Malware causing printer problems, Vista "counterfeit" detection, etc.

malfee · Mar 22, 2009

Hi guys, I was searching on Google for ways to clean my infected system, and I stumbled across this wonderful site. It seems that this is the place to be if you want to clean up a computer. I read the sticky at the top of the forum, so I've already backed up my registry using ERUNT. I've had System Restore disabled since day one of owning my computer, so hopefully that isn't an issue. Anyway, to my issues:

About a week or so ago I ran an .exe on my computer that apparently was a trojan. Immediately after running the file, I suspected that something had gone awry, so I quickly re-downloaded Lavasoft's Ad-Aware and Grisoft's AVG Free (two programs that I had installed previously, but had uninstalled some time ago for a reason I cannot remember :/). I've since run both, and some problems have been identified and "removed," but I am still suffering from issues. Not satisfied with the results from these programs (or my limited experience with malware removal), I downloaded and installed both Spybot - Search and Destroy, as well as WinASO's Registry Optimizer. I've run both a few times since installation, and they have both claimed to have fixed certain errors and problems. Unfortunately, I was not aware of this site before I tried all of these fixes on my own, so I am worried that I might have made it harder to diagnose and repair my computer.

Right now I am running Windows Vista Home Premium, and I still have AVG, Spybot, and WinASO installed. I disabled Spybot's TeaTimer as advised in a sticky thread here, but AVG still runs at startup, while WinASO only runs at my command (though I've read that you suggest not running any registry cleaners/optimizers, but it's a bit too late for that unfortunately). I have also just downloaded HijackThis and Malwarebyte's Anti-Malware, but have not installed them yet.

Now, to better explain what issues I am still suffering from. As of right now, the most annoying issue is that my printer refuses to work ever since this happened. Although my printer hardware appears absolutely fine, whenever I go to print anything whatsoever, I get a very generic error. For example, if I attempt to print this page right now, I receive, "An unknown error has occurred while printing." I receive similar errors when I try to print from a word processor. I own an HP Photosmart C4280 printer, which does have some software that came with it (which I might have lying around here somewhere; though I believe you can download printer software off of HP's site). This lack of a printer is becoming very frustrating as I often have to print out homework for school, among other things.

The second most notable issue is that every time I start up my computer, Windows notifies me that I may be a victim of software counterfeiting, and that I should follow this link to Microsoft's Genuine Advantage page to verify my machine. When I do so, the service is unable to verify my machine, and offers some advice on how to fix my issue (none of which I have since pursued). I can assure that I own a legitimate copy of Windows Vista Home Premium. Before going through all of this trouble cleaning up my computer, I was considering reformatting to fix all of my problems. However, I cannot seem to find my installation disc. I know it must be hiding around here somewhere, but I do not have it on hand at the moment. Regardless, this counterfeit issue only started occurring immediately after I was infected, so I suspect that upon cleaning my computer, this issue will resolve itself.

Finally, there are some strange glitches throughout Vista here and there. Since my infection, I can no longer open my Control Panel through a typical approach. I have always had a shortcut to my Control Panel in my quick-launch bar, but now when I click that icon, the window appears very briefly, and then closes itself. Instead, in order to access my Control Panel, I must right-click this shortcut, and then choose 'Open file location,' and then browse through my files to find what I am looking for.

I apologize for the long post, but hopefully all of this information can help you to help ME resolve all of my issues soon. Any and all help is greatly appreciated! Thank you!

katana · Mar 25, 2009

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Hello and welcome to the forums

My name is Katana and I will be helping you to remove any infection(s) that you may have.

Please observe these rules while we work:

Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)

If you can do those few things, everything should go smoothly

Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware to your desktop.

Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
- Update Malwarebytes' Anti-Malware
- and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If requested, please reboot
- If you accidently close it, the log file is saved here and will be named like this:
- C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt

Download and Run RSIT

Please download Random's System Information Tool by random/random from here and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
- log.txt will be opened maximized.
- info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.

malfee · Mar 27, 2009

Ok, first up is the Malwarebytes log, then the RSIT info log, and finally the RSIT log.txt file.

Malwarebytes' Anti-Malware 1.34
Database version: 1899
Windows 6.0.6000

3/26/2009 7:51:32 PM
mbam-log-2009-03-26 (19-51-32).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 237496
Time elapsed: 1 hour(s), 34 minute(s), 32 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 9
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9522b3fb-7a2b-4646-8af6-36e7f593073c} (Adware.Coupons) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdss.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\EKRN.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GUARD.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MCSHIELD.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe (Security.Hijack) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\defaultlib (Spyware.Passwords) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\softyinforwow1 (Trojan.PWS) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\xccinit (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_CLASSES_ROOT\txtfile\shell\open\command\ (Hijack.Notepad) -> Bad: ("C:\Windows\system32\nxtepad.exe" "%1") Good: (notepad.exe %1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Windows\System32\inf\rundll33.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\temp\svchost.exe (Backdoor.Bot) -> Delete on reboot.
C:\Windows\System32\sopidkc.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

info.txt logfile of random's system information tool 1.06 2009-03-26 19:58:18

======Uninstall list======

-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
-->C:\Windows\UNNeroBackItUp.exe /UNINSTALL
-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL
-->C:\Windows\UNNeroShowTime.exe /UNINSTALL
-->C:\Windows\UNNeroVision.exe /UNINSTALL
-->C:\Windows\UNRecode.exe /UNINSTALL
-->D:\Program Files\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
-->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7B9AE66C-2A8F-4FB2-85D7-416AFFAE8408}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x9
-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AA9944C8-7D34-475E-8C90-2788685B2C47}\setup.exe" -l0x9 /remove
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
7-Zip 4.57-->"C:\Program Files\7-Zip\Uninstall.exe"
AC3Filter (remove only)-->D:\Program Files\AC3Filter\uninstall.exe
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop 7.0-->C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Adobe\Photoshop 7.0\Uninst.isu" -c"C:\Program Files\Adobe\Photoshop 7.0\Uninst.dll"
Adobe Reader 8.1.4-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81300000003}
Adobe Shockwave Player 11-->C:\Windows\system32\adobe\SHOCKW~1\UNWISE.EXE C:\Windows\system32\Adobe\SHOCKW~1\Install.log
AnyDVD-->"C:\Program Files\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Program Files\SlySoft\AnyDVD"
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Aspell English Dictionary-0.50-2-->"C:\Program Files\Aspell\unins001.exe"
Audacity 1.2.6-->"C:\Program Files\Audacity\unins000.exe"
Audiosurf Demo-->"C:\Program Files\Steam\steam.exe" steam://uninstall/12910
AVG 8.5-->C:\Program Files\AVG\AVG8\setup.exe /UNINSTALL
AVIcodec (remove only)-->"D:\Program Files\AVIcodec\uninst.exe"
Battlefield 2142-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ED50ECE9-EC54-4C05-B5ED-EE4741A9F2EC}\setup.exe" -l0x9 -removeonly
BF2 G15 Mod 1.0.1-->"D:\Program Files\BF2G15Mod\icons\unins000.exe"
BitPim 1.0.5-->"D:\Program Files\BitPim\unins000.exe"
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CloneDVD-->"C:\Program Files\Elaborate Bytes\CloneDVD\CloneDVD-uninst.exe" /D="C:\Program Files\Elaborate Bytes\CloneDVD"
Coupon Printer for Windows-->"C:\Program Files\Coupons\uninstall.exe" "/U:C:\Program Files\Coupons\Uninstall\uninstall.xml"
Creative Audio Console-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{7B9AE66C-2A8F-4FB2-85D7-416AFFAE8408}\setup.exe" -l0x9 /remove
DH Driver Cleaner Professional Edition-->C:\Program Files\Driver Cleaner Pro\Uninstall.exe
DivX Codec-->C:\Program Files\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->C:\Program Files\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->C:\Program Files\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->C:\Program Files\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Program Files\DivX\DivXWebPlayerUninstall.exe /PLUGIN
ERUNT 1.1j-->"C:\Program Files\ERUNT\unins000.exe"
F.E.A.R. 2: Project Origin-->"C:\Program Files\Steam\steam.exe" steam://uninstall/16450
FW LiveUpdate-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11F5D779-7BD9-465A-BBC4-10701386BCB9}\setup.exe" -l0x9 -removeonly
Gears of War-->".:\Gears of War\unins000.exe"
GNU Aspell 0.50-3-->"C:\Program Files\Aspell\unins000.exe"
Google Earth-->MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
GTK+ Runtime 2.14.7 rev a (remove only)-->C:\Program Files\Common Files\GTK\2.0\uninst.exe
Guitar Pro 5.2-->"C:\Program Files\Guitar Pro 5\unins000.exe"
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Customer Participation Program 9.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 9.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{B22C19AE-6A67-4f28-B541-5AE72FB17A25}\setup\hpzscr01.exe -datfile hposcr15.dat
HP Photosmart Essential 3.0-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Smart Web Printing-->MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7}
HP Solution Center 9.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}
HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
iDump (Build: 28)-->"C:\Program Files\EscSoft\iDump\uninstall.exe"
iTunes-->MsiExec.exe /I{318AB667-3230-41B5-A617-CB3BF748D371}
Java(TM) 6 Update 12-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) 6 Update 2-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160020}
Java(TM) 6 Update 3-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160030}
Java(TM) 6 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160040}
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
Kaze to Desktop 1.0.1-->"C:\Program Files\Kaze to Desktop\unins000.exe"
K-Lite Codec Pack 3.3.0 Standard-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Logitech G-series Keyboard Software-->MsiExec.exe /X{5A080213-5AEC-4BF2-BB32-796EB0E421EC}
Logitech iTouch Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{036AA4D4-6D32-11D4-9875-00105ACE7734}\Setup.exe" -l0x9 UNINSTALL
Magic ISO Maker v5.4 (build 0256)-->C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB929729)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M929729\M929729Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}
Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
MobileMe Control Panel-->MsiExec.exe /I{6DA9102E-199F-43A0-A36B-6EF48081A658}
Mozilla Firefox (3.0.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.21)-->C:\Program Files\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
Nero 7 Ultra Edition-->MsiExec.exe /I{235BBFC6-D863-4066-A01A-3BD504C31033}
Netflix Movie Viewer-->MsiExec.exe /X{BCE72AED-3332-4863-9567-C5DCB9052CA2}
NVIDIA Drivers-->C:\Windows\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
OpenAL-->"C:\Program Files\OpenAL\OALInst.exe" /U
OpenOffice.org 3.0-->MsiExec.exe /I{F44DA61E-720D-4E79-871F-F6E628B33242}
Pidgin-->C:\Program Files\Pidgin\pidgin-uninst.exe
PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u
QuickTime-->MsiExec.exe /I{F958CA02-BB40-4007-894B-258729456EE4}
RivaTuner v2.06-->"D:\Program Files\RivaTuner v2.06\uninstall.exe"
Security Update for Excel 2007 (KB946974)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {85E83E2E-AF9B-439B-B4F9-EB9B7EF6A00E}
Security Update for Microsoft Office Publisher 2007 (KB950114)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F9C3CDBA-1F00-4D4D-959D-75C9D3ACDD85}
Security Update for Microsoft Office system 2007 (KB951808)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {8F375E11-4FD6-4B89-9E2B-A76D48B51E00}
Security Update for Microsoft Office Word 2007 (KB950113)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {AD72BABE-C733-4FCF-9674-4314466191B9}
Security Update for Office 2007 (KB934062)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33}
Security Update for Office 2007 (KB947801)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {02B5A17B-01BE-4BA6-95F1-1CBB46EBC76E}
Security Update for Outlook 2007 (KB946983)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {66B9496E-C0C3-4065-9868-85CCA92126C3}
Security Update for the 2007 Microsoft Office System (KB936960)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5E5BD655-7AA9-47F9-BB6D-A1D8CE29AC86}
Security Update for Visio 2007 (KB947590)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {6BAD036C-261F-4BEF-96CF-C20678D07A41}
SkyForceReloaded-->C:\Windows\WindowsMobile\SkyForceReloaded\Uninstall.exe SkyForceReloaded
SoulSeek Client 156c-->"C:\Program Files\Soulseek\uninstall.exe"
SpeechRedist-->MsiExec.exe /X{8795CBED-55E2-4693-9F14-84EC446935BE}
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Team Fortress 2-->"C:\Program Files\Steam\steam.exe" steam://uninstall/440
Update for Office 2007 (KB932080)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
Update for Office 2007 (KB946691)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {A420F522-7395-4872-9882-C591B4B92278}
Update for Outlook 2007 Junk Email Filter (kb950378)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F6296086-AED5-4EC0-938B-08EA0254F20E}
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
VideoLAN VLC media player 0.8.6i-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Viewpoint Media Player-->C:\Program Files\Viewpoint\Viewpoint Experience Technology\mtsAxInstaller.exe /u
ViewSonic Monitor Drivers-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48963B63-7A10-49D6-8B08-61E6132453D0}\Setup.exe" -l0x9
ViewSonic Windows Vista Signed Files-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FC47C7A5-BE63-11D5-B7C9-005004566E4D}\Setup.exe" -l0x9
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\Windows\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
WinASO Registry Optimizer 4.2-->"C:\Program Files\WinASO\Registry Optimizer\unins000.exe"
Window Washer-->C:\Windows\Unwash6.exe
Windows Live Messenger-->MsiExec.exe /I{571700F0-DB9D-4B3A-B03D-35A14BB5939F}
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Mobile Device Center Driver Update-->MsiExec.exe /X{E7044E25-3038-4A76-9064-344AC038043E}
Windows Mobile Device Center-->MsiExec.exe /X{904CCF62-818D-4675-BC76-D37EB399F917}
Windows Resource Kit Tools - SubInAcl.exe-->MsiExec.exe /X{D3EE034D-5B92-4A55-AA02-2E6D0A6A96EE}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
Xfire (remove only)-->"C:\Program Files\Xfire\uninst.exe"
Yahoo! Messenger-->C:\PROGRA~1\Yahoo!\MESSEN~1\UNWISE.EXE /U C:\PROGRA~1\Yahoo!\MESSEN~1\INSTALL.LOG

======Hosts File======

127.0.0.1 jL.chura.pl
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com

======Security center information======

AV: AVG Anti-Virus Free
AS: AVG Anti-Virus Free (disabled)
AS: Spybot - Search and Destroy (disabled) (outdated)
AS: Windows Defender

======System event log======

Computer Name: Stephen-PC
Event Code: 49
Message: Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
Record Number: 64135
Source Name: volmgr
Time Written: 20090326235430.046875-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 10000
Message: Unable to start a DCOM Server: {56EA1054-1959-467F-BE3B-A2A787C4B6EA}. The error:
"2"
Happened while starting this command:
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Record Number: 64137
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20090326235449.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 10000
Message: Unable to start a DCOM Server: {AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}. The error:
"2"
Happened while starting this command:
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
Record Number: 64139
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20090326235512.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 10000
Message: Unable to start a DCOM Server: {56EA1054-1959-467F-BE3B-A2A787C4B6EA}. The error:
"2"
Happened while starting this command:
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
Record Number: 64140
Source Name: Microsoft-Windows-DistributedCOM
Time Written: 20090326235520.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 1048
Message: Terminal Service start failed. The relevant status code was Error: 0xc004f027.
Record Number: 64141
Source Name: LSM
Time Written: 20090326235529.000000-000
Event Type: Error
User:

=====Application event log=====

Computer Name: Stephen-PC
Event Code: 1000
Message:
Record Number: 28291
Source Name: Application Error
Time Written: 20090325185426.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 1001
Message: The Software Licensing service failed to start. hr=0xC004D401, [2, 4]
Record Number: 28315
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20090326184958.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 1000
Message:
Record Number: 28321
Source Name: Application Error
Time Written: 20090326185013.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 1001
Message: The Software Licensing service failed to start. hr=0xC004D401, [2, 4]
Record Number: 28344
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20090326235451.000000-000
Event Type: Error
User:

Computer Name: Stephen-PC
Event Code: 1000
Message:
Record Number: 28350
Source Name: Application Error
Time Written: 20090326235500.000000-000
Event Type: Error
User:

=====Security event log=====

Computer Name: Stephen-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 68342
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090323100540.633457-000
Event Type: Audit Success
User:

Computer Name: Stephen-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: STEPHEN-PC$
Account Domain: <EDITED LAST NAME>
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x24c
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 68343
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090323100604.543532-000
Event Type: Audit Success
User:

Computer Name: Stephen-PC
Event Code: 4624
Message: An account was successfully logged on.

Subject:
Security ID: S-1-5-18
Account Name: STEPHEN-PC$
Account Domain: <EDITED LAST NAME>
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x24c
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 68344
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090323100604.543532-000
Event Type: Audit Success
User:

Computer Name: Stephen-PC
Event Code: 4672
Message: Special privileges assigned to new logon.

Subject:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 68345
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090323100604.543532-000
Event Type: Audit Success
User:

Computer Name: Stephen-PC
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Subject:
Security ID: S-1-5-18
Account Name: STEPHEN-PC$
Account Domain: <EDITED LAST NAME>
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x24c
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 68346
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090323102035.025356-000
Event Type: Audit Success
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Microsoft SQL Server\80\Tools\Binn\;C:\Program Files\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=x86
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=0f07
"NUMBER_OF_PROCESSORS"=4
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Logfile of random's system information tool 1.06 (written by random/random)
Run by Stephen at 2009-03-26 19:57:39
Microsoft® Windows Vista™ Home Premium
System drive C: has 7 GB (10%) free of 71 GB
Total RAM: 2046 MB (57% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:58:16 PM, on 3/26/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16757)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Logitech\G-series Software\LGDCore.exe
C:\Program Files\Logitech\G-series Software\LCDMon.exe
C:\Windows\System32\CtHelper.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
D:\Program Files\Reader\reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Users\Stephen\Desktop\RSIT.exe
C:\Program Files\trend micro\Stephen.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Launch LGDCore] "C:\Program Files\Logitech\G-series Software\LGDCore.exe" /SHOWHIDE
O4 - HKLM\..\Run: [Launch LCDMon] "C:\Program Files\Logitech\G-series Software\LCDMon.exe"
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [ElbyCheckAnyDVD] "C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe" /L AnyDVD
O4 - HKLM\..\Run: [CloneDVDElbyDelay] "C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" /L ElbyDelay
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -noicon
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DevconDefaultDB] C:\Windows\system32\READREG /SILENT /FAIL=1 (User 'Default user')
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://dl.tvunetworks.com/TVUAx.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/VistaMSNPUplden-us.cab
O16 - DPF: {8BC53B30-32E4-4ED3-BEF9-DB761DB77453} (CInstallLPCtrl Object) - http://u3.sandisk.com/download/apps/LPInstaller.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{36902B9B-219E-439D-9B33-540C1E709F71}: NameServer = 24.29.103.15,24.29.103.16
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NBService - Nero AG - D:\Program Files\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

--
End of file - 8876 bytes

======Scheduled tasks folder======

C:\Windows\tasks\Ad-Aware Update (Weekly).job
C:\Windows\tasks\User_Feed_Synchronization-{8F7E58D7-2B56-4E06-B6F4-578A071173E8}.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}]
AVG Safe Search

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
Groove GFS Browser Helper - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-03-05 35840]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
""= []
"Launch LGDCore"=C:\Program Files\Logitech\G-series Software\LGDCore.exe [2006-03-06 1142784]
"Launch LCDMon"=C:\Program Files\Logitech\G-series Software\LCDMon.exe [2006-03-06 514560]
"CTHelper"=C:\Windows\system32\CTHELPER.EXE [2007-04-09 37376]
"CTxfiHlp"=C:\Windows\system32\CTXFIHLP.EXE [2007-04-09 37376]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 69632]
"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016]
"hpqSRMon"=C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe [2008-06-02 99328]
"AppleSyncNotifier"=C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [2008-09-03 111936]
"Adobe Reader Speed Launcher"=D:\Program Files\Reader\Reader_sl.exe [2008-10-15 39792]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2008-11-20 290088]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2009-02-09 13683232]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2009-02-09 92704]
"Windows Mobile Device Center"=C:\Windows\WindowsMobile\wmdc.exe [2007-05-31 648072]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-03-05 148888]
"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2007-07-25 1006264]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2008-11-04 434176]
"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 176128]
"ElbyCheckAnyDVD"=C:\Program Files\SlySoft\AnyDVD\ElbyCheck.exe [2003-09-20 65536]
"CloneDVDElbyDelay"=C:\Program Files\Elaborate Bytes\CloneDVD\ElbyCheck.exe [2002-11-02 65536]
"AVG8_TRAY"=C:\PROGRA~1\AVG\AVG8\avgtray.exe [2009-03-11 1932568]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2006-11-02 219136]
"DAEMON Tools"=C:\Program Files\DAEMON Tools\daemon.exe [2007-04-03 165784]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

C:\Users\Stephen\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
OpenOffice.org 2.4.lnk - C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="avgrsstx.dll"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"EnableLUA"=0
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Windows\system32\winlogon.exe"="C:\Windows\system32\winlogon.exe:*:enabled

shell32.dll,-1"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42b14064-3cc6-11dc-8e2d-00044b056e58}]
shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42b14066-3cc6-11dc-8e2d-00044b056e58}]
shell\AutoRun\command - I:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52d6983-3ca8-11dc-8385-00044b056e58}]
shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52d6985-3ca8-11dc-8385-00044b056e58}]
shell\AutoRun\command - I:\CD_Start.exe

======File associations======

.txt - open - notepad.exe %1

======List of files/folders created in the last 1 months======

2009-03-26 19:57:40 ----D---- C:\Program Files\trend micro
2009-03-26 19:57:39 ----DC---- C:\rsit
2009-03-25 22:55:44 ----D---- C:\Users\Stephen\AppData\Roaming\Malwarebytes
2009-03-25 22:55:39 ----D---- C:\ProgramData\Malwarebytes
2009-03-25 22:55:39 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-03-22 14:17:38 ----D---- C:\Windows\ERDNT
2009-03-22 14:17:00 ----D---- C:\Program Files\ERUNT
2009-03-13 14:50:32 ----D---- C:\ProgramData\Windows Genuine Advantage
2009-03-12 22:47:34 ----AC---- C:\tmuninst.ini
2009-03-12 22:47:24 ----DC---- C:\VIRUS
2009-03-12 14:05:24 ----HDC---- C:\$AVG8.VAULT$
2009-03-11 18:51:59 ----A---- C:\Windows\system32\avgrsstx.dll
2009-03-10 21:54:45 ----D---- C:\Users\Stephen\AppData\Roaming\gtk-2.0
2009-03-10 21:48:57 ----D---- C:\Users\Stephen\AppData\Roaming\.purple
2009-03-10 21:48:39 ----D---- C:\Program Files\Aspell
2009-03-10 21:48:19 ----D---- C:\Program Files\Pidgin
2009-03-10 21:48:16 ----D---- C:\Program Files\Common Files\GTK
2009-03-10 08:40:56 ----D---- C:\ProgramData\Spybot - Search & Destroy
2009-03-10 08:40:56 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-03-10 08:19:43 ----D---- C:\Program Files\WinASO
2009-03-10 06:06:16 ----DC---- C:\temp
2009-03-10 06:06:01 ----A---- C:\Windows\system32\tmpxccacj1.exe
2009-03-09 22:57:24 ----DC---- C:\Swsetup
2009-03-09 20:35:16 ----D---- C:\ProgramData\avg8
2009-03-09 20:35:16 ----D---- C:\Program Files\AVG
2009-03-09 19:57:21 ----A---- C:\Windows\system32\tcpd.exe
2009-03-09 19:57:21 ----A---- C:\Windows\system32\tcpd.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\Packer.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\kernel32_check.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\iphy.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\fiplock.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\fhpatch.dll
2009-03-09 19:57:21 ----A---- C:\Windows\system32\AUTMGR.EXE
2009-03-09 19:56:51 ----A---- C:\Windows\system32\xcchit32.ini
2009-03-09 19:56:17 ----D---- C:\Windows\system32\inf
2009-03-09 19:56:17 ----A---- C:\Windows\xccwinsys.ini
2009-03-09 19:55:21 ----D---- C:\ProgramData\TEMP
2009-03-09 19:54:51 ----A---- C:\Windows\system32\BTCamVideoSource.dll

======List of files/folders modified in the last 1 months======

2009-03-26 19:57:52 ----D---- C:\Windows\Prefetch
2009-03-26 19:57:40 ----RD---- C:\Program Files
2009-03-26 19:56:56 ----D---- C:\Program Files\Mozilla Firefox
2009-03-26 19:55:16 ----D---- C:\Windows\Temp
2009-03-26 19:54:11 ----D---- C:\Windows\system32\drivers
2009-03-26 19:54:11 ----D---- C:\Windows
2009-03-26 19:53:07 ----A---- C:\Windows\{00000002-00000000-0000000A-00001102-00000004-20021102}.BAK
2009-03-26 19:51:32 ----D---- C:\Windows\System32
2009-03-25 22:55:39 ----HD---- C:\ProgramData
2009-03-24 23:04:27 ----D---- C:\Program Files\Soulseek
2009-03-24 22:44:19 ----D---- C:\Users\Stephen\AppData\Roaming\uTorrent
2009-03-21 21:26:37 ----SHD---- C:\Windows\Installer
2009-03-21 21:26:37 ----HDC---- C:\Config.Msi
2009-03-19 18:28:53 ----D---- C:\Program Files\Mozilla Thunderbird
2009-03-14 17:42:28 ----D---- C:\Program Files\Steam
2009-03-13 22:27:18 ----D---- C:\Program Files\Common Files\Steam
2009-03-13 07:41:59 ----D---- C:\Windows\system32\catroot2
2009-03-12 14:30:01 ----D---- C:\Windows\system
2009-03-11 19:09:10 ----D---- C:\Windows\inf
2009-03-11 19:09:10 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-03-11 02:54:53 ----A---- C:\Windows\win.ini
2009-03-10 22:08:26 ----SD---- C:\Windows\Downloaded Program Files
2009-03-10 21:48:16 ----D---- C:\Program Files\Common Files
2009-03-10 08:10:43 ----D---- C:\Windows\winsxs
2009-03-10 08:10:35 ----D---- C:\Windows\system32\catroot
2009-03-10 01:15:53 ----D---- C:\Windows\pss
2009-03-10 00:45:40 ----D---- C:\Program Files\Viewpoint
2009-03-10 00:45:39 ----D---- C:\ProgramData\Viewpoint
2009-03-09 23:32:37 ----D---- C:\Program Files\Lavasoft
2009-03-09 23:32:31 ----DC---- C:\Windows\system32\DRVSTORE
2009-03-09 22:53:25 ----HD---- C:\Program Files\InstallShield Installation Information
2009-03-09 22:42:53 ----D---- C:\Windows\system32\WDI
2009-03-09 22:30:29 ----D---- C:\Users\Stephen\AppData\Roaming\DisplayTune
2009-03-09 22:05:52 ----D---- C:\Windows\Tasks
2009-03-09 22:05:52 ----D---- C:\Windows\system32\Tasks
2009-03-09 21:32:28 ----D---- C:\Program Files\WinRAR
2009-03-09 20:23:45 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-03-09 19:57:21 ----A---- C:\Windows\system32\kernel32.dll
2009-03-05 08:17:41 ----A---- C:\Windows\system32\javaws.exe
2009-03-05 08:17:41 ----A---- C:\Windows\system32\javaw.exe
2009-03-05 08:17:41 ----A---- C:\Windows\system32\java.exe
2009-03-05 08:17:41 ----A---- C:\Windows\system32\deploytk.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AvgLdx86;AVG Free AVI Loader Driver x86; C:\Windows\System32\Drivers\avgldx86.sys [2009-03-11 325640]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86; C:\Windows\System32\Drivers\avgmfx86.sys [2009-03-11 27656]
R2 ElbyCDIO;ElbyCDIO Driver; C:\Windows\System32\Drivers\ElbyCDIO.sys [2003-09-15 9728]
R3 AnyDVD;AnyDVD; C:\Windows\System32\Drivers\AnyDVD.sys [2003-09-29 22912]
R3 COMMONFX.DLL;COMMONFX.DLL; C:\Windows\system32\COMMONFX.DLL [2007-04-18 98600]
R3 ctaud2k;Creative Audio Driver (WDM); C:\Windows\system32\drivers\ctaud2k.sys [2007-04-10 520488]
R3 CTAUDFX.DLL;CTAUDFX.DLL; C:\Windows\system32\CTAUDFX.DLL [2007-04-12 546048]
R3 ctprxy2k;Creative Proxy Driver; C:\Windows\system32\drivers\ctprxy2k.sys [2007-04-10 14632]
R3 CTSBLFX.DLL;CTSBLFX.DLL; C:\Windows\system32\CTSBLFX.DLL [2007-04-12 560384]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\Windows\system32\drivers\ctsfm2k.sys [2007-04-10 157480]
R3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2006-11-02 131584]
R3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2006-11-02 16384]
R3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2006-11-02 36864]
R3 ElbyDelay;ElbyDelay; C:\Windows\System32\Drivers\ElbyDelay.sys [2003-03-28 3840]
R3 emupia;E-mu Plug-in Architecture Driver; C:\Windows\system32\drivers\emupia2k.sys [2007-04-10 92968]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\System32\Drivers\GEARAspiWDM.sys [2008-04-17 15464]
R3 ha10kx2k;Creative Hardware Abstract Layer Driver; C:\Windows\system32\drivers\ha10kx2k.sys [2007-04-10 797992]
R3 hap16v2k;Creative P16V HAL Driver; C:\Windows\system32\drivers\hap16v2k.sys [2007-04-10 163112]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\Windows\system32\DRIVERS\nvmfdx32.sys [2007-11-18 1040544]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2009-02-09 7764672]
R3 ossrv;Creative OS Services Driver; C:\Windows\system32\drivers\ctoss2k.sys [2007-04-10 126760]
R3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
R3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]
S3 agdxzcy2;agdxzcy2; C:\Windows\system32\drivers\agdxzcy2.sys []
S3 CT20XUT.DLL;CT20XUT.DLL; C:\Windows\system32\CT20XUT.DLL [2007-04-12 164608]
S3 ctac32k;Creative AC3 Software Decoder; C:\Windows\system32\drivers\ctac32k.sys [2007-04-10 511272]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\Windows\system32\drivers\ctdvda2k.sys [2007-04-10 347128]
S3 CTEAPSFX.DLL;CTEAPSFX.DLL; C:\Windows\system32\CTEAPSFX.DLL [2007-04-12 168192]
S3 CTEDSPFX.DLL;CTEDSPFX.DLL; C:\Windows\system32\CTEDSPFX.DLL [2007-04-12 280320]
S3 CTEDSPIO.DLL;CTEDSPIO.DLL; C:\Windows\system32\CTEDSPIO.DLL [2007-04-12 128768]
S3 CTEDSPSY.DLL;CTEDSPSY.DLL; C:\Windows\system32\CTEDSPSY.DLL [2007-04-12 323328]
S3 CTERFXFX.DLL;CTERFXFX.DLL; C:\Windows\system32\CTERFXFX.DLL [2007-04-12 94976]
S3 CTEXFIFX.DLL;CTEXFIFX.DLL; C:\Windows\system32\CTEXFIFX.DLL [2007-04-12 1317632]
S3 CTHWIUT.DLL;CTHWIUT.DLL; C:\Windows\system32\CTHWIUT.DLL [2007-04-12 66816]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 hap17v2k;Creative P17V HAL Driver; C:\Windows\system32\drivers\hap17v2k.sys [2007-04-10 189736]
S3 itchfltr;iTouch Keyboard Filter; C:\Windows\system32\DRIVERS\itchfltr.sys [2004-03-10 12953]
S3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\Windows\system32\DRIVERS\mcdbus.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 RivaTuner32;RivaTuner32; \??\D:\Program Files\RivaTuner v2.06\RivaTuner32.sys [2007-10-30 9088]
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM); C:\Windows\system32\DRIVERS\sscdbus.sys [2005-08-17 58352]
S3 sscdmdfl;SAMSUNG CDMA Modem Filter; C:\Windows\system32\DRIVERS\sscdmdfl.sys [2005-08-17 8272]
S3 sscdmdm;SAMSUNG CDMA Modem Drivers; C:\Windows\system32\DRIVERS\sscdmdm.sys [2005-08-17 93872]
S3 sscdserd;SAMSUNG CDMA Modem Diagnostic Serial Port (WDM); C:\Windows\system32\DRIVERS\sscdserd.sys [2005-08-17 73696]
S3 usb_rndisx;USB RNDIS Adapter; C:\Windows\system32\DRIVERS\usb8023x.sys [2006-11-02 14848]
S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2008-10-01 32000]
S3 WINUSB;WinUsb Driver; C:\Windows\system32\DRIVERS\WinUSB.SYS [2006-11-02 31616]
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2006-11-02 39936]
S3 wrssweep;Webroots Volume Access Driver; \??\C:\Program Files\Webroot\Washer\wrssweep.sys [2007-11-26 21832]
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [2006-11-02 11264]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-11-07 132424]
R2 avg8wd;AVG Free8 WatchDog; C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2009-03-11 298264]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-08-29 238888]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2009-02-09 207392]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2007-08-25 66872]
R2 RapiMgr;@%windir%\WindowsMobile\rapimgr.dll,-104; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 SBSDWSCService;SBSD Security Center Service; C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
R2 WcesComm;@%windir%\WindowsMobile\wcescomm.dll,-40079; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-11-20 536872]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 90112]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 MSSQL$SONY_MEDIAMGR;MSSQL$SONY_MEDIAMGR; D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlservr.exe [2002-12-17 7520337]
S3 MSSQLServerADHelper;MSSQLServerADHelper; C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqladhlp.exe [2002-12-17 66112]
S3 NBService;NBService; D:\Program Files\Nero 7\Nero BackItUp\NBService.exe [2006-11-10 794624]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 SQLAgent$SONY_MEDIAMGR;SQLAgent$SONY_MEDIAMGR; D:\Program Files\Sony\Shared Plug-Ins\Media Manager\MSSQL$SONY_MEDIAMGR\Binn\sqlagent.EXE [2002-12-17 311872]
S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-03-12 316664]
S3 usnjsvc;Messenger Sharing Folders USN Journal Reader service; C:\Program Files\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S4 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 81920]
S4 wwEngineSvc;Window Washer Engine; C:\Program Files\Webroot\Washer\WasherSvc.exe [2007-11-26 598856]

-----------------EOF-----------------

katana · Mar 27, 2009

==============================WARNING==============================
There is some evidence of what may be a very nasty infection.
If the Computer has been used for any important data, you are strongly advised to do the following, immediately:

If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account numbers.
From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
Take any other steps you think appropriate for an attempted identity theft.

==============================WARNING==============================

REMOVE P2P PROGRAMS

IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

Soulseek
uTorrent

Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.
The bad guys use P2P filesharing as a major conduit to spread their wares.

Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.

----------------------------------------------------------- -----------------------------------------------------------

Download and Run ComboFix (by sUBs)
Please visit this webpage for instructions for downloading and running ComboFix:

Bleeping Computer ComboFix Tutorial

You must download it to and run it from your Desktop
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply
Re-enable all the programs that were disabled during the running of ComboFix..

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Logs/Information to Post in Reply
Please post the following logs/Information in your reply

Combofix Log
Kaspersky Log
How are things running now ?

malfee · Mar 27, 2009

I just finished running both ComboFix and Kaspersky, so here are the logs. My computer seems to be running just as it was before, but I have not yet rebooted, if that matters at all. I attempted to print a document, but received the same error that I had been prior to scanning everything. I'll await your next instructions.

ComboFix 09-03-26.03 - Stephen 2009-03-27 11:36:48.1 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2046.1452 [GMT -4:00]
Running from: c:\users\Stephen\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\AutoRun.inf
c:\windows\system32\fhpatch.dll
c:\windows\system32\fiplock.dll
c:\windows\system32\iphy.dll
c:\windows\system32\kernel32_check.dll
c:\windows\system32\tcpd.dll
c:\windows\system32\tmpxccacj1.exe
c:\windows\system32\xcchit32.ini
c:\windows\xccwinsys.ini

.
((((((((((((((((((((((((( Files Created from 2009-02-27 to 2009-03-27 )))))))))))))))))))))))))))))))
.

2009-03-26 19:57 . 2009-03-26 19:58 <DIR> d----c--- C:\rsit
2009-03-26 19:57 . 2009-03-26 19:58 <DIR> d-------- c:\program files\trend micro
2009-03-25 22:55 . 2009-03-25 22:55 <DIR> d-------- c:\users\Stephen\AppData\Roaming\Malwarebytes
2009-03-25 22:55 . 2009-03-25 22:55 <DIR> d-------- c:\users\All Users\Malwarebytes
2009-03-25 22:55 . 2009-03-25 22:55 <DIR> d-------- c:\programdata\Malwarebytes
2009-03-25 22:55 . 2009-03-25 22:55 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-03-25 22:55 . 2009-02-11 10:19 38,496 --a------ c:\windows\System32\drivers\mbamswissarmy.sys
2009-03-25 22:55 . 2009-02-11 10:19 15,504 --a------ c:\windows\System32\drivers\mbam.sys
2009-03-22 14:17 . 2009-03-22 14:17 <DIR> d-------- c:\program files\ERUNT
2009-03-13 14:50 . 2009-03-13 14:50 <DIR> d-------- c:\users\All Users\Windows Genuine Advantage
2009-03-12 22:47 . 2009-03-12 22:47 <DIR> d----c--- C:\VIRUS
2009-03-12 22:47 . 2009-03-12 22:47 21 --a--c--- C:\tmuninst.ini
2009-03-12 14:05 . 2009-03-22 12:57 <DIR> d--h-c--- C:\$AVG8.VAULT$
2009-03-11 18:51 . 2009-03-24 17:47 <DIR> d-------- c:\windows\System32\drivers\Avg
2009-03-11 18:51 . 2009-03-11 18:51 325,640 --a------ c:\windows\System32\drivers\avgldx86.sys
2009-03-11 18:51 . 2009-03-11 18:51 10,520 --a------ c:\windows\System32\avgrsstx.dll
2009-03-10 21:54 . 2009-03-21 17:21 <DIR> d-------- c:\users\Stephen\AppData\Roaming\gtk-2.0
2009-03-10 21:48 . 2009-03-27 11:25 <DIR> d-------- c:\users\Stephen\AppData\Roaming\.purple
2009-03-10 21:48 . 2009-03-10 21:48 <DIR> d-------- c:\program files\Pidgin
2009-03-10 21:48 . 2009-03-10 21:48 <DIR> d-------- c:\program files\Common Files\GTK
2009-03-10 21:48 . 2009-03-10 21:48 <DIR> d-------- c:\program files\Aspell
2009-03-10 08:40 . 2009-03-10 17:59 <DIR> d-------- c:\users\All Users\Spybot - Search & Destroy
2009-03-10 08:40 . 2009-03-10 17:59 <DIR> d-------- c:\programdata\Spybot - Search & Destroy
2009-03-10 08:40 . 2009-03-10 08:40 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2009-03-10 08:19 . 2009-03-10 08:19 <DIR> d-------- c:\program files\WinASO
2009-03-10 06:06 . 2009-03-26 19:54 <DIR> d----c--- C:\temp
2009-03-09 22:57 . 2009-03-09 22:57 <DIR> d----c--- C:\Swsetup
2009-03-09 20:35 . 2009-03-11 18:51 <DIR> d-------- c:\users\All Users\avg8
2009-03-09 20:35 . 2009-03-11 18:51 <DIR> d-------- c:\programdata\avg8
2009-03-09 20:35 . 2009-03-09 20:35 <DIR> d-------- c:\program files\AVG
2009-03-09 19:57 . 2009-03-09 19:57 61,440 --a------ c:\windows\System32\tcpd.exe
2009-03-09 19:57 . 2009-03-09 19:57 18,944 --a------ c:\windows\System32\AUTMGR.EXE
2009-03-09 19:57 . 2009-03-09 19:57 10,240 --a------ c:\windows\System32\Packer.dll
2009-03-09 19:56 . 2009-03-26 19:51 <DIR> d-------- c:\windows\System32\inf
2009-03-09 19:55 . 2009-03-09 19:55 <DIR> d-------- c:\users\All Users\TEMP
2009-03-09 19:55 . 2009-03-09 19:55 <DIR> d-------- c:\programdata\TEMP
2009-03-09 19:54 . 2007-09-20 13:04 114,688 --a------ c:\windows\System32\BTCamVideoSource.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-27 15:12 --------- d-----w c:\program files\Steam
2009-03-27 14:58 --------- d-----w c:\program files\Soulseek
2009-03-25 02:44 --------- d-----w c:\users\Stephen\AppData\Roaming\uTorrent
2009-03-19 22:28 --------- d-----w c:\program files\Mozilla Thunderbird
2009-03-14 02:27 --------- d-----w c:\program files\Common Files\Steam
2009-03-10 04:45 --------- d-----w c:\programdata\Viewpoint
2009-03-10 04:45 --------- d-----w c:\program files\Viewpoint
2009-03-10 03:32 --------- d-----w c:\program files\Lavasoft
2009-03-10 02:53 --------- d--h--w c:\program files\InstallShield Installation Information
2009-03-10 02:30 --------- d-----w c:\users\Stephen\AppData\Roaming\DisplayTune
2009-03-10 00:23 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-03-05 12:17 410,984 ----a-w c:\windows\System32\deploytk.dll
2009-02-27 01:01 162,816 ----a-w c:\windows\System32\fmod.dll
2009-02-27 00:43 --------- d-----w c:\program files\Microsoft ActiveSync
2009-02-26 20:15 --------- d-----w c:\users\Stephen\AppData\Roaming\OpenOffice.org
2009-02-26 20:12 --------- d-----w c:\program files\OpenOffice.org 3
2009-02-26 20:12 --------- d-----w c:\program files\OpenOffice.org 2.4
2009-02-26 20:12 --------- d-----w c:\program files\JRE
2009-02-26 20:00 --------- d-----w c:\users\Stephen\AppData\Roaming\OpenOffice.org2
2009-02-26 06:41 --------- d-----w c:\program files\Microsoft.NET
2009-02-26 06:11 --------- d-----w c:\program files\Audacity
2009-02-26 03:01 --------- d-----w c:\program files\Windows Resource Kits
2009-02-26 02:57 --------- d-----w c:\programdata\Apple Computer
2009-02-21 22:26 --------- d-----w c:\programdata\Media Center Programs
2009-02-19 22:50 --------- d-----w c:\programdata\NVIDIA
2009-02-19 22:47 --------- d-----w c:\program files\AGEIA Technologies
2009-02-13 19:21 --------- d-----w c:\program files\EscSoft
2009-02-05 15:54 453,152 ----a-w c:\windows\System32\nvuninst.exe
2009-02-04 03:07 --------- d-----w c:\users\Stephen\AppData\Roaming\Thunderbird
2009-01-16 23:24 70,936 ----a-w c:\windows\System32\PhysXLoader.dll
2008-11-01 22:38 174 --sha-w c:\program files\desktop.ini
2008-05-04 03:37 22,328 ----a-w c:\users\Stephen\AppData\Roaming\PnkBstrK.sys
2007-07-26 05:15 769,536 ----a-w c:\users\Stephen\AppData\Roaming\sfdnwin.dll
2000-06-05 21:47 32,768 ----a-w c:\program files\mozilla firefox\plugins\AppSub32.dll
2008-03-24 03:15 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\UserData\index.dat
.

------- Sigcheck -------

2007-11-14 03:19 2940928 5b3e5c7ba8b31a9e684c23c8f2bf53c7 c:\windows\explorer.exe
2006-11-02 05:45 2940928 ddc26e1cd32bfb498deb4662811f5ea2 c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16386_none_4f7de5167cd15deb\explorer.exe
2007-11-14 03:19 2940928 5b3e5c7ba8b31a9e684c23c8f2bf53c7 c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16549_none_4fac29707cae347a\explorer.exe
2007-11-14 03:19 2940928 00cfe6f69923a9d3e3f2d566e1e7e9e9 c:\windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20668_none_501f261995dcf2cf\explorer.exe

2006-11-02 05:45 26112 988de27a1af636a9924004d25485bb26 c:\windows\System32\ctfmon.exe
2006-11-02 05:45 26112 988de27a1af636a9924004d25485bb26 c:\windows\winsxs\x86_microsoft-windows-t..cesframework-ctfmon_31bf3856ad364e35_6.0.6000.16386_none_9af9cad793a67953\ctfmon.exe

2006-11-02 05:45 41984 9530d2075160ee21521be01b70d97c88 c:\windows\System32\userinit.exe
2006-11-02 05:45 41984 9530d2075160ee21521be01b70d97c88 c:\windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe

2009-03-09 19:57 874496 30dac7abd9a407e0e1532b9abb40a0fe c:\windows\System32\kernel32.dll
2006-11-02 05:46 874496 1e36ae445e4da83b82d51feb2d4f8772 c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6000.16386_none_91872345596077da\kernel32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-11-02 219136]
"DAEMON Tools"="c:\program files\DAEMON Tools\daemon.exe" [2007-04-03 165784]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Launch LGDCore"="c:\program files\Logitech\G-series Software\LGDCore.exe" [2006-03-06 1142784]
"Launch LCDMon"="c:\program files\Logitech\G-series Software\LCDMon.exe" [2006-03-06 514560]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 69632]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-27 31016]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-06-02 99328]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-03 111936]
"Adobe Reader Speed Launcher"="d:\program files\Reader\Reader_sl.exe" [2008-10-15 39792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-02-09 13683232]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-02-09 92704]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-05 148888]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 434176]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 176128]
"ElbyCheckAnyDVD"="c:\program files\SlySoft\AnyDVD\ElbyCheck.exe" [2003-09-20 65536]
"CloneDVDElbyDelay"="c:\program files\Elaborate Bytes\CloneDVD\ElbyCheck.exe" [2002-11-02 65536]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-11 1932568]
"CTHelper"="CTHELPER.EXE" [2007-04-09 c:\windows\System32\CtHelper.exe]
"CTxfiHlp"="CTXFIHLP.EXE" [2007-04-09 c:\windows\System32\Ctxfihlp.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DevconDefaultDB"="c:\windows\system32\READREG" [X]
"nidle"="c:\windows\system32\config\systemprofile\AppData\Roaming\nidle\nidle.exe" [2009-03-09 77824]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-07-25 131072]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.i420"= i420vfw.dll
"msacm.ac3filter"= ac3filter.acm
"VIDC.XFR1"= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Antivirus-ashDisp.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Antivirus-ashserv.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\Antivirus-ashSimpl.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\avesvc.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\bdmcon.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\bdnagent.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\bdswitch.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\image file execution options\DefWatch.exe]
"Debugger"=c:\windows\system32\alg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-719362987-505877805-2150120177-1000]
"EnableNotificationsRef"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{7862A670-224A-4305-9699-06F0D3150D6B}"= UDP:c:\program files\Steam\Steam.exe:Steam Client
"{F19BE53A-154A-4722-B32F-3DAB022B9AA0}"= TCP:c:\program files\Steam\Steam.exe:Steam Client
"{8A33361F-033E-4BDF-9995-4CAECFA15446}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{06B069B7-9095-4496-B62D-E80AD14D7380}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"TCP Query User{BA4A981B-C5F0-4707-9DDF-690EB4D6BFA6}c:\\program files\\aim6\\aim6.exe"= UDP:c:\program files\aim6\aim6.exe:AIM
"UDP Query User{149093CE-CA75-4C31-8C8B-FB5C97162946}c:\\program files\\aim6\\aim6.exe"= TCP:c:\program files\aim6\aim6.exe:AIM
"TCP Query User{DBF729F4-B191-48E6-9D92-B53939849764}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\day of defeat source\\hl2.exe"= UDP:c:\program files\steam\steamapps\altrigun@yahoo.com\day of defeat source\hl2.exe:hl2
"UDP Query User{47A2AD72-1BC0-41E3-B6FD-5CA2A6613A8F}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\day of defeat source\\hl2.exe"= TCP:c:\program files\steam\steamapps\altrigun@yahoo.com\day of defeat source\hl2.exe:hl2
"TCP Query User{CCB0A119-C12F-4796-83FD-3A86334E9CAC}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\counter-strike source\\hl2.exe"= UDP:c:\program files\steam\steamapps\altrigun@yahoo.com\counter-strike source\hl2.exe:hl2
"UDP Query User{8F8751B9-7554-4A82-975C-C522E97F5541}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\counter-strike source\\hl2.exe"= TCP:c:\program files\steam\steamapps\altrigun@yahoo.com\counter-strike source\hl2.exe:hl2
"TCP Query User{80FF5706-861E-42E8-ADD7-4CF1AFE922FA}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\half-life 2 deathmatch\\hl2.exe"= UDP:c:\program files\steam\steamapps\altrigun@yahoo.com\half-life 2 deathmatch\hl2.exe:hl2
"UDP Query User{6C65952F-49A5-4ECE-B1E4-D3E9A268B4F6}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\half-life 2 deathmatch\\hl2.exe"= TCP:c:\program files\steam\steamapps\altrigun@yahoo.com\half-life 2 deathmatch\hl2.exe:hl2
"TCP Query User{6525029C-1BF0-427A-B20F-14651F66BC86}d:\\program files\\azureus\\azureus.exe"= UDP:d:\program files\azureus\azureus.exe:Azureus
"UDP Query User{A845CB87-CD8B-4D82-AAC8-D126621B7AE9}d:\\program files\\azureus\\azureus.exe"= TCP:d:\program files\azureus\azureus.exe:Azureus
"TCP Query User{1F7E6527-FA3B-4278-9749-93E7F21B2D9F}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\source sdk base\\hl2.exe"= UDP:c:\program files\steam\steamapps\altrigun@yahoo.com\source sdk base\hl2.exe:hl2
"UDP Query User{09DB3EC0-F7F0-4EEE-BB7F-A63E62877F66}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\source sdk base\\hl2.exe"= TCP:c:\program files\steam\steamapps\altrigun@yahoo.com\source sdk base\hl2.exe:hl2
"{EA849728-922E-439F-B97A-C7564D3E6EDD}"= UDP:c:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"{43ACB36C-6170-4BF4-94CF-194DCE1CA1B7}"= TCP:c:\program files\EA GAMES\Battlefield 2\BF2.exe:Battlefield 2
"TCP Query User{384C4DA0-102A-46C8-A546-18435C7E788F}c:\\program files\\itunes\\itunes.exe"= UDP:c:\program files\itunes\itunes.exe:iTunes
"UDP Query User{0E758134-7E47-466D-A813-C31A4B9F44D0}c:\\program files\\itunes\\itunes.exe"= TCP:c:\program files\itunes\itunes.exe:iTunes
"TCP Query User{74E44A36-34A0-43D5-8F74-A9108E4E9AAE}c:\\program files\\soulseek\\slsk.exe"= UDP:c:\program files\soulseek\slsk.exe:SoulSeek
"UDP Query User{E7C0678D-9DA8-4CAD-B691-689E03A94016}c:\\program files\\soulseek\\slsk.exe"= TCP:c:\program files\soulseek\slsk.exe:SoulSeek
"{1BF85BD7-AC26-4F0B-8D5F-B85F52951D7E}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{9C69F411-516E-4363-A81C-89914CE97AFC}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{67781A1E-ED94-4386-8644-7B1779561E99}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{DA7979A7-9A74-4192-BE1D-E33B3E24FDEA}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"TCP Query User{C2DCF9D7-E09D-4569-805E-9B3A61DF7576}c:\\program files\\xfire\\xfire.exe"= UDP:c:\program files\xfire\xfire.exe:Xfire
"UDP Query User{90FEE6AE-9417-4B6E-A070-3D9547418CEE}c:\\program files\\xfire\\xfire.exe"= TCP:c:\program files\xfire\xfire.exe:Xfire
"TCP Query User{C2E44D37-989F-439F-872D-032CCD8A9EBC}d:\\program files\\aim6\\aim6.exe"= UDP:d:\program files\aim6\aim6.exe:AIM
"UDP Query User{157CAF92-2BB0-4718-B631-2D97D9547AC0}d:\\program files\\aim6\\aim6.exe"= TCP:d:\program files\aim6\aim6.exe:AIM
"TCP Query User{70E2065B-4116-49FA-AC2F-FA22A1883323}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= UDP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"UDP Query User{27FE47F7-2A5C-4B68-BD9B-2AFAC264ECEE}c:\\program files\\activision\\call of duty 2\\cod2mp_s.exe"= TCP:c:\program files\activision\call of duty 2\cod2mp_s.exe:CoD2MP_s
"{9930004D-C6BA-4B04-991B-5AC9492CE899}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{7989BBDB-DEC9-45C0-A0BC-C3ED2247AB0A}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent
"{242385C8-3ED6-4483-B2DE-47E4602947C2}"= UDP:c:\ut2004\System\UT2004.exe:UT2004
"{D23262AA-61CE-4518-A817-E528AC43EBF9}"= TCP:c:\ut2004\System\UT2004.exe:UT2004
"{066C79FE-5B46-4722-809B-9E89F944C5CF}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{0EDB91C7-897E-450C-B71E-08B77C5FD8EE}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{32F23FE5-145C-48E8-B489-27578DCCB26B}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{498EE006-B237-4558-ABDD-1930264DD9B6}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\team fortress 2\\hl2.exe"= UDP:c:\program files\steam\steamapps\altrigun@yahoo.com\team fortress 2\hl2.exe:hl2
"UDP Query User{F60FA93A-118B-4E8D-A42E-5BB4A6ECF1D4}c:\\program files\\steam\\steamapps\\altrigun@yahoo.com\\team fortress 2\\hl2.exe"= TCP:c:\program files\steam\steamapps\altrigun@yahoo.com\team fortress 2\hl2.exe:hl2
"TCP Query User{438ACC86-5EF4-472F-862A-0026B0F5C144}c:\\program files\\mozilla firefox\\firefox.exe"= UDP:c:\program files\mozilla firefox\firefox.exe:Firefox
"UDP Query User{D8BB8B0E-4E1B-4B4C-B810-C57636A98484}c:\\program files\\mozilla firefox\\firefox.exe"= TCP:c:\program files\mozilla firefox\firefox.exe:Firefox
"{A0865704-A5AB-4E69-9749-94AB72BAE473}"= UDP:c:\windows\System32\PnkBstrA.exe

nkBstrA
"{E84D6225-6791-4CC7-B7DC-B8B14A74E9AF}"= TCP:c:\windows\System32\PnkBstrA.exe

nkBstrA
"{43B68E9D-CFD8-4196-BA1E-58F9E4E2659E}"= UDP:c:\windows\System32\PnkBstrB.exe

nkBstrB
"{C531F333-DD08-4A19-89AB-FDD1885CDEBD}"= TCP:c:\windows\System32\PnkBstrB.exe

nkBstrB
"TCP Query User{C5FBB017-5EB2-4743-901A-2B009EA0DECB}c:\\program files\\gamespy\\comrade\\comrade.exe"= UDP:c:\program files\gamespy\comrade\comrade.exe:Comrade
"UDP Query User{456C6769-B760-44BE-A703-E7D7F91C32BE}c:\\program files\\gamespy\\comrade\\comrade.exe"= TCP:c:\program files\gamespy\comrade\comrade.exe:Comrade
"{AFFBF251-D36F-4B2E-AB3E-E3991372FFCF}"= UDP:c:\program files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{724189B9-99AE-4596-A940-27D325969C50}"= TCP:c:\program files\Electronic Arts\Battlefield 2142\BF2142.exe:Battlefield 2
"{EEDA8D87-7F09-44E9-A5F9-486F497AAEA9}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{0FF0A1EB-E015-4108-A83D-5F7183E25CA2}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{1C1D1C20-52AF-4582-9541-CB70947691B6}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{B02FA78C-1755-47AA-99D8-0928AC40AB3A}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{5077F775-74FA-4AF8-AD51-819B63011BA8}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{E62951EE-01EC-45DB-85F2-68D501B4D983}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{96CE03B8-690F-4CDB-B9CB-C04B2C915A8E}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{1AB93C16-F847-47CE-9D0A-EB83A179B8E0}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{CB4553E7-72A5-4D86-8D01-1CC3C0644DC3}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:Crysis_32
"{90F040FE-A730-4781-A8AD-9F06634B5795}"= UDP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"{D6F7E439-0A2A-4BFE-B5FA-A087706B4AC9}"= TCP:c:\program files\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:CrysisDedicatedServer_32
"TCP Query User{5EC248C1-BAE3-40D4-8EA1-2AED4F0EEBE7}c:\\program files\\ubisoft\\rainbow six vegas\\binaries\\r6vegas_game.exe"= UDP:c:\program files\ubisoft\rainbow six vegas\binaries\r6vegas_game.exe:R6Vegas_Game
"UDP Query User{F7D2B852-5A00-47E9-BA3E-2A0ACE530ACF}c:\\program files\\ubisoft\\rainbow six vegas\\binaries\\r6vegas_game.exe"= TCP:c:\program files\ubisoft\rainbow six vegas\binaries\r6vegas_game.exe:R6Vegas_Game
"TCP Query User{5F10ECED-027D-4C35-BA3D-78D800FE6506}c:\\users\\stephen\\desktop\\gearssss\\gears of war\\binaries\\wargame-g4wlive.exe"= UDP:c:\users\stephen\desktop\gearssss\gears of war\binaries\wargame-g4wlive.exe:wargame-g4wlive.exe
"UDP Query User{CD8F10D4-C62E-4FFE-A690-62FDDEC3D772}c:\\users\\stephen\\desktop\\gearssss\\gears of war\\binaries\\wargame-g4wlive.exe"= TCP:c:\users\stephen\desktop\gearssss\gears of war\binaries\wargame-g4wlive.exe:wargame-g4wlive.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\System32\drivers\avgldx86.sys [2009-03-11 325640]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-11 298264]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-03-10 1153368]
S3 wrssweep;Webroots Volume Access Driver;c:\program files\Webroot\Washer\wrSSweep.sys [2008-10-13 21832]
S4 wwEngineSvc;Window Washer Engine;c:\program files\Webroot\Washer\WasherSvc.exe [2008-10-13 598856]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\shell\AutoRun\command - J:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42b14064-3cc6-11dc-8e2d-00044b056e58}]
\shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{42b14066-3cc6-11dc-8e2d-00044b056e58}]
\shell\AutoRun\command - I:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52d6983-3ca8-11dc-8385-00044b056e58}]
\shell\AutoRun\command - H:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c52d6985-3ca8-11dc-8385-00044b056e58}]
\shell\AutoRun\command - I:\CD_Start.exe
.
Contents of the 'Scheduled Tasks' folder

2009-03-24 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []

2009-03-27 c:\windows\Tasks\User_Feed_Synchronization-{8F7E58D7-2B56-4E06-B6F4-578A071173E8}.job
- c:\windows\system32\msfeedssync.exe [2006-11-02 05:45]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: steampowered.com
Trusted Zone: steampowered.com\store
TCP: {36902B9B-219E-439D-9B33-540C1E709F71} = 24.29.103.15,24.29.103.16
FF - ProfilePath - c:\users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\9sqtk8kz.default\
FF - component: c:\users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\9sqtk8kz.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\WINNT_x86-msvc\components\ipc.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NpIpx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF - plugin: c:\users\Stephen\AppData\Roaming\Mozilla\Firefox\Profiles\9sqtk8kz.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: d:\program files\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-27 11:39:15
Windows 6.0.6000 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTHelper = CTHELPER.EXE?
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(720)
c:\program files\Bonjour\mdnsNSP.dll
.
Completion time: 2009-03-27 11:41:19
ComboFix-quarantined-files.txt 2009-03-27 15:41:15

Pre-Run: 7,435,919,360 bytes free
Post-Run: 7,879,610,368 bytes free

305 --- E O F --- 2008-11-01 22:33:38

malfee · Mar 27, 2009

The Kaspersky log appears to be too long for me to post, and also too big for me to attach to a post here. What do you suggest I do? I suppose that I can copy the log in increments until it all fits on here in multiple posts.

katana · Mar 27, 2009

malfee said:
The Kaspersky log appears to be too long for me to post, and also too big for me to attach to a post here.

I've sent you a PM with an e-mail address to send the log to

malfee · Mar 28, 2009

katana said:
I've sent you a PM with an e-mail address to send the log to

Ok, I've sent the log to the address. Just a little update, I had thought that my Vista Counterfeit error had been fixed, but I received the error earlier tonight randomly. :sad:

Thanks for all of your help, Katana.

katana · Mar 28, 2009

VIRUT

Infected objects: 1646
Infected: Virus.Win32.Virut.ce

This machine needs to be formatted.

This system is infected with a polymorphic file infector called Virut. Virut is capable of infecting all the machine's executable files (.exe) and screensaver files (.scr). However, the problem is that the virus has a number of bugs in its code, and as a result, it may misinfect a proportion of executable files and therefore, the files are corrupted beyond repair. As of now, security experts suggest that a format and clean install, or destructive recovery if you have an OEM recovery partition, is the best way to clean the infection and it is the best and safest way to return the machine to its normal working state.

Backup all your documents and important items (personal data, work documents, etc) only. DO NOT backup any executable files (softwares) and screensavers (*.scr). It attempts to infect any accessed .exe or .scr files by appending itself to the executable.

Also, avoid backing up compressed files (zip/cab/rar) files that have .exe or .scr files inside them. Virut can penetrate and infect .exe files inside compressed files too.

Recent variants also modify htm, html, asp and php files.

Do not back up to another machine, as it may become compromised. Burn to DVD/CD, or to an external drive which has nothing else on it, and which you can format should it happen to become infected from the backups.

See miekiemoes' blog for similar comments here:
http://miekiemoes.blogspot.com/2009/02/virut-and-other-file-infectors-throwing.html

malfee · Mar 28, 2009

Ahh, I thought it might come to this. :/ Oh well, I guess I have to go searching for my Vista disc around here. Thanks for all of the help Katana, you've been really great.

Just another question: how seriously should I consider changing all of my passwords, especially for financial sites? After I read that portion of your message yesterday, I started handwriting down a list of all of my current passwords tied to each account, but my mother also has used my computer quite often to pay bills, making payments through PayPal, etc., and it seems as though it would be quite the hassle to call up our banks to notify them of a possible breach. If you advise it, I will proceed with your instructions, but I'm of course looking for a way to make this as simple as possible.

Thanks again!

katana · Mar 28, 2009

it seems as though it would be quite the hassle to call up our banks to notify them of a possible breach. If you advise it, I will proceed with your instructions, but I'm of course looking for a way to make this as simple as possible.

I'm sorry to say, the newer versions of this infection do bring a lot of password stealing nasties.
There is evidence of two in your MalwareBytes log

C:\temp\svchost.exe (Backdoor.Bot)
C:\Windows\System32\sopidkc.exe (Backdoor.Bot)

So, even though it may be a hassle, I suspect that it is worth the effort.

----------------------------------------------------------- -----------------------------------------------------------

The following is some info to help you stay safe and clean after your reformat.

You may already have some of the following programs, but I include the full list for the benefit of all the other people who will be reading this thread in the future.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.pandasecurity.com/activescan
http://www.kaspersky.com/kos/eng/partner/71706/kavwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

AntiSpyware is not the same thing as Antivirus.
Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
Most of the programs in this list have a free (for Home Users ) and paid versions,
it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
Spybot - Search & Destroy <<< A must have program
- It includes host protection and registry protection
- A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
MalwareBytes Anti-malware <<< A New and effective program
a-squared Free <<< A good "realtime" or "on demand" scanner
superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

These programs don't detect malware, they help stop it getting on your machine in the first place.
Each does a different job, so you can have more than one
Winpatrol
- An excellent startup manager and then some !!
- Notifies you if programs are added to startup
- Allows delayed startup
- A must have addition
SpywareBlaster 4.0
- SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
SpywareGuard 2.2
- SpywareGuard provides real-time protection against spyware.
- Not required if you have other "realtime" antispyware or Winpatrol
ZonedOut
- Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
MVPS HOSTS
- This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
- For information on how to download and install, please read this tutorial by WinHelp2002.
- Not required if you are using other host file protections

Internet Browsers

Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
Using a different web browser can help stop malware getting on your machine.
- Make your Internet Explorer more secure - This can be done by following these simple instructions:
  1. From within Internet Explorer click on the Tools menu and then click on Options.
  2. Click once on the Security tab
  3. Click once on the Internet icon so it becomes highlighted.
  4. Click once on the Custom Level button.
    - Change the Download signed ActiveX controls to Prompt
    - Change the Download unsigned ActiveX controls to Disable
    - Change the Initialise and script ActiveX controls not marked as safe to Disable
    - Change the Installation of desktop items to Prompt
    - Change the Launching programs and files in an IFRAME to Prompt
    - Change the Navigate sub-frames across different domains to Prompt
    - When all these settings have been made, click on the OK button.
    - If it prompts you as to whether or not you want to save the settings, press the Yes button.
  5. Next press the Apply button and then the OK to exit the Internet Properties page.
If you are still using IE6 then either update, or get one of the following.
- FireFox
  - With many addons available that make customization easy this is a very popular choice
  - NoScript and AdBlockPlus addons are essential
- Opera
  - Another popular alternative
- Netscape
  - Another popular alternative
  - Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

Temporary Internet Files are mainly the files that are downloaded when you open a web page.
Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
It is a good idea to empty the Temporary Internet Files folder on a regular basis.

Tracking Cookies are files that websites use to monitor which sites you visit and how often.
A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords

Both of these can be cleaned manually, but a quicker option is to use a program
ATF Cleaner
- Free and very simple to use
CCleaner
- Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.....So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again

If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

malfee · Mar 28, 2009

Alright, I just spent a bit of time searching for my Vista disc, but I haven't found it yet. Hopefully I'll find it within the next few days, otherwise I'm afraid that I may have to purchase a new copy. :sad: Once I reformat I'll post back here.

malfee · Mar 28, 2009

UPDATE: I've just found my Vista disc and will be reformatting within the next day or so. Yay. =)

malfee · Mar 30, 2009

So I've reformatted and reinstalled almost everything that I had before, and my computer is running flawlessly again. No more Windows counterfeit scares, no more printer errors, etc. I did have one mild scare as I was copying files from a flash thumb drive of mine onto my newly formatted hard drive. I remembered that you had said NOT to backup any .exe files, or anything of that sort, and I hadn't. However, I completely forgot that on my thumb drive there exists this .exe file that runs automatically upon connection with a PC. When I connected my thumb drive to my newly formatted PC, AVG was able to detect and quarantine the Virut malware before it did any harm (or at least, it seems not to have cause any harm). If you'd like me to run one last final scan to be sure that I'm clean, please advise me. Otherwise, I'm a happy camper.

Thanks again!

katana · Mar 30, 2009

It's best to perform an online scan in these situations.

Please ensure that any USB/Flash/External drives are connected whilst we are cleaning your machine.

Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html

Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.

**Note**

To optimize scanning time and produce a more sensible report for review:

Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

Malware causing printer problems, Vista "counterfeit" detection, etc.

malfee

New member

katana

Security Expert-Emeritus

malfee

New member

katana

Security Expert-Emeritus

malfee

New member

malfee

New member

katana

Security Expert-Emeritus

malfee

New member

katana

Security Expert-Emeritus

malfee

New member

katana

Security Expert-Emeritus

malfee

New member

malfee

New member

malfee

New member

katana

Security Expert-Emeritus