,72,1c,61,e9,e0,1a,85,f8,62,35,9b,91,52,c0,36,\
fa,52,c0,2e,ea,52
"rkeysecu"=hex:44,5e,dc,72,2e,73,69,a2,58,05,bf,c1,d9,24,b9,0e
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
c:\program files\common files\logishrd\bluetooth\LBTServ.dll
.
Completion time: 2009-01-08 18:03:40
ComboFix-quarantined-files.txt 2009-01-08 23:02:55
ComboFix2.txt 2009-01-07 23:59:07

Pre-Run: 19,137,323,008 bytes free
Post-Run: 19,150,188,544 bytes free

295 --- E O F --- 2009-01-08 23:01:47




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:07:40 PM, on 1/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Ahead\InCD\InCD.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/?page=1&refresh=2#14345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.velocitymicro.com/
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0989.0\msneshellx.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135016683871
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198427060296
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15034/CTPID.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 12846 bytes

 

[pskelley]

We need to get an up to date antivirus program on the computer. Here are three, install only one. Update the one you choose and run a system scan removing anything it finds, then post a new HJT log.

Tell me how the computer is running now.

http://free.grisoft.com/ww.download-avg-anti-virus-free-edition
How to Install Free version AVG 8.0 without LinkScanner feature
http://russelltexas.com/tutorials/avg8install.htm

http://www.avast.com/eng/avast_4_home.html

http://www.free-av.com/

Thanks

 

[cricket5012000]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:25:36 PM, on 1/9/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ahead\InCD\InCDsrv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Ahead\InCD\InCD.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\mHotkey.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDClock.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDCountdown.exe
C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDPop3.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Logitech\GamePanel Software\LCD Manager\Applets\LCDMedia.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe
C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Kodak\printer\center\KodakSvc.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\USB Disk Win98 Driver\Res.EXE
C:\WINDOWS\system32\CTHELPER.EXE
C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\Paltalk Messenger\paltalk.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Electronic Arts\Warhammer Online - Age of Reckoning\warpatch.bin
C:\Program Files\Curse\CurseClient.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AVG\AVG8\avgui.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/?page=1&refresh=2#14345
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.velocitymicro.com/
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: Yahoo! ¤u¨ã¦C - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.0989.0\msneshellx.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [CHotkey] mHotkey.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\GamePanel Software\LCD Manager\LCDMon.exe"
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\GamePanel Software\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe" -startup
O4 - HKLM\..\Run: [Corel File Shell Monitor] C:\Program Files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Program Files\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\NEROPH~2\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CTSyncU.exe] "C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe"
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O4 - Global Startup: PalTalk.lnk = C:\Program Files\Paltalk Messenger\paltalk.exe
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.apple.com.edgesuite.net/content.info.apple.com/QuickTime/qtactivex/qtplugin.cab
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15031/CTSUEng.cab
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} (EARTPatchX Class) - http://simcity.ea.com/update/EARTPX.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1135016683871
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6C269571-C6D7-4818-BCA4-32A035E8C884} (Creative Software AutoUpdate) - http://www.creative.com/softwareupdate/su/ocx/15101/CTSUEng.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1198427060296
O16 - DPF: {BC18E6DF-BE57-4580-93E8-F228F9A133AA} (MaxisSimCity4LotTeleX Control) - http://simcity.ea.com/exchange/lots/teleport/MaxisSimCity4LotTeleX.cab
O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} (MaxisSimCity4PatcherX Control) - http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su/ocx/15034/CTPID.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: InCD Helper (read only) (InCDsrvR) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: Kodak AiO Device Service (KodakSvc) - Eastman Kodak Company - C:\Program Files\Kodak\printer\center\KodakSvc.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Protexis Licensing V2 (PSI_SVC_2) - Protexis Inc. - C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

--
End of file - 13910 bytes



seems to be running ok so far. i installed the latest vesion of avg



here is the log


"Scan ""Scan whole computer"" was finished."
"Infections found:";"0"
"Infected objects removed or healed:";"0"
"Not removed or healed:";"0"
"Spyware found:";"0"
"Spyware removed:";"0"
"Not removed:";"0"
"Warnings count:";"63"
"Information count:";"0"
"Scan started:";"Friday, January 09, 2009, 6:25:33 AM"
"Scan finished:";"Friday, January 09, 2009, 7:03:53 AM (38 minute(s) 19 second(s))"
"Total object scanned:";"669126"
"User who launched the scan:";"Darin"

"Warnings"
"File";"Infection";"Result"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[1].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.539b0606";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.557bf2b0";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.830b6f08";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.87a9ab5d";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.8a47878";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.b68f2b7b";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.e762f029";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@ad.yieldmanager[3].txt:\ad.yieldmanager.com.ff92306";"Found Tracking cookie.Yieldmanager";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@bs.serving-sys[1].txt";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@bs.serving-sys[1].txt:\bs.serving-sys.com.5bf1f00f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@msnportal.112.2o7[1].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@msnportal.112.2o7[1].txt:\msnportal.112.2o7.net.7225be6f";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@msnportal.112.2o7[2].txt";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@msnportal.112.2o7[2].txt:\msnportal.112.2o7.net.7225be6f";"Found Tracking cookie.2o7";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@questionmarket[2].txt";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@questionmarket[2].txt:\questionmarket.com.3eb5a9f1";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@questionmarket[2].txt:\questionmarket.com.4dd5e426";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt:\revsci.net.55564293";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt:\revsci.net.6215368c";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[1].txt:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[2].txt";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[2].txt:\revsci.net.2df99d79";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[2].txt:\revsci.net.44927ec";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[2].txt:\revsci.net.55564293";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@revsci[2].txt:\revsci.net.e9dbeb91";"Found Tracking cookie.Revsci";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.255d6f2f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.4b416ef8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.606c3d3b";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.400f83f";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.6a1cf9e8";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@serving-sys[2].txt:\serving-sys.com.c9034af6";"Found Tracking cookie.Serving-sys";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@smartadserver[1].txt";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@smartadserver[1].txt:\smartadserver.com.321a5cf8";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@smartadserver[1].txt:\smartadserver.com.5550c4ed";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@smartadserver[1].txt:\smartadserver.com.c5827141";"Found Tracking cookie.Smartadserver";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt:\trafficmp.com.37644bdb";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt:\trafficmp.com.a00e30b4";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt:\trafficmp.com.ae53b8b";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt:\trafficmp.com.e2e71e33";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[1].txt:\trafficmp.com.f3e5803e";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt:\trafficmp.com.37644bdb";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt:\trafficmp.com.a00e30b4";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt:\trafficmp.com.ae53b8b";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt:\trafficmp.com.e2e71e33";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Documents and Settings\Darin\Cookies\darin@trafficmp[2].txt:\trafficmp.com.f3e5803e";"Found Tracking cookie.Trafficmp";"Potentially dangerous object"
"C:\Program Files\Sony\Vanguard\bin\mozilla\cookies.txt";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"
"C:\Program Files\Sony\Vanguard\bin\mozilla\cookies.txt:\doubleclick.net.bf396750";"Found Tracking cookie.Doubleclick";"Potentially dangerous object"
"C:\Program Files\Sony\Vanguard\bin\mozilla\cookies.txt:\questionmarket.com.3eb5a9f1";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"
"C:\Program Files\Sony\Vanguard\bin\mozilla\cookies.txt:\questionmarket.com.4dd5e426";"Found Tracking cookie.Questionmarket";"Potentially dangerous object"

 

[pskelley]

I hope you had AVG 8 remove all of those junk cookies, here is some information to help you with those.
http://www.mvps.org/winhelp2002/cookies.htm
http://www.microsoft.com/windows/ie/using/howto/privacy/config.mspx

Let's see if we can wrap up like this.

Remove combofix from the computer like this:

Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.

Clean the System Restore files like this:

Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Reboot

Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.

Update MBAM and scan to be sure we missed none of the junk, there is no need to post a clean scan result.
(MBAM is yours to keep if you wish, update it and run it once a month or so)

Update AVG 8 and scan the system, to be sure it is running right and scanning clean.
Here is good information for AVG:
FAQ: http://www.avg.com/faq
AVG Free Forum: http://freeforum.avg.com/

If all is well at this point, let me know and I will close the topic.

Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx

Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml

http://www.malwarecomplaints.info/

Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.

http://users.telenet.be/bluepatchy/miekiemoes/Links.html

 

[cricket5012000]

so far so good ...but

Ok everthing here seems ok as far as the malware goes.


Something that I thought was related to all of this might not be.

1. each time i try to shut down the computer automatic updates tries to install an update. The update is a security update for xml core services 4.0 servcie pack 2.

2. Under the details tab is says 0 kb and 0 minutes for the download. ready to install.

But it has never installed itself.

Is this something unrelated or do I have something else goin on here besides a malware problem.


Darin

 

[pskelley]

Not sure if I can help with that, unless you are getting some kind of error message you can post?

Have a look here to see if anything helps:
http://v4.windowsupdate.microsoft.com/troubleshoot/

or ask for help here: http://support.microsoft.com/?LN=en-us&x=13&y=9

Thanks