something in my system 32, creating pop ups

[NELSONdeltaZERO]

I'm sure there are other things invading as well but the main thing that comes up is a system 32 message and immediately after a blank pop up appears, it's driving me crazy because it happens frequently, please help me

here is my hijack this log

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:46:41 PM, on 1/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {0EEE9E78-5204-0E18-0778-4CC620930E82} - C:\WINDOWS\system32\cdmdownld\eyornvfqrw.dll (file missing)
O2 - BHO: (no name) - {124CD448-4EFE-6E08-AECA-61A3EAFEFFBC} - C:\WINDOWS\system32\ddlwm.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {E1136B38-D27C-4BE5-9339-DEB3861841FF} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [SpybotSD TeaTimer] "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [RecordNow!] (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Owner')
O4 - HKUS\S-1-5-21-4146988369-3849773923-3652654320-1003\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User 'Owner')
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O20 - Winlogon Notify: ddcddcc - C:\WINDOWS\
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7810 bytes

 

[ken545]

Hello

Welcome to Safer Networking.

Please read Before You Post
All advice given by anyone volunteering here, is taken at own risk.
While best efforts are made to assist in removing infections safely, unexpected stuff can happen

Your infected with the Vundo Trojan and another trojan that we need to remove.


You need to disable the Tea Timer in Spybot Search and Destroy or it may prevent the fixes from taking.

1. Run Spybot-S&D in Advanced Mode.
2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
3. On the left hand side, Click on Tools
4. Then click on the Resident Icon in the List
5. Uncheck "Resident TeaTimer" and OK any prompts.
6. Restart your computer.

===================================

Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

O2 - BHO: (no name) - {0EEE9E78-5204-0E18-0778-4CC620930E82} - C:\WINDOWS\system32\cdmdownld\eyornvfqrw.dll (file missing)
O2 - BHO: (no name) - {124CD448-4EFE-6E08-AECA-61A3EAFEFFBC} - C:\WINDOWS\system32\ddlwm.dll (file missing)
O2 - BHO: (no name) - {E1136B38-D27C-4BE5-9339-DEB3861841FF} - (no file)

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O20 - Winlogon Notify: ddcddcc - C:\WINDOWS\


========================================

Download VundoFix to your desktop

• Double-click VundoFix.exe to run it.
• Click the Scan for Vundo button.
• Once it's done scanning, click the Remove Vundo button.
• You will receive a prompt asking if you want to remove the files, click YES
• Once you click yes, your desktop will go blank as it starts removing Vundo.
• When completed, it will prompt that it will reboot your computer, click OK.
• Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.

Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.


===================================


Download ComboFix from Here or Here to your Desktop.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Double click combofix.exe and follow the prompts.
• When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall



I need to see the Vundofix log, the Combofix log and a New HJT log please

 

[NELSONdeltaZERO]

still getting pop up

im still getting the blank pop up, but here are the 3 logs

VundoFix V6.7.7

Checking Java version...

Scan started at 10:03:11 PM 1/22/2008

Listing files found while scanning....

C:\windows\system32\awtss.dll
C:\windows\system32\awvvu.dll
C:\windows\system32\ddcyw.dll
C:\windows\system32\gebya.dll
C:\windows\system32\jkhff.dll
C:\windows\system32\jkhhh.dll
C:\windows\system32\mllmk.dll
C:\windows\system32\mllml.dll
C:\windows\system32\mllmm.dll
C:\windows\system32\pmkjk.dll
C:\windows\system32\ssqrs.dll
C:\windows\system32\sstqp.dll
C:\windows\system32\ssttq.dll
C:\windows\system32\ssttt.dll
C:\windows\system32\sstwa.ini
C:\windows\system32\sstwa.ini2
C:\windows\system32\vturq.dll

Beginning removal...

Attempting to delete C:\windows\system32\awtss.dll
C:\windows\system32\awtss.dll Has been deleted!

Attempting to delete C:\windows\system32\awvvu.dll
C:\windows\system32\awvvu.dll Has been deleted!

Attempting to delete C:\windows\system32\ddcyw.dll
C:\windows\system32\ddcyw.dll Has been deleted!

Attempting to delete C:\windows\system32\gebya.dll
C:\windows\system32\gebya.dll Has been deleted!

Attempting to delete C:\windows\system32\jkhff.dll
C:\windows\system32\jkhff.dll Has been deleted!

Attempting to delete C:\windows\system32\jkhhh.dll
C:\windows\system32\jkhhh.dll Has been deleted!

Attempting to delete C:\windows\system32\mllmk.dll
C:\windows\system32\mllmk.dll Has been deleted!

Attempting to delete C:\windows\system32\mllml.dll
C:\windows\system32\mllml.dll Has been deleted!

Attempting to delete C:\windows\system32\mllmm.dll
C:\windows\system32\mllmm.dll Has been deleted!

Attempting to delete C:\windows\system32\pmkjk.dll
C:\windows\system32\pmkjk.dll Has been deleted!

Attempting to delete C:\windows\system32\ssqrs.dll
C:\windows\system32\ssqrs.dll Has been deleted!

Attempting to delete C:\windows\system32\sstqp.dll
C:\windows\system32\sstqp.dll Has been deleted!

Attempting to delete C:\windows\system32\ssttq.dll
C:\windows\system32\ssttq.dll Has been deleted!

Attempting to delete C:\windows\system32\ssttt.dll
C:\windows\system32\ssttt.dll Has been deleted!

Attempting to delete C:\windows\system32\sstwa.ini
C:\windows\system32\sstwa.ini Has been deleted!

Attempting to delete C:\windows\system32\sstwa.ini2
C:\windows\system32\sstwa.ini2 Has been deleted!

Attempting to delete C:\windows\system32\vturq.dll
C:\windows\system32\vturq.dll Has been deleted!

Performing Repairs to the registry.
Done!


ComboFix 08-01-23.1 - Kim 2008-01-22 22:27:00.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.222 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\ComboFix(2).exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\temp\tn3
C:\WINDOWS\system32\awtqn.dll
C:\WINDOWS\system32\awtss.exe
C:\WINDOWS\system32\awtusrp.dll
C:\WINDOWS\system32\ddayv.dll
C:\WINDOWS\system32\drivers\core.cache(2).dsk
C:\WINDOWS\system32\drivers\core.cache(3).dsk
C:\WINDOWS\system32\drivers\core.cache(4).dsk
C:\WINDOWS\system32\drivers\core.cache(5).dsk
C:\WINDOWS\system32\drivers\core.cache(6).dsk
C:\WINDOWS\system32\drivers\core.cache(7).dsk
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkkjhhh.dll
C:\WINDOWS\system32\mljge.dll
C:\WINDOWS\system32\mljji.dll
C:\WINDOWS\system32\nnnnomj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhf.dll
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmnnk.dll
C:\WINDOWS\system32\qqtss.ini2
C:\WINDOWS\system32\RCX21.tmp
C:\WINDOWS\system32\RCX22.tmp
C:\WINDOWS\system32\RCX23.tmp
C:\WINDOWS\system32\RCX24.tmp
C:\WINDOWS\system32\RCX44.tmp
C:\WINDOWS\system32\RCX45.tmp
C:\WINDOWS\system32\RCX46.tmp
C:\WINDOWS\system32\wcpsu.exe
D:\Autorun.inf
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-22 22:33 . 2008-01-22 22:33 <DIR> d-------- C:\temp\tn3
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 22:03 . 2008-01-22 22:03 <DIR> d-------- C:\VundoFix Backups
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-18 04:02 . 2008-01-18 04:02 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-17 16:01 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-12 14:18 . 2008-01-12 15:52 39,936 --a------ C:\WINDOWS\17PHolmes572.exe
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05 .exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray .exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd .exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon .exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv .exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-10 01:41 . 2008-01-10 01:41 86,016 --a------ C:\WINDOWS\system32\drivers\ati1xbxxx.sys
2008-01-10 01:41 . 2008-01-22 22:32 932 --------- C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 43,387 --a------ C:\WINDOWS\browser.exe
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-22 19:42 --------- d-----w C:\Program Files\Yahoo!
2008-01-17 20:11 --------- d-----w C:\Program Files\WildTangent
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-15 21:46 127,034 ------r C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
.

<pre>
----a-w            53,248 2008-01-12 08:27:00  C:\hp\bin\AUTOTKIT .EXE
----a-w            61,440 2008-01-12 08:27:13  C:\hp\KBD\KBD .EXE
----a-w            75,128 2008-01-12 08:27:07  C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w           368,706 2008-01-12 08:27:17  C:\Program Files\BroadJump\Client Foundation\CFD .exe
----a-w           110,592 2008-01-12 08:26:59  C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w            24,576 2008-01-22 19:30:42  C:\Program Files\HP\Digital Imaging\bin\backupnotify .exe
----a-w            90,112 2008-01-12 08:26:56  C:\Program Files\HP\Digital Imaging\Unload\hpqcmon .exe
----a-w            49,152 2008-01-12 08:27:10  C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w           442,455 2008-01-22 19:31:22  C:\Program Files\SBC Self Support Tool\SmartBridge\MotiveSB .exe
----a-w         4,670,704 2008-01-11 01:50:35  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
----a-w         4,670,704 2008-01-22 19:32:06  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w           212,992 2008-01-12 08:27:01  C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w            52,736 2008-01-12 08:26:52  C:\WINDOWS\system\hpsysdrv .exe
----a-w           118,784 2008-01-15 13:44:35  C:\WINDOWS\system32\hkcmd .exe
----a-w           483,328 2008-01-15 13:44:41  C:\WINDOWS\system32\hphmon05 .exe
----a-w           155,648 2008-01-15 13:44:34  C:\WINDOWS\system32\igfxtray .exe
----a-w            99,840 2008-01-11 18:21:50  C:\WINDOWS\system32\M-AudioTaskBarIcon .exe
</pre>

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [ ]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [ ]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [ ]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-01-11 20:45 4898816]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-10 20:30 364032 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2006-04-04 14:42 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-01-11 20:45 4898816 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

R1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys [2008-01-10 01:41]
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-22 22:33:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-22 22:36:08 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-23 03:36:05
.
2008-01-22 09:02:07 --- E O F ---

 

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:37:13 PM, on 1/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\LTMSG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6716 bytes

 

[ken545]

NELSONdeltaZERO,

Let me explain how these forums work, we are all staffed by volunteers,we do this in our free time and the amount of infected computers is way out of hand, we cannot afford to have more than one person helping you.

http://www.techsupportforum.com/sec...702-constant-blank-popups-driving-me-mad.html
You posted here for help. Your are infected with a newer variant of the Vundo Trojan that includes a File Infector, if you want to continue here with me helping you than you need to have the courtesy to inform the the other forum that your being helped here, we all work together so its your call, if you want to continue here, notify them and then let me know. I really cant spare the time to help you if your being helped elsewhere.

 

[NELSONdeltaZERO]

sorry bout that, i wasnt trying to have more than one person help, i was just trying to find someone who would help. i posted that other thread 6 days ago so i figured they just ignored it. but i did let them know your helping me know.

 

[ken545]

OK Nelson, thanks for taking care of that.:bigthumb:

Lets proceed, if you look in the Code box in the Combofix log , all those files and programs are infected. It may take a few runs to get them all, the ones that cant be removed you may have to uninstall and reinstall the program, but lets worry about that in a bit.

Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad. Make sure there is not space above and to the left of File::

File::
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\temp\tn3
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe

Folder::
C:\VundoFix Backups

RenV::
----a-w 53,248 2008-01-12 08:27:00 C:\hp\bin\AUTOTKIT .EXE
----a-w 61,440 2008-01-12 08:27:13 C:\hp\KBD\KBD .EXE
----a-w 75,128 2008-01-12 08:27:07 C:\Program Files\Alwil Software\Avast4\ashDisp .exe
----a-w 368,706 2008-01-12 08:27:17 C:\Program Files\BroadJump\Client Foundation\CFD .exe
----a-w 110,592 2008-01-12 08:26:59 C:\Program Files\Common Files\Sonic\Update Manager\sgtray .exe
----a-w 24,576 2008-01-22 19:30:42 C:\Program Files\HP\Digital Imaging\bin\backupnotify .exe
----a-w 90,112 2008-01-12 08:26:56 C:\Program Files\HP\Digital Imaging\Unload\hpqcmon .exe
----a-w 49,152 2008-01-12 08:27:10 C:\Program Files\HP\HP Software Update\HPWuSchd2 .exe
----a-w 442,455 2008-01-22 19:31:22 C:\Program Files\SBC Self Support Tool\SmartBridge\MotiveSB .exe
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 212,992 2008-01-12 08:27:01 C:\WINDOWS\SMINST\RECGUARD .EXE
----a-w 52,736 2008-01-12 08:26:52 C:\WINDOWS\system\hpsysdrv .exe
----a-w 118,784 2008-01-15 13:44:35 C:\WINDOWS\system32\hkcmd .exe
----a-w 483,328 2008-01-15 13:44:41 C:\WINDOWS\system32\hphmon05 .exe
----a-w 155,648 2008-01-15 13:44:34 C:\WINDOWS\system32\igfxtray .exe
----a-w 99,840 2008-01-11 18:21:50 C:\WINDOWS\system32\M-AudioTaskBarIcon .exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

 

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-23 13:54:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.212 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\temp\tn3
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\awtss.dll.bad
C:\VundoFix Backups\awvvu.dll.bad
C:\VundoFix Backups\ddcyw.dll.bad
C:\VundoFix Backups\gebya.dll.bad
C:\VundoFix Backups\jkhff.dll.bad
C:\VundoFix Backups\jkhhh.dll.bad
C:\VundoFix Backups\mllmk.dll.bad
C:\VundoFix Backups\mllml.dll.bad
C:\VundoFix Backups\mllmm.dll.bad
C:\VundoFix Backups\pmkjk.dll.bad
C:\VundoFix Backups\ssqrs.dll.bad
C:\VundoFix Backups\sstqp.dll.bad
C:\VundoFix Backups\ssttq.dll.bad
C:\VundoFix Backups\ssttt.dll.bad
C:\VundoFix Backups\sstwa.ini.bad
C:\VundoFix Backups\sstwa.ini2.bad
C:\VundoFix Backups\vturq.dll.bad
C:\WINDOWS\17PHolmes572.exe
C:\WINDOWS\browser.exe
C:\WINDOWS\bwUnin-8.1.1.50-8876480SL.exe
C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\drivers\ati1xbxxx.sys
C:\WINDOWS\system32\drivers\core.cache.dsk

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-23 13:58 . 2008-01-23 13:58 <DIR> d-------- C:\temp\tn3
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
.

<pre>
----a-w         4,670,704 2008-01-11 01:50:35  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
----a-w         4,670,704 2008-01-22 19:32:06  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>

((((((((((((((((((((((((((((( snapshot@2008-01-22_22.35.51.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 03:26:39 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 03:26:40 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 03:26:40 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 03:26:40 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 03:26:40 3,985,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 03:26:40 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 18:54:28 4,001,792 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\ntuser.dat
+ 2008-01-23 18:54:28 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2008-01-23 14:32:10 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\ARPPRODUCTICON.exe
+ 2008-01-23 14:32:11 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut2_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2008-01-23 14:32:11 65,536 ----a-r C:\WINDOWS\Installer\{A654A805-41D9-40C7-AA46-4AF04F044D61}\NewShortcut3_4BDFD2CE632942E498019B3D1F10D79B.exe
+ 2008-01-23 14:35:36 295,606 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A81100000003}\SC_Reader.exe
- 2007-08-22 02:37:11 8,443 -c--a-w C:\WINDOWS\mozver.dat
+ 2008-01-23 14:30:07 8,935 -c--a-w C:\WINDOWS\mozver.dat
- 2008-01-11 01:30:54 560,128 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
+ 2008-01-23 15:43:14 212,992 ----a-w C:\WINDOWS\SMINST\RECGUARD.EXE
- 2008-01-18 09:14:21 323,520 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-01-23 14:38:01 327,504 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
- 2008-01-11 01:12:31 1,606,184 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-23 15:28:11 9,417,052 ----a-w C:\WINDOWS\system32\Restore\rstrlog.dat
+ 2008-01-23 19:16:57 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4ac.dat
+ 2006-06-05 19:14:28 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
+ 2006-06-05 19:14:28 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
+ 2006-06-05 19:14:28 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 14:17:38
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-23 14:21:05 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-23 19:21:02
ComboFix2.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

 

[NELSONdeltaZERO]

and heres the hijack this, also, in the combofix log it said something about yahoo messenger, my dad was complaining that his yahoo messenger was not working, when all this is fixed will it work again ?

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:25:33 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7056 bytes

 

[ken545]

Hello,

Yahoo Messenger is not working because its still infected, look in the code box.

Lets give it one more run, and if Combofix does not remove it than what your going to have to do is uninstall it completely and then do a clean download and install. Don't do that yet though.

Make sure Yahoo Messenger is closed



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad. Make sure there is no space above and to the left of RenV::

RenV::
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply
together with a new HijackThis log.

 

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-23 17:21:42.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.243 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\temp\tn3

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
.

<pre>
----a-w         4,670,704 2008-01-11 01:50:35  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
----a-w         4,670,704 2008-01-22 19:32:06  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>

((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-23 22:21:35 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-23 22:21:35 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-23 22:21:35 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-23 22:21:35 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-23 22:21:35 4,042,752 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 22:21:35 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"Yahoo! Pager"="1" []
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-08-30 17:43 4670704 C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 17:25:16
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-23 17:25:54
ComboFix-quarantined-files.txt 2008-01-23 22:25:46
ComboFix2.txt 2008-01-23 19:21:05
ComboFix3.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

 

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 5:27:15 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [Yahoo! Pager] 1
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 7016 bytes

 

[ken545]

Hello,

I am afraid your going to have to uninstall Yahoo Messenger, if you keep it its just going to reinfect you. After we are done you can do a fresh download and reinstall the program.

Remove this with HJT.
O4 - HKCU\..\Run: [Yahoo! Pager] 1

Try uninstalling Yahoo Messenger from the Add Remove Programs in the Control Panel.



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

Folder::
C:\Program Files\Yahoo

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

 

[NELSONdeltaZERO]

ComboFix 08-01-23.1 - Kim 2008-01-24 11:35:59.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.204 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe
C:\Program Files\inetget2
C:\Program Files\inetget2\FINAL -- Fort 5.6_MST-ONLY.exe
C:\Program Files\seekmo
C:\Program Files\seekmo\bin\10.0.406.0\HostOE.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAAX.dll
C:\Program Files\seekmo\bin\10.0.406.0\SeekmoSAHook.dll
C:\Program Files\Temporary
C:\Program Files\Temporary\kernInst.exe
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b116.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\b128.exe
C:\WINDOWS\b138.exe
C:\WINDOWS\b149.exe
C:\WINDOWS\b151.exe
C:\WINDOWS\mrofinu572.exe
C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\jkhfd.dll
C:\WINDOWS\system32\jkkhhhe.dll
C:\WINDOWS\system32\jkkjj.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pmkhg.dll
C:\WINDOWS\system32\pmkjh.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\ssqrs.dll
C:\WINDOWS\system32\vtutq.dll

.
((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-24 00:21 . 2008-01-24 00:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-24 00:13 . 2008-01-24 01:01 <DIR> d-------- C:\Program Files\Zango Programs
2008-01-23 23:32 . 2008-01-23 23:43 <DIR> d-------- C:\Program Files\RegCure
2008-01-23 22:52 . 2004-10-25 15:18 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2008-01-23 22:52 . 2003-05-19 16:07 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2008-01-23 22:40 . 2008-01-23 22:40 <DIR> d-------- C:\WINDOWS\system32\AEABB2AFB2B4B0B
2008-01-23 22:40 . 2007-12-14 07:40 120,832 --a------ C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
2008-01-23 21:34 . 2008-01-23 21:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\temp\cXzz9
2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 --a--c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:23 --------- d-----w C:\Program Files\MSN Messenger
2008-01-24 04:54 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-02 13:43 282,624 ----a-w C:\Program Files\TTC.dll
.

<pre>
----a-w         4,670,704 2008-01-11 01:50:35  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
----a-w         4,670,704 2008-01-22 19:32:06  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>

((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-24 16:34:59 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-24 16:34:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-24 16:34:59 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-24 16:34:59 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-24 16:34:59 4,501,504 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-24 16:35:00 4,050,944 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\ntuser.dat
+ 2008-01-24 16:35:00 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
+ 2008-01-24 05:22:06 29,926 ----a-r C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F}\MsblIco.Exe
- 2004-08-04 07:56:43 1,392,671 -c--a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-24 02:42:40 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2008-01-19 13:13:12 32,768 ----a-w C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
- 2005-10-12 22:11:06 118,784 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-01-19 17:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 1996-01-12 23:00:00 24,576 ----a-w C:\WINDOWS\system32\STKIT432.DLL
+ 2008-01-24 16:41:20 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_498.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2924BE2F-CDE4-48AE-B9D3-928C12909CE3}]
C:\Program Files\Internet Explorer\metocodoqC:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"F7F4FBF8FBFDF903F"="B1AEB5B2B5B7B3B.exe" [2007-12-14 07:40 120832 C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
"RegistryMechanic"="" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-24 04:32:45 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 08:00:00 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 11:41:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> C:\Program Files\Logitech\SetPoint\lgscroll.dll
.
Completion time: 2008-01-24 11:45:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-24 16:45:28
ComboFix2.txt 2008-01-23 22:25:55
ComboFix3.txt 2008-01-23 19:21:05
ComboFix4.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

 

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:46:12 AM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2924BE2F-CDE4-48AE-B9D3-928C12909CE3} - C:\Program Files\Internet Explorer\metocodoqC:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll (file missing)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [F7F4FBF8FBFDF903F] B1AEB5B2B5B7B3B.exe
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 7832 bytes

 

[ken545]

This garbage is getting harder and harder to remove. I need some feedback from you as to what you have done. Did you try to remove Yahoo from the Add Remove programs??

Go to VirusTotal and submit these files for analysis, just use the browse feature and then submit them , you will get a report back, post the report into this thread for me to see.

C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe




Download OTMoveIt and save it to your desktop

• Open OTMoveIt.exe.
• In the left pane where it says: "Paste List of Files/Folders to be Moved", copy and paste the files in the quote box including the full path
  
  

  C:\Program Files\TTC.dll

• Then click the MoveIt button below.
• In case you get a "Bad Image" error, just click OK at the promt. It will move the file anyway.
• When done, it will create a log (********_******.log -- * stands for date and time) in next folder: C:\_OTMoveIt\MovedFiles.
• Copy and paste this log in your next reply.

Please download F-Secure Blacklight (fsbl.exe) and save to your C:\ drive.

• Open a command window by going to Start > Run and typing: cmd
• Copy/paste or type the following in the command window: C:\fsbl.exe /expert
• Hit "Enter" to start the program and then close the cmd box.
• Accept the user agreement and click "Next".
• Click "Scan".
• After the scan is complete, click "Next", then "Exit".
• BlackLight will create a log in C:\ drive named "fsbl-xxxxxxx.log" (the xxxxxxx will be the date and time of the scan).
• The log will have a list of all items found. Do not choose to rename any yet!
  I want to see the log first because legitimate items can also be present...like "wbemtest.exe" and "tcptest.exe.
• Exit Blacklight and post the contents of the log in your next reply.

Note: If Blacklight does not work, rename fsbl.exe to zsbl.exe and try running it again.






Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from Kaspersky Online Virus Scanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
• Now click on Scan Settings
• In the scan settings make that the following are selected:
• Scan using the following Anti-Virus database:
• Standard
• Scan Options:
• Scan Archives
• Scan Mail Bases
• Click OK
• Now under select a target to scan: Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
• Now click on the Save as Text button:
• Save the file to your desktop.

Post the log along with a New HJT Log into your next reply.


Let me see the OtMoveIt log, the report from VirusTotal and the Kaspersky log please

 

[NELSONdeltaZERO]

i did remove yahoo messenger from the add/remove programs and the hijack this
i couldnt run the kaspersky because i dont have windows 6.0, where do i go to get that?
here are the other logs

Antivirus Version Last Update Result
AhnLab-V3 2008.1.25.10 2008.01.24 -
AntiVir 7.6.0.48 2008.01.24 -
Authentium 4.93.8 2008.01.24 -
Avast 4.7.1098.0 2008.01.23 -
AVG 7.5.0.516 2008.01.24 -
BitDefender 7.2 2008.01.24 -
CAT-QuickHeal 9.00 2008.01.24 -
ClamAV 0.91.2 2008.01.24 -
DrWeb 4.44.0.09170 2008.01.24 -
eSafe 7.0.15.0 2008.01.16 Suspicious File
eTrust-Vet 31.3.5483 2008.01.24 -
Ewido 4.0 2008.01.24 -
FileAdvisor 1 2008.01.24 -
Fortinet 3.14.0.0 2008.01.24 -
F-Prot 4.4.2.54 2008.01.24 W32/VB-Wird-based!Maximus
F-Secure 6.70.13260.0 2008.01.24 -
Ikarus T3.1.1.20 2008.01.24 Trojan-Spy.Win32.Banbra.z
Kaspersky 7.0.0.125 2008.01.24 Trojan-Downloader.Win32.VB.chy
McAfee 5215 2008.01.24 -
Microsoft 1.3109 2008.01.24 -
NOD32v2 2820 2008.01.24 -
Norman 5.80.02 2008.01.24 -
Panda 9.0.0.4 2008.01.24 Suspicious file
Prevx1 V2 2008.01.24 Heuristic: Suspicious File With Bad Child Associations
Rising 20.28.31.00 2008.01.24 -
Sophos 4.24.0 2008.01.24 -
Sunbelt 2.2.907.0 2008.01.23 -
Symantec 10 2008.01.24 -
TheHacker 6.2.9.196 2008.01.23 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.24 -
Additional information
File size: 120832 bytes
MD5: 2a51f6176a685c3205f6ca5d1220d0fe
SHA1: c6cee85fcbc65799fae36d2d1cf64f78cf831034
PEiD: -
packers: Aspack
packers: ASPack, PE_Patch
Prevx info: http://info.prevx.com/aboutprogramtext.asp?PX5=395D6A7E00874A26D86B01B7CA17F300DDE8FD42





LoadLibrary failed for C:\Program Files\TTC.dll
C:\Program Files\TTC.dll NOT unregistered.
C:\Program Files\TTC.dll moved successfully.

Created on 01/24/2008 17:46:26




01/24/08 18:01:53 [Info]: BlackLight Engine 1.0.67 initialized
01/24/08 18:01:53 [Info]: OS: 5.1 build 2600 (Service Pack 2)
01/24/08 18:01:53 [Note]: 7019 4
01/24/08 18:01:53 [Note]: 7005 0
01/24/08 18:01:59 [Note]: 7006 0
01/24/08 18:01:59 [Note]: 7011 2984
01/24/08 18:01:59 [Note]: 7026 0
01/24/08 18:01:59 [Note]: 7026 0
01/24/08 18:02:02 [Note]: FSRAW library version 1.7.1024
01/24/08 18:23:45 [Note]: 7007 0

 

[ken545]

Hi,

FYI Blacklight checks for hidden files and it did not find any.


Drag Combofix to the trash and download the latest version, don't run it yet.

Download ComboFix from Here to your Desktop.

**Note: In the event you already have Combofix, please delete it from your desktop and download this new version . It is important that it is saved directly to your desktop**



Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

File::
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
C:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2924BE2F-CDE4-48AE-B9D3-928C12909CE3}]

RenV::
----a-w 4,670,704 2008-01-11 01:50:35 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
----a-w 4,670,704 2008-01-22 19:32:06 C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe

Save this as CFScript to your desktop.

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.



You can download and install Internet Explorer 7 from here. It has a lot more security features than the older version. After you install it, run the Kaspersky online scan.
http://www.microsoft.com/windows/products/winfamily/ie/default.mspx

Let me see the New Combofix log, the Kaspersky log and a New HJT log

 

[NELSONdeltaZERO]

ComboFix 08-01-23.1C - Kim 2008-01-24 19:02:31.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.146 [GMT -5:00]
Running from: C:\Documents and Settings\Kim\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Kim\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\DOCUME~1\Owner\LOCALS~1\Temp\mst455101.exe.dll
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\awtss.dll
C:\WINDOWS\system32\B1AEB5B2B5B7B3B.exe

.
((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-24 18:49 . 2008-01-24 18:49 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-01-24 18:46 . 2008-01-24 18:46 <DIR> d-------- C:\WINDOWS\LastGood
2008-01-24 00:21 . 2008-01-24 00:21 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-01-24 00:13 . 2008-01-24 01:01 <DIR> d-------- C:\Program Files\Zango Programs
2008-01-23 23:32 . 2008-01-23 23:43 <DIR> d-------- C:\Program Files\RegCure
2008-01-23 22:52 . 2004-10-25 15:18 131,072 --a------ C:\WINDOWS\system32\ypclsp.dll
2008-01-23 22:52 . 2003-05-19 16:07 86,016 --a------ C:\WINDOWS\system32\YPcservice.exe
2008-01-23 22:40 . 2008-01-23 22:40 <DIR> d-------- C:\WINDOWS\system32\AEABB2AFB2B4B0B
2008-01-23 21:34 . 2008-01-23 21:34 <DIR> d-------- C:\Program Files\Dot1XCfg
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\WINDOWS\system32\nGpxx01
2008-01-23 21:31 . 2008-01-23 21:31 <DIR> d-------- C:\temp\cXzz9
2008-01-23 15:26 . 2008-01-23 15:26 <DIR> d-------- C:\Program Files\Google
2008-01-23 10:43 . 2008-01-23 10:43 827,392 --a------ C:\WINDOWS\system32\FLASH.OCX
2008-01-23 10:26 . 2008-01-23 10:26 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-01-22 22:25 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 22:18 . 2008-01-22 22:18 24,576 --a------ C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-22 14:42 . 2001-10-11 11:26 65,536 --a------ C:\WINDOWS\system32\YCRWin32.dll
2008-01-17 16:48 . 2007-07-09 08:09 584,192 --a--c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2008-01-17 16:42 . 2008-01-17 16:42 <DIR> d-------- C:\Deckard
2008-01-17 16:00 . 2008-01-23 10:25 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-01-17 15:18 . 2008-01-17 15:18 164 --a------ C:\install.dat
2008-01-15 08:50 . 2008-01-15 08:50 <DIR> d-------- C:\Program Files\Common Files\iS3
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Lavasoft
2008-01-11 18:42 . 2008-01-11 18:42 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-11 13:31 . 2006-04-04 15:45 2,400,648 --a------ C:\WINDOWS\system32\madiousb.dll
2008-01-11 13:31 . 2006-04-04 14:42 186,368 --a------ C:\WINDOWS\system32\M-AudioFastTrackControlPanelApplet.cpl
2008-01-11 13:31 . 2006-04-04 14:42 106,112 --a------ C:\WINDOWS\system32\drivers\mausbft.sys
2008-01-11 13:31 . 2006-04-04 14:42 19,456 --a------ C:\WINDOWS\system32\mausbasio.dll
2008-01-11 13:30 . 2008-01-11 13:30 <DIR> d-------- C:\Program Files\M-Audio Fast Track USB
2008-01-10 20:15 . 2008-01-15 08:44 483,328 --a------ C:\WINDOWS\system32\hphmon05.exe
2008-01-10 20:15 . 2008-01-15 08:44 155,648 --a------ C:\WINDOWS\system32\igfxtray.exe
2008-01-10 20:15 . 2008-01-15 08:44 118,784 --a------ C:\WINDOWS\system32\hkcmd.exe
2008-01-10 20:15 . 2008-01-11 13:21 99,840 --a------ C:\WINDOWS\system32\M-AudioTaskBarIcon.exe
2008-01-10 20:15 . 2008-01-12 03:26 52,736 --a------ C:\WINDOWS\system\hpsysdrv.exe
2008-01-10 18:46 . 2008-01-10 18:46 337,408 --a------ C:\WINDOWS\system32\RCX148.tmp
2008-01-10 15:41 . 2008-01-10 15:41 337,408 --a------ C:\WINDOWS\system32\RCX135.tmp
2008-01-10 11:14 . 2008-01-12 03:39 181 --a------ C:\WINDOWS\system\hpsysdrv .DAT
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\vt8
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\ob3
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\mp2
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\edcA01
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\WINDOWS\system32\che9
2008-01-10 01:41 . 2008-01-10 01:41 <DIR> d-------- C:\temp\Ryuan1
2008-01-10 01:41 . 2008-01-10 01:41 346,924 --a------ C:\temp\liHco0109.exe
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a------ C:\WINDOWS\system32\drivers\USBAUDIO.sys
2008-01-06 14:30 . 2004-08-04 00:07 59,264 --a--c--- C:\WINDOWS\system32\dllcache\usbaudio.sys
2008-01-05 16:49 . 2007-01-31 10:58 6,246 --a------ C:\WINDOWS\atty.ico
2008-01-05 16:48 . 2008-01-05 16:48 <DIR> d-------- C:\WINDOWS\Motive
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\SBC Self Support Tool
2008-01-05 16:48 . 2008-01-07 19:46 <DIR> d-------- C:\Program Files\Common Files\Motive
2008-01-05 16:48 . 2005-05-10 01:36 81,920 --a------ C:\WINDOWS\system32\W32n50.dll
2008-01-05 16:48 . 2005-05-10 01:36 17,162 --a------ C:\WINDOWS\system32\Pcandis5.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,848 --a------ C:\WINDOWS\system32\Pcandis4.sys
2008-01-05 16:48 . 2005-05-10 01:36 16,073 --a------ C:\WINDOWS\system32\Pcandis3.vxd
2008-01-05 16:30 . 2008-01-05 16:30 <DIR> d-------- C:\Program Files\BroadJump
2008-01-05 16:13 . 2001-01-12 16:09 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-01-05 16:13 . 2001-01-12 18:04 171,280 --a------ C:\WINDOWS\system32\jit.dll
2008-01-05 16:13 . 2001-01-12 18:04 139,536 --a------ C:\WINDOWS\system32\javaee.dll
2008-01-05 16:13 . 2001-01-12 18:04 46,352 --a------ C:\WINDOWS\setdebug.exe
2008-01-05 16:13 . 2001-01-12 16:27 7,315 --a------ C:\WINDOWS\system32\javasup.vxd
2008-01-05 16:13 . 2001-01-12 16:10 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-01-05 16:08 . 2007-01-31 10:58 266,240 --------- C:\WINDOWS\SBCDSL.exe
2008-01-05 16:08 . 2007-01-31 10:58 6,345 -ra------ C:\WINDOWS\system32\DevMngr.vxd

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-24 05:23 --------- d-----w C:\Program Files\MSN Messenger
2008-01-24 04:54 --------- d-----w C:\Program Files\Yahoo!
2008-01-23 15:24 --------- d-----w C:\Program Files\WildTangent
2008-01-23 15:20 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 18:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-10 16:14 498,176 ----a-w C:\WINDOWS\PCHealth\HelpCtr\Binaries\msconfig.exe.tmp
2008-01-09 16:17 --------- d-----w C:\Program Files\The Weather Channel FW
2008-01-06 19:32 --------- d-----w C:\Program Files\M-Audio
2008-01-05 21:13 155,995 ----a-w C:\WINDOWS\Java\Packages\KLFVT75N.ZIP
2007-12-19 13:24 --------- d-----w C:\Program Files\FreeSolitaire
2007-12-04 14:56 93,264 -c--a-w C:\WINDOWS\system32\drivers\aswmon.sys
2007-12-04 14:55 94,544 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys
2007-12-04 14:53 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys
2007-12-04 14:51 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys
2007-12-04 14:49 26,624 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys
2007-12-04 13:04 837,496 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-12-04 12:54 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 22:40 227,328 ----a-w C:\WINDOWS\system32\wmasf.dll
.

<pre>
----a-w         4,670,704 2008-01-11 01:50:35  C:\Program Files\Yahoo!\Messenger\YahooMessenger  .exe
----a-w         4,670,704 2008-01-22 19:32:06  C:\Program Files\Yahoo!\Messenger\YahooMessenger .exe
</pre>

((((((((((((((((((((((((((((( snapshot_2008-01-23_14.20.47.56 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460$\shell32.dll
- 2007-06-13 06:53:14 115,712 -c----w C:\WINDOWS\$NtUninstallKB943460$\xpsp3res.dll
+ 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\shell32.dll
+ 2006-12-19 21:52:18 8,453,632 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\shell32.dll.000
+ 2007-03-06 01:22:39 213,216 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\spuninst\spuninst.exe
+ 2007-03-06 01:23:47 371,424 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\spuninst\updspapi.dll
+ 2007-06-13 06:53:14 115,712 -c----w C:\WINDOWS\$NtUninstallKB943460_0$\xpsp3res.dll
+ 2007-11-20 21:04:32 1,523,536 ----a-w C:\WINDOWS\Downloaded Program Files\FP_AX_CAB_INSTALLER.exe
- 2008-01-23 18:54:25 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-25 00:02:08 1,425,408 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-25 00:02:08 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-23 18:54:26 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-25 00:02:08 1,421,312 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-23 18:54:26 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-25 00:02:08 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-23 18:54:27 4,485,120 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-25 00:02:08 4,120,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-23 18:54:27 24,576 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-25 00:02:08 139,264 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\ARPPRODUCTICON.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\googleearth.exe1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut1_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 65,536 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\NewShortcut2_407B9B5CDAC54F44A756B57CAB4E6A8B.exe
+ 2008-01-23 20:26:57 26,694 ----a-r C:\WINDOWS\Installer\{1E04F83B-2AB9-4301-9EF7-E86307F79C72}\UNINST_Uninstall_G_3DE5E7D47B88403CA3FD2017A8240C5B.exe
+ 2008-01-24 05:22:06 29,926 ----a-r C:\WINDOWS\Installer\{571700F0-DB9D-4B3A-B03D-35A14BB5939F}\MsblIco.Exe
+ 2006-06-03 11:40:49 33,792 ------w C:\WINDOWS\network diagnostic\custsat.dll
+ 2006-10-10 12:44:50 557,568 ------w C:\WINDOWS\network diagnostic\xpnetdiag.exe
- 2007-10-26 03:36:51 8,454,656 -c----w C:\WINDOWS\system32\dllcache\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 -c--a-w C:\WINDOWS\system32\dllcache\shell32.dll
- 2007-10-10 10:59:40 13,824 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2007-08-13 23:39:10 13,312 ----a-w C:\WINDOWS\system32\ieudinit.exe
+ 2005-05-24 17:27:16 213,048 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
+ 2007-08-29 20:47:20 94,208 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
+ 2007-08-29 20:49:54 950,272 ----a-w C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
- 2008-01-09 18:45:59 74,649 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
+ 2008-01-24 19:56:08 74,649 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
- 2004-08-04 07:56:43 1,392,671 -c--a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2004-02-24 02:42:40 1,386,496 ----a-w C:\WINDOWS\system32\msvbvm60.dll
+ 2008-01-19 13:13:12 32,768 ----a-w C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
- 2007-10-26 03:36:51 8,454,656 ----a-w C:\WINDOWS\system32\shell32.dll
+ 2007-10-26 03:34:01 8,460,288 ----a-w C:\WINDOWS\system32\shell32.dll
- 2005-10-12 22:11:06 118,784 ----a-w C:\WINDOWS\system32\sirenacm.dll
+ 2007-01-19 17:53:04 51,056 ----a-w C:\WINDOWS\system32\sirenacm.dll
- 2006-01-19 19:29:19 14,048 ------w C:\WINDOWS\system32\spmsg.dll
+ 2006-09-06 22:43:16 14,048 ------w C:\WINDOWS\system32\spmsg.dll
- 2005-06-28 15:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 2006-09-06 22:43:16 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe
+ 1996-01-12 23:00:00 24,576 ----a-w C:\WINDOWS\system32\STKIT432.DLL
- 2004-08-04 07:56:46 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
+ 2006-03-24 04:37:50 49,152 ----a-w C:\WINDOWS\system32\wdigest.dll
- 2007-10-29 10:26:53 115,712 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2007-10-29 10:04:03 350,720 ----a-w C:\WINDOWS\system32\xpsp3res.dll
+ 2008-01-24 23:43:31 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_4a0.dat
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe" [ ]
"NVIEW"="nview.dll" [2003-08-19 04:56 852038 C:\WINDOWS\system32\nview.dll]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2008-01-15 08:44 155648]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2008-01-15 08:44 118784]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2008-01-15 08:44 483328]
"VTTimer"="VTTimer.exe" [2003-05-08 01:32 36864 C:\WINDOWS\system32\VTTimer.exe]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"NetscapeClient"="" []
"nwiz"="nwiz.exe" [2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"F7F4FBF8FBFDF903F"="B1AEB5B2B5B7B3B.exe" []
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2007-10-26 15:42 509224]
"RegistryMechanic"="" []
"YPC"="C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe" [2005-02-11 18:14 352256]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="C:\Program Files\MySpace\IM\MySpaceIM.exe" [2007-12-18 20:47 8720384]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 18:28:24 258048]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 18:50:52 53248]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-12-15 16:48:46 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2007-01-07 14:56:00 581632]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SBC Self Support Tool.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SBC Self Support Tool.lnk
backup=C:\WINDOWS\pss\SBC Self Support Tool.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BackupNotify]
--a------ 2008-01-22 14:30 24576 c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2004-10-21 13:28 29696 C:\WINDOWS\KHALMNPR.Exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
--a------ 2008-01-11 13:21 99840 C:\WINDOWS\System32\M-AudioTaskBarIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM]
--a------ 2007-12-18 20:47 8720384 C:\Program Files\MySpace\IM\MySpaceIM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2003-08-19 04:56 323584 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2005-03-19 19:13 98304 C:\Program Files\QuickTime\qttask.exe

S1 ati1xbxxx;ati1xbxxx;C:\WINDOWS\system32\drivers\ati1xbxxx.sys []
S2 nvcap;nVidia WDM Video Capture (universal);C:\WINDOWS\system32\DRIVERS\nvcap.sys [2003-07-30 04:15]
S2 NVXBAR;nVidia WDM A/V Crossbar;C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2003-07-30 04:15]
S3 ADSFilter;ADSFilter - (Aluria Filter Driver);C:\WINDOWS\system32\DRIVERS\ADSFilter.sys []
S3 BW2NDIS5;BW2NDIS5;C:\WINDOWS\system32\Drivers\BW2NDIS5.sys []
S3 DzlUsb;Dazzle DVC USB Device;C:\WINDOWS\system32\DRIVERS\DzlUsb.sys [1999-09-17 11:28]
S3 MAUSBFT;Service for M-Audio Fast Track USB (WDM);C:\WINDOWS\system32\DRIVERS\mausbft.sys [2006-04-04 14:42]

.
Contents of the 'Scheduled Tasks' folder
"2006-10-04 22:22:46 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- C:\Program Files\Easy Internet signup\HPSdpApp.exe
"2008-01-24 22:00:00 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2008-01-24 08:00:00 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-24 19:05:11
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-24 19:05:51
ComboFix-quarantined-files.txt 2008-01-25 00:05:43
ComboFix2.txt 2008-01-24 16:45:31
ComboFix3.txt 2008-01-23 22:25:55
ComboFix4.txt 2008-01-23 19:21:05
ComboFix5.txt 2008-01-23 03:36:08
.
2008-01-22 09:02:07 --- E O F ---

 

[NELSONdeltaZERO]

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 7:06:30 PM, on 1/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\hphmon05.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe
C:\PROGRA~1\Yahoo!\YOP\yop.exe
C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Softex\OmniPass\Omniserv.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\PROGRA~1\Yahoo!\YOP\SSDK02.exe
C:\Program Files\MySpace\IM\MySpaceIM.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kim\Desktop\hijack this and other spyware stuff\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - C:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [nwiz] "nwiz.exe" /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [F7F4FBF8FBFDF903F] B1AEB5B2B5B7B3B.exe
O4 - HKLM\..\Run: [YOP] C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
O4 - HKLM\..\Run: [YPC] C:\PROGRA~1\Yahoo!\PARENT~1\ypc.exe
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoTBar.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Share in Hello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra 'Tools' menuitem: Share in H&ello - {B13B4423-2647-4cfc-A4B3-C7D56CB83487} - C:\Program Files\Hello\PicasaCapture.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: M-Audio Fast Track Installer (FastTrackInstallerService) - Avid Technology, Inc. - C:\Program Files\M-Audio\Fast Track USB\MAUSBFTInst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Softex OmniPass Service (omniserv) - Unknown owner - C:\Program Files\Softex\OmniPass\Omniserv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

--
End of file - 8276 bytes