vertumonde virus

G

Godofwar15

New member
hi sorry to have to use this again i tried to download a certen torrent and it contained a virus. personally i was told that torrents didn't contain viruses its a great free download and now i know he was wrong so im not using torrents again. but still i am stuck with this stupid virus vertumonde and can seem to remove it here is the codes for hijack this





ogfile of HijackThis v1.99.1
Scan saved at 9:23:43 PM, on 17/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WIN_XP\System32\smss.exe
C:\WIN_XP\system32\winlogon.exe
C:\WIN_XP\system32\services.exe
C:\WIN_XP\system32\lsass.exe
C:\WIN_XP\system32\svchost.exe
C:\WIN_XP\System32\svchost.exe
C:\WIN_XP\Explorer.EXE
C:\WIN_XP\system32\netdde.exe
C:\WIN_XP\system32\nvsvc32.exe
C:\WIN_XP\system32\RUNDLL32.EXE
C:\WIN_XP\system32\rundll32.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\WIN_XP\system32\ploecclw.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F3 - REG:win.ini: load=C:\WIN_XP\system32\ssqro.exe
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIN_XP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WIN_XP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [74593a2b] rundll32.exe "C:\WIN_XP\system32\xudlervk.dll",b
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA3762] command /c del "C:\WIN_XP\system32\ploecclw.exe_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9604] cmd /c del "C:\WIN_XP\system32\ploecclw.exe_tobedeleted_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7330] command /c del "C:\WIN_XP\system32\ssqro.dll_tobedeleted"
O4 - HKLM\..\RunOnce: [SpybotDeletingC4198] cmd /c del "C:\WIN_XP\system32\ssqro.dll_tobedeleted"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows Update] C:\Documents and Settings\AndrewM\Application Data\svchost.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB202] command /c del "C:\WIN_XP\system32\ploecclw.exe_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD5568] cmd /c del "C:\WIN_XP\system32\ploecclw.exe_tobedeleted_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingB9067] command /c del "C:\WIN_XP\system32\ssqro.dll_tobedeleted"
O4 - HKCU\..\RunOnce: [SpybotDeletingD634] cmd /c del "C:\WIN_XP\system32\ssqro.dll_tobedeleted"
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WIN_XP\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WIN_XP\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C45577E-8FA0-4BFD-BF25-49EC394BA62C}: NameServer = 64.71.255.198
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WIN_XP\system32\nvsvc32.exe
 
alerts

i keep getting these annoying alerts that part of my system is missing and sometimes theres a little message at the tool bar that says to download something. i don't. my system is really slowed down please help me.
 
Hi Godofwar15

Rename HijackThis.exe to Godofwar.exe and post back a fresh HijackThis.exe, please :)
 
thank u

ok i did and with a updated version too heres the codes



ogfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:01 PM, on 24/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WIN_XP\System32\smss.exe
C:\WIN_XP\system32\winlogon.exe
C:\WIN_XP\system32\services.exe
C:\WIN_XP\system32\lsass.exe
C:\WIN_XP\system32\svchost.exe
C:\WIN_XP\System32\svchost.exe
C:\WIN_XP\system32\bsobnfya.exe
C:\WIN_XP\system32\netdde.exe
C:\WIN_XP\system32\nvsvc32.exe
C:\WIN_XP\Explorer.EXE
C:\WIN_XP\system32\RUNDLL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\godofwar.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F3 - REG:win.ini: load=C:\WIN_XP\system32\ssqro.exe
O2 - BHO: {a49e5281-6572-392b-1c34-88e2d722b931} - {139b227d-2e88-43c1-b293-27561825e94a} - C:\WIN_XP\system32\fmfqyfuk.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: (no name) - {7479007C-413F-4E93-A13A-D75473864F6B} - C:\WIN_XP\system32\ssqro.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WIN_XP\system32\afodvowp.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O2 - BHO: (no name) - {E1E1D3A0-66EA-46D2-BBCF-43730668E1EB} - C:\WIN_XP\system32\xxyaayx.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIN_XP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WIN_XP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [74593a2b] rundll32.exe "C:\WIN_XP\system32\ayejwulm.dll",b
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Windows Update] C:\Documents and Settings\AndrewM\Application Data\svchost.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WIN_XP\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WIN_XP\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\win_xp\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C45577E-8FA0-4BFD-BF25-49EC394BA62C}: NameServer = 64.71.255.198
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O20 - Winlogon Notify: afodvowp - C:\WIN_XP\SYSTEM32\afodvowp.dll
O20 - Winlogon Notify: xxyaayx - C:\WIN_XP\SYSTEM32\xxyaayx.dll
O23 - Service: DomainService - - C:\WIN_XP\system32\bsobnfya.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WIN_XP\system32\nvsvc32.exe

--
End of file - 5582 bytes
 
Hi

1. Download combofix from any of these links and save it to Desktop:
Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here

Post:

- a fresh HijackThis log
- combofix report
 
combo fix

yea combo fix took from 9:23 am to 11:50 am it was long but anyways here it is in a nut shell

ComboFix 08-01-23.1C - AndrewM 2008-01-25 9:25:06.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.308 [GMT -5:00]
Running from: C:\Documents and Settings\AndrewM\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WIN_XP\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users.WIN_XP\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\AndrewM\Application Data\svchost .exe
C:\Documents and Settings\AndrewM\Application Data\svchost.exe
C:\Documents and Settings\AndrewM\My Documents\pos1000.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1001.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1002.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1003.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1004.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1005.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1006.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1007.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1008.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1009.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100A.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100B.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100C.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100D.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100E.tmp
C:\Documents and Settings\AndrewM\My Documents\pos100F.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1010.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1011.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1012.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1013.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1014.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1015.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1016.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1017.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1018.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1019.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101A.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101B.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101C.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101D.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101E.tmp
C:\Documents and Settings\AndrewM\My Documents\pos101F.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1020.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1021.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1022.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1023.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1024.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1025.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1026.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1027.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1028.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1029.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102A.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102B.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102C.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102D.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102E.tmp
C:\Documents and Settings\AndrewM\My Documents\pos102F.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1030.tmp
C:\Documents and Settings\AndrewM\My Documents\pos1031.tmp

and that continues for about 300 more lines (wiled guess but its a good one) until here

C:\Documents and Settings\AndrewM\My Documents\posFFB.tmp
C:\Documents and Settings\AndrewM\My Documents\posFFC.tmp
C:\Documents and Settings\AndrewM\My Documents\posFFD.tmp
C:\Documents and Settings\AndrewM\My Documents\posFFE.tmp
C:\Documents and Settings\AndrewM\My Documents\posFFF.tmp
:\pos10.tmp
C:\pos100.tmp
C:\pos1000.tmp
C:\pos1001.tmp
C:\pos1002.tmp
C:\pos1003.tmp
C:\pos1004.tmp
C:\pos1005.tmp
C:\pos1006.tmp
C:\pos1007.tmp
C:\pos1008.tmp
C:\pos1009.tmp
C:\pos100A.tmp
C:\pos100B.tmp
C:\pos100C.tmp
C:\pos100D.tmp
C:\pos100E.tmp
C:\pos100F.tmp
C:\pos101.tmp
C:\pos1010.tmp
C:\pos1011.tmp
C:\pos1012.tmp
C:\pos1013.tmp
C:\pos1014.tmp
C:\pos1015.tmp
C:\pos1016.tmp
C:\pos1017.tmp
C:\pos1018.tmp
C:\pos1019.tmp
C:\pos101A.tmp
C:\pos101B.tmp
C:\pos101C.tmp
C:\pos101D.tmp
C:\pos101E.tmp
C:\pos101F.tmp
C:\pos102.tmp
C:\pos1020.tmp
C:\pos1021.tmp
C:\pos1022.tmp
C:\pos1023.tmp
C:\pos1024.tmp

and that continues on forever (guessing 700 lines) until

C:\posFFB.tmp
C:\posFFC.tmp
C:\posFFD.tmp
C:\posFFE.tmp
C:\posFFF.tmp
C:\Program Files\Messenger\msmsgs .exe
C:\Program Files\Messenger\msmsgs.exe
C:\WIN_XP\system32\afodvowp.dll
C:\WIN_XP\system32\afodvowp.dllbox
C:\WIN_XP\system32\ayejwulm.dll
C:\WIN_XP\system32\bsobnfya.exe
C:\WIN_XP\system32\fmfqyfuk.dll
C:\WIN_XP\system32\fwyywlik.dll
C:\WIN_XP\system32\kbdkyr.dll
C:\WIN_XP\system32\kilwyywf.ini
C:\WIN_XP\system32\kjbezjlc.dllbox
C:\WIN_XP\system32\kljlgkik.dll
C:\WIN_XP\system32\ljjhiff.dll
C:\WIN_XP\system32\mcrh.tmp
C:\WIN_XP\system32\mluwjeya.ini
C:\WIN_XP\system32\obtdomut.dll
C:\WIN_XP\system32\orqss.ini
C:\WIN_XP\system32\orqss.ini2
C:\WIN_XP\system32\RCX8.tmp
C:\WIN_XP\system32\rqroopm.dll
C:\WIN_XP\system32\ssqro.dll
C:\WIN_XP\system32\ssqro.exe
C:\WIN_XP\system32\wvusrqn.dll
C:\WIN_XP\system32\xxyaayx.dll
C:\WIN_XP\system32\ypmytjxr.dll

Code: 
 <pre>
C:\Documents and Settings\AndrewM\Application Data\svchost .exe ---> QooBox
C:\Program Files\Messenger\msmsgs .exe ---> QooBox
</pre>
.
----- BITS: Possible infected sites -----

hxxp://gpdl.google.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-12-25 to 2008-01-25 )))))))))))))))))))))))))))))))
.

2008-01-22 20:11 . 2008-01-22 20:11 348,160 --a------ C:\WIN_XP\system32\RCX1984.tmp
2008-01-19 10:12 . 2008-01-19 10:12 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-17 20:08 . 2008-01-18 23:26 1,075,822 ---hs---- C:\WIN_XP\system32\kvreldux.ini
2008-01-16 18:53 . 2008-01-22 21:00 543 --a------ C:\WIN_XP\wininit.ini
2008-01-12 22:36 . 2008-01-12 22:36 <DIR> d-------- C:\SW_BtlFrnt
2008-01-12 22:35 . 2008-01-12 22:35 <DIR> d-------- C:\Program Files\Google
2008-01-01 19:41 . 2008-01-01 19:41 <DIR> d--hs---- C:\FOUND.001
2008-01-01 19:07 . 2008-01-01 19:07 1,228,800 --a------ C:\WIN_XP\WoW Glider Cracked.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-16 19:58 --------- d-----w C:\Program Files\otron.net
2007-12-16 19:57 --------- d-----w C:\Program Files\Bonjour
2007-12-16 19:56 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2007-12-07 18:19 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-07-25 19:58 6,506 --sh--w C:\WIN_XP\system32\xyadd.bak1
2007-10-20 15:21 1,682 --sha-w C:\WIN_XP\system32\KGyGaAvL.sys
2007-05-22 03:10 56 --sh--r C:\WIN_XP\system32\C28E09FCD9.sys
2005-08-02 21:46 187,904 --sha-r C:\WIN_XP\QW5kcmV3IE0u\asappsrv.dll
2005-08-02 21:58 293,888 --sha-r C:\WIN_XP\QW5kcmV3IE0u\command.exe
2005-07-29 21:24 472 --sha-r C:\WIN_XP\QW5kcmV3IE0u\kqc4wApaKHXR.vbs
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 15:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11D4-9B18-009027A5CD4F}
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 15:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WIN_XP\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WIN_XP\system32\nwiz.exe]
"NvMediaCenter"="C:\WIN_XP\system32\NvMcTray.dll" [2007-10-04 17:14 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WIN_XP\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-07-27 02:00 145920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WIN_XP\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WIN_XP\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WIN_XP\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^AndrewM^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\AndrewM\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WIN_XP\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^AndrewM^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\AndrewM\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WIN_XP\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2007-07-27 02:00 416256 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-03 23:56 15360 C:\WIN_XP\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2007-08-16 07:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMOFFICE4DMOUSE]
--a------ 2007-04-22 19:53 360448 C:\Program Files\Micro Innovations\Optical Navigator Mouse\mouse32a.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]
C:\Program Files\Ipwindows\ipwins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Location Finder]
--a------ 2005-08-24 18:25 101080 C:\Program Files\Microsoft Location Finder\LocationFinder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-10-04 17:14 8491008 C:\WIN_XP\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-10-04 17:14 81920 C:\WIN_XP\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-10-04 17:14 1626112 C:\WIN_XP\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-22 19:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 18:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-27 16:05 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VortexTray]
--a------ 2000-08-09 08:59 241664 C:\WIN_XP\au30setp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]
C:\Program Files\webHancer\Programs\whagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 00:28 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{74593A84-063B-4105-0220-040514030002}]
C:\Program Files\Common Files\{74593A84-063B-4105-0220-040514030002}\Update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{74593A84-063C-4105-0220-040514030002}]
C:\Program Files\Common Files\{74593A84-063C-4105-0220-040514030002}\Update.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=2 (0x2)
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"GoogleDesktopManager-093007-112848"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)

R3 wdm_au8830;Aureal Vortex 8830 Audio Driver (WDM);C:\WIN_XP\system32\drivers\adm8830.sys [2001-08-17 12:19]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CF545AF2-E046-E360-B07C-F00050000C01}]
C:\Documents and Settings\AndrewM\Application Data\svchost.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-10-24 01:46:18 C:\WIN_XP\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-25 11:43:52
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-25 11:48:51 - machine was rebooted
ComboFix2.txt 2007-06-24 21:54:02
ComboFix-quarantined-files.txt 2008-01-25 16:48:50

thats the combo fix long in a nut shell i decided to shorten it up because i real dont think you need to know stuff like
C:\posFF8.tmp 1,000 more times if you do then just ask in the form and i will give you it all
 
hyjackthis

weird my local disk icon changed form the usual local disk icon to the hand of the icon with a a large red X well anyways here is the long and so far it seems that i haven't goten the error pop ups so i think it might have got it




logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:08:03 PM, on 25/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WIN_XP\System32\smss.exe
C:\WIN_XP\system32\winlogon.exe
C:\WIN_XP\system32\services.exe
C:\WIN_XP\system32\lsass.exe
C:\WIN_XP\system32\svchost.exe
C:\WIN_XP\System32\svchost.exe
C:\WIN_XP\system32\netdde.exe
C:\WIN_XP\system32\nvsvc32.exe
C:\WIN_XP\Explorer.EXE
C:\WIN_XP\system32\RUNDLL32.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\godofwar.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIN_XP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WIN_XP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WIN_XP\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WIN_XP\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\win_xp\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C45577E-8FA0-4BFD-BF25-49EC394BA62C}: NameServer = 64.71.255.198
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WIN_XP\system32\nvsvc32.exe

--
End of file - 4666 bytes
 
Hi

Before we continue cleaning process, you will need to install antivirus:

Looking over your log, it seems you don't have any evidence of an anti-virus software.

Anti-virus software are programs that detect, cleanse, and erase harmful virus files on a computer, Web server, or network. Unchecked, virus files can unintentionally be forwarded to others, including trading partners and thereby spreading infection. Because new viruses regularly emerge, anti-virus software should be updated frequently. Anti-virus software can scan the computer memory and disk drives for malicious code. They can alert the user if a virus is present, and will clean, delete (or quarantine) infected files or directories. Please download a free anti-virus software from one these excellent vendors NOW:

1) Antivir PersonalEdition Classic - Free anti-virus software for Windows. Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition - Anti-virus program for Windows. The home edition is freeware for noncommercial users.
3) AVG Anti-Virus Free Edition - Free edition of the AVG anti-virus program for Windows.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts. If you choose to install more than one antivirus program on your computer, then only one of them should be active in memory at a time.

After that, please post a fresh HijackThis log :)
 
thank you

well i got a new anti virus program that found 171 viruses i wouldnt have ever guessed that much so i think its realy good the only thing is that it slows my computer down but small sacrifice for a safe comp well thank u here is the codes


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:15:39 PM, on 25/01/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WIN_XP\System32\smss.exe
C:\WIN_XP\system32\winlogon.exe
C:\WIN_XP\system32\services.exe
C:\WIN_XP\system32\lsass.exe
C:\WIN_XP\system32\svchost.exe
C:\WIN_XP\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WIN_XP\system32\netdde.exe
C:\WIN_XP\system32\nvsvc32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WIN_XP\Explorer.EXE
C:\WIN_XP\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Trend Micro\HijackThis\godofwar.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIN_XP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WIN_XP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WIN_XP\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WIN_XP\system32\GPhotos.scr/200
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\win_xp\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C45577E-8FA0-4BFD-BF25-49EC394BA62C}: NameServer = 64.71.255.198
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WIN_XP\system32\nvsvc32.exe

--
End of file - 5416 bytes
 
Hi

Yes, it's a small price from keeping your computer clean :)

Open notepad and copy/paste the text in the quotebox below into it:

Code: 
File::
C:\WIN_XP\system32\RCX1984.tmp
C:\WIN_XP\system32\kvreldux.ini
C:\WIN_XP\system32\xyadd.bak1

Folder::
C:\WIN_XP\QW5kcmV3IE0u

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IpWins]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{74593A84-063B-4105-0220-040514030002}]

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{74593A84-063C-4105-0220-040514030002}]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"cmdService"=-

Save this as "CFScript"

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScript.gif


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.
 
ok the log of combofix


ComboFix 08-01-23.1C - AndrewM 2008-01-26 12:10:01.2 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.281 [GMT -5:00]
Running from: C:\Documents and Settings\AndrewM\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\AndrewM\Desktop\cfscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\WIN_XP\system32\kvreldux.ini
C:\WIN_XP\system32\RCX1984.tmp
C:\WIN_XP\system32\xyadd.bak1
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WIN_XP\QW5kcmV3IE0u
C:\WIN_XP\system32\kvreldux.ini
C:\WIN_XP\system32\xyadd.bak1

.
((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-25 12:49 . 2008-01-25 12:49 <DIR> d-------- C:\Program Files\Alwil Software
2008-01-25 12:49 . 2007-12-04 08:04 837,496 --a------ C:\WIN_XP\system32\aswBoot.exe
2008-01-25 12:49 . 2004-01-09 04:13 380,928 --a------ C:\WIN_XP\system32\actskin4.ocx
2008-01-25 12:49 . 2007-12-04 07:54 95,608 --a------ C:\WIN_XP\system32\AvastSS.scr
2008-01-25 12:49 . 2007-12-04 09:55 94,544 --a------ C:\WIN_XP\system32\drivers\aswmon2.sys
2008-01-25 12:49 . 2007-12-04 09:56 93,264 --a------ C:\WIN_XP\system32\drivers\aswmon.sys
2008-01-25 12:49 . 2007-12-04 09:51 42,912 --a------ C:\WIN_XP\system32\drivers\aswTdi.sys
2008-01-25 12:49 . 2007-12-04 09:49 26,624 --a------ C:\WIN_XP\system32\drivers\aavmker4.sys
2008-01-25 12:49 . 2007-12-04 09:53 23,152 --a------ C:\WIN_XP\system32\drivers\aswRdr.sys
2008-01-19 10:12 . 2008-01-19 10:12 <DIR> d-------- C:\Program Files\Trend Micro
2008-01-16 18:53 . 2008-01-22 21:00 543 --a------ C:\WIN_XP\wininit.ini
2008-01-12 22:36 . 2008-01-12 22:36 <DIR> d-------- C:\SW_BtlFrnt
2008-01-12 22:35 . 2008-01-12 22:35 <DIR> d-------- C:\Program Files\Google
2008-01-01 19:41 . 2008-01-01 19:41 <DIR> d--hs---- C:\FOUND.001
2008-01-01 19:07 . 2008-01-01 19:07 1,228,800 --a------ C:\WIN_XP\WoW Glider Cracked.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-16 19:57 --------- d-----w C:\Program Files\Bonjour
2007-12-16 19:56 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2007-12-07 18:19 --------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-10-20 15:21 1,682 --sha-w C:\WIN_XP\system32\KGyGaAvL.sys
2007-05-22 03:10 56 --sh--r C:\WIN_XP\system32\C28E09FCD9.sys
.

((((((((((((((((((((((((((((( snapshot@2008-01-25_11.44.49.40 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-25 14:22:58 1,445,888 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 17:09:24 1,449,984 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-25 14:22:58 8,192 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-26 17:09:24 8,192 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-25 14:23:00 1,449,984 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-26 17:09:24 1,449,984 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-25 14:23:00 8,192 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-26 17:09:26 8,192 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-25 14:23:00 5,308,416 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-26 17:09:28 5,292,032 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-25 14:23:00 212,992 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 17:09:28 212,992 ----a-w C:\WIN_XP\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 17:15:20 16,384 ----a-w C:\WIN_XP\TEMP\Perflib_Perfdata_684.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 15:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 15:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WIN_XP\system32\NvCpl.dll" [2007-10-04 17:14 8491008]
"nwiz"="nwiz.exe" [2007-10-04 17:14 1626112 C:\WIN_XP\system32\nwiz.exe]
"NvMediaCenter"="C:\WIN_XP\system32\NvMcTray.dll" [2007-10-04 17:14 81920]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 08:00 79224]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WIN_XP\system32\CTFMON.EXE" [2004-08-03 23:56 15360]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-07-27 02:00 145920]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WIN_XP\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Google Updater.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Google Updater.lnk
backup=C:\WIN_XP\pss\Google Updater.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WIN_XP^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users.WIN_XP\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WIN_XP\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^AndrewM^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=C:\Documents and Settings\AndrewM\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=C:\WIN_XP\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^AndrewM^Start Menu^Programs^Startup^PowerReg Scheduler V3.exe]
path=C:\Documents and Settings\AndrewM\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe
backup=C:\WIN_XP\pss\PowerReg Scheduler V3.exeStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
--a------ 2007-07-27 02:00 416256 C:\PROGRA~1\Grisoft\AVG7\avgcc.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
--a------ 2004-08-03 23:56 15360 C:\WIN_XP\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2007-08-16 07:24 167368 C:\Program Files\DAEMON Tools\daemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FLMOFFICE4DMOUSE]
--a------ 2007-04-22 19:53 360448 C:\Program Files\Micro Innovations\Optical Navigator Mouse\mouse32a.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Location Finder]
--a------ 2005-08-24 18:25 101080 C:\Program Files\Microsoft Location Finder\LocationFinder.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2007-10-04 17:14 8491008 C:\WIN_XP\system32\NvCpl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
--a------ 2007-10-04 17:14 81920 C:\WIN_XP\system32\nvmctray.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-10-04 17:14 1626112 C:\WIN_XP\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
--a------ 2007-10-22 19:47 360448 C:\Program Files\Winamp Remote\bin\OrbTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\Core\smax4pnp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-06-14 18:32 132760 C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-09-27 16:05 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VortexTray]
--a------ 2000-08-09 08:59 241664 C:\WIN_XP\au30setp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\webHancer Agent]
C:\Program Files\webHancer\Programs\whagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
--a------ 2007-10-10 00:28 36352 C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"usnjsvc"=3 (0x3)
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"AVGEMS"=2 (0x2)
"Avg7UpdSvc"=2 (0x2)
"Avg7Alrt"=2 (0x2)
"GoogleDesktopManager-093007-112848"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)

R3 wdm_au8830;Aureal Vortex 8830 Audio Driver (WDM);C:\WIN_XP\system32\drivers\adm8830.sys [2001-08-17 12:19]


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CF545AF2-E046-E360-B07C-F00050000C01}]
C:\Documents and Settings\AndrewM\Application Data\svchost.exe
.
Contents of the 'Scheduled Tasks' folder
"2007-10-24 01:46:18 C:\WIN_XP\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 12:16:41
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-26 12:22:17 - machine was rebooted
ComboFix3.txt 2007-06-24 21:54:02
ComboFix-quarantined-files.txt 2008-01-26 17:22:16
ComboFix2.txt 2008-01-25 16:48:54
 
ok weird now its back to the red X anyways heres the log

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WIN_XP\System32\smss.exe
C:\WIN_XP\system32\winlogon.exe
C:\WIN_XP\system32\services.exe
C:\WIN_XP\system32\lsass.exe
C:\WIN_XP\system32\svchost.exe
C:\WIN_XP\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WIN_XP\system32\netdde.exe
C:\WIN_XP\system32\nvsvc32.exe
C:\WIN_XP\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WIN_XP\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\godofwar.exe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://runonce.msn.com/?v=msgrv75
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.ca/0SEENCA/SAOS01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WIN_XP\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WIN_XP\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WIN_XP\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users.WIN_XP\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WIN_XP\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O10 - Unknown file in Winsock LSP: c:\win_xp\system32\nwprovau.dll
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3C45577E-8FA0-4BFD-BF25-49EC394BA62C}: NameServer = 64.71.255.198
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~3\GOEC62~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WIN_XP\system32\nvsvc32.exe

--
End of file - 4944 bytes
 
Hi

Please check next if you can find this file:

C:\Documents and Settings\AndrewM\Application Data\svchost.exe
 
Hi

Yes, but those are legit files :)

First we'll need to backup registry:

Start -> Run -> regedit -> ok. Then File -> Export. Give it a name and press Save.

Save text below as fix.reg on Notepad (save it as all files (*.*)) on Desktop

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{CF545AF2-E046-E360-B07C-F00050000C01}]

It should look like this ->
reg.gif


Doubleclick fix.reg, press Yes and ok.

(In case you are unsure how to create a reg file, take a look here with screenshots.)

Reboot.

Save this to desktop and run it.

Let me know if now local disk icon is back to normal?
 
Last edited:
You must log in or register to reply here.
Back
Top